Summary:


NtAddAtom(>) 
 1 
NtSetInformationFile(>) 
 1 
NtQueryInformationFile(>) 
 3 
NtOpenThreadTokenEx(>) 
 14 

NtCallbackReturn(>) 
 1 
NtSetInformationProcess(>) 
 1 
NtUserRegisterWindowMessage(>) 
 3 
NtCreateSection(>) 
 16 

NtConnectPort(>) 
 1 
NtSetInformationThread(>) 
 1 
NtQueryDefaultLocale(>) 
 4 
NtQueryInformationToken(>) 
 18 

NtCreateSemaphore(>) 
 1 
NtTestAlert(>) 
 1 
NtQueryKey(>) 
 4 
NtQueryAttributesFile(>) 
 21 

NtEnumerateValueKey(>) 
 1 
NtUserGetDC(>) 
 1 
NtSetInformationObject(>) 
 4 
NtOpenSection(>) 
 22 

NtFsControlFile(>) 
 1 
NtUserGetGUIThreadInfo(>) 
 1 
NtSetValueKey(>) 
 4 
NtQuerySystemInformation(>) 
 26 

NtGdiCreateBitmap(>) 
 1 
NtUserGetObjectInformation(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtOpenFile(>) 
 27 

NtGdiCreatePatternBrushInternal(>) 
 1 
NtUserGetProcessWindowStation(>) 
 1 
NtOpenProcessToken(>) 
 6 
NtMapViewOfSection(>) 
 34 

NtGdiInit(>) 
 1 
NtUserGetThreadDesktop(>) 
 1 
NtQueryInformationProcess(>) 
 7 
NtUserFindExistingCursorIcon(>) 
 50 

NtGdiQueryFontAssocInfo(>) 
 1 
NtCreateFile(>) 
 2 
NtQuerySection(>) 
 7 
NtAllocateVirtualMemory(>) 
 52 

NtGdiSelectBitmap(>) 
 1 
NtCreateKey(>) 
 2 
NtQueryVolumeInformationFile(>) 
 7 
NtUserRegisterClassExWOW(>) 
 61 

NtOpenEvent(>) 
 1 
NtDuplicateObject(>) 
 2 
NtQueryDefaultUILanguage(>) 
 8 
NtFlushInstructionCache(>) 
 73 

NtOpenKeyedEvent(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtQueryDebugFilterState(>) 
 9 
NtOpenKey(>) 
 111 

NtOpenProcess(>) 
 1 
NtGdiHfontCreate(>) 
 2 
NtUnmapViewOfSection(>) 
 9 
NtClose(>) 
 143 

NtOpenSymbolicLinkObject(>) 
 1 
NtNotifyChangeKey(>) 
 2 
NtUserCallNoParam(>) 
 9 
NtProtectVirtualMemory(>) 
 146 

NtQueryInstallUILanguage(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtRequestWaitReplyPort(>) 
 10 
NtQueryValueKey(>) 
 152 

NtQueryObject(>) 
 1 
NtWaitForSingleObject(>) 
 2 
NtUserGetWindowDC(>) 
 10 
NtContinue(>) 
 1906 

NtQueryPerformanceCounter(>) 
 1 
NtAccessCheck(>) 
 3 
NtUserCallOneParam(>) 
 12 
NtQueryVirtualMemory(>) 
 1910 

NtQuerySymbolicLinkObject(>) 
 1 
NtCreateEvent(>) 
 3 
NtUserSystemParametersInfo(>) 
 12 

NtRegisterThreadTerminatePort(>) 
 1 
NtDeviceIoControlFile(>) 
 3 
NtFreeVirtualMemory(>) 
 13 

NtSecureConnectPort(>) 
 1 

Trace:
 00001   484   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... ) }, 0, 32, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00003   484   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00004   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00005   484   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00006   484   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00007   484   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00008   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00009   484   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00010   484   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00011   484   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00012   484   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00013   484   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00014   484   NtClose  (12, ... ) == 0x0
 00015   484   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00016   484   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00017   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00020   484   NtClose  (16, ... ) == 0x0
 00021   484   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00022   484   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00023   484   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00024   484   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00025   484   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00026   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00027   484   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00028   484   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00029   484   NtClose  (16, ... ) == 0x0
 00030   484   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00031   484   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00032   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00033   484   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00034   484   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00035   484   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6\31\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 860, 484, 57959, 0} "`\375\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 860, 484, 57959, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6\31\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 860, 484, 57959, 0} "`\375\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00036   484   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00037   484   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00038   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00039   484   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00040   484   NtClose  (16, ... ) == 0x0
 00041   484   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00042   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00043   484   NtClose  (16, ... ) == 0x0
 00044   484   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00045   484   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00046   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00047   484   NtClose  (16, ... ) == 0x0
 00048   484   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00049   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00050   484   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00051   484   NtClose  (16, ... ) == 0x0
 00052   484   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00053   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00054   484   NtClose  (16, ... ) == 0x0
 00055   484   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00056   484   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00057   484   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00058   484   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00059   484   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6\31\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ... {24, 52, reply, 0, 860, 484, 57960, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" )  ... {24, 52, reply, 0, 860, 484, 57960, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6\31\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ... {24, 52, reply, 0, 860, 484, 57960, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" )  ) == 0x0
 00060   484   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 860, 484, 57961, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 860, 484, 57961, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 860, 484, 57961, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00061   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 128, ) == 0x0
 00062   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 128, ... (0x480000), 94208, 4, ) == 0x0
 00063   484   NtFlushInstructionCache  (-1, 4718592, 94208, ... ) == 0x0
 00064   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00065   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00066   484   NtClose  (16, ... ) == 0x0
 00067   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00068   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00069   484   NtClose  (16, ... ) == 0x0
 00070   484   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00071   484   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00072   484   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00073   484   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00074   484   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00075   484   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00076   484   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00077   484   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00078   484   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00079   484   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00080   484   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00081   484   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00082   484   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00083   484   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00084   484   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00085   484   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00086   484   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00087   484   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00088   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0
 00089   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0
 00090   484   NtFlushInstructionCache  (-1, 4718592, 94208, ... ) == 0x0
 00091   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "advapi32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00092   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00093   484   NtClose  (16, ... ) == 0x0
 00094   484   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00095   484   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00096   484   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00097   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00098   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00099   484   NtClose  (16, ... ) == 0x0
 00100   484   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00101   484   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00102   484   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00103   484   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00104   484   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00105   484   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00106   484   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00107   484   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00108   484   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00109   484   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00110   484   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00111   484   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00112   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0
 00113   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0
 00114   484   NtFlushInstructionCache  (-1, 4718592, 94208, ... ) == 0x0
 00115   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "oleaut32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00116   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00117   484   NtClose  (16, ... ) == 0x0
 00118   484   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00119   484   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00120   484   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00121   484   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00122   484   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00123   484   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00124   484   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00125   484   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00126   484   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00127   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00128   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00129   484   NtClose  (16, ... ) == 0x0
 00130   484   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00131   484   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00132   484   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00133   484   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00134   484   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00135   484   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00136   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ole32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00137   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0
 00138   484   NtClose  (16, ... ) == 0x0
 00139   484   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00140   484   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00141   484   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00142   484   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00143   484   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00144   484   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00145   484   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00146   484   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00147   484   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00148   484   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00149   484   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00150   484   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00151   484   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00152   484   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00153   484   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00154   484   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00155   484   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00156   484   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00157   484   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00158   484   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00159   484   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00160   484   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00161   484   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00162   484   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00163   484   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00164   484   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00165   484   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00166   484   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00167   484   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00168   484   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00169   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0
 00170   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0
 00171   484   NtFlushInstructionCache  (-1, 4718592, 94208, ... ) == 0x0
 00172   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0
 00173   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0
 00174   484   NtFlushInstructionCache  (-1, 4718592, 94208, ... ) == 0x0
 00175   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "shell32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00176   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c9c0000), 0x0, 8482816, ) == 0x0
 00177   484   NtClose  (16, ... ) == 0x0
 00178   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00179   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00180   484   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00181   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00182   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00183   484   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00184   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00185   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00186   484   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00187   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00188   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00189   484   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00190   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00191   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00192   484   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00193   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00194   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00195   484   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00196   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00197   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 00198   484   NtClose  (16, ... ) == 0x0
 00199   484   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00200   484   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00201   484   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00202   484   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00203   484   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00204   484   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00205   484   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00206   484   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00207   484   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00208   484   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00209   484   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00210   484   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00211   484   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00212   484   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00213   484   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00214   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00215   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00216   484   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00217   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00218   484   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00219   484   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00220   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0
 00221   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0
 00222   484   NtFlushInstructionCache  (-1, 4718592, 94208, ... ) == 0x0
 00223   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00224   484   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00225   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\ws2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00226   484   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00227   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ws2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == 0x0
 00228   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ws2_32.dll"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00229   484   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00230   484   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00231   484   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00232   484   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00233   484   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00234   484   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00235   484   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00236   484   NtClose  (36, ... ) == 0x0
 00237   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00238   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00239   484   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00240   484   NtClose  (36, ... ) == 0x0
 00241   484   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   484   NtClose  (32, ... ) == 0x0
 00243   484   NtClose  (16, ... ) == 0x0
 00244   484   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00245   484   NtClose  (28, ... ) == 0x0
 00246   484   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00247   484   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00248   484   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00249   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00250   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00251   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == 0x0
 00252   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00253   484   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 16, ) == 0x0
 00254   484   NtQuerySection  (16, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00255   484   NtClose  (28, ... ) == 0x0
 00256   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00257   484   NtClose  (16, ... ) == 0x0
 00258   484   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00259   484   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00260   484   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00261   484   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00262   484   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00263   484   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00264   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0
 00265   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0
 00266   484   NtFlushInstructionCache  (-1, 4718592, 94208, ... ) == 0x0
 00267   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0
 00268   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0
 00269   484   NtFlushInstructionCache  (-1, 4718592, 94208, ... ) == 0x0
 00270   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0
 00271   484   NtProtectVirtualMemory  (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0
 00272   484   NtFlushInstructionCache  (-1, 4718592, 94208, ... ) == 0x0
 00273   484   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00274   484   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00275   484   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00276   484   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00277   484   NtClose  (16, ... ) == 0x0
 00278   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00279   484   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00280   484   NtClose  (16, ... ) == 0x0
 00281   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00282   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00283   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00284   484   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 1242384, 0, 1242028}  (24, {28, 56, new_msg, 0, 0, 1242384, 0, 1242028} "\210\6\31\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 860, 484, 57962, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 860, 484, 57962, 0}  (24, {28, 56, new_msg, 0, 0, 1242384, 0, 1242028} "\210\6\31\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 860, 484, 57962, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00285   484   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00286   484   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00287   484   NtClose  (16, ... ) == 0x0
 00288   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239420, ... ) }, 1239420, ... ) == 0x0
 00289   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00290   484   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 16, ... 28, ) == 0x0
 00291   484   NtClose  (16, ... ) == 0x0
 00292   484   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x4a0000), 0x0, 110592, ) == 0x0
 00293   484   NtClose  (28, ... ) == 0x0
 00294   484   NtUnmapViewOfSection  (-1, 0x4a0000, ... ) == 0x0
 00295   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239328, ... ) }, 1239328, ... ) == 0x0
 00296   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00297   484   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 16, ) == 0x0
 00298   484   NtClose  (28, ... ) == 0x0
 00299   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x4a0000), 0x0, 110592, ) == 0x0
 00300   484   NtClose  (16, ... ) == 0x0
 00301   484   NtUnmapViewOfSection  (-1, 0x4a0000, ... ) == 0x0
 00302   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239636, ... ) }, 1239636, ... ) == 0x0
 00303   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00304   484   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00305   484   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00306   484   NtClose  (16, ... ) == 0x0
 00307   484   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00308   484   NtClose  (28, ... ) == 0x0
 00309   484   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00310   484   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00311   484   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00312   484   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00313   484   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00314   484   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00315   484   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00316   484   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00317   484   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00318   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00319   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00320   484   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00321   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236552, ... ) }, 1236552, ... ) == 0x0
 00322   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00323   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00324   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00325   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advapi32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00326   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00327   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00328   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oleaut32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00329   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00330   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shell32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00331   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00332   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00333   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239956, ... ) }, 1239956, ... ) == 0x0
 00334   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00335   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 28, ) }, ... 28, ) == 0x0
 00336   484   NtQueryValueKey  (28,  (28, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00337   484   NtClose  (28, ... ) == 0x0
 00338   484   NtMapViewOfSection  (-2147482740, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x4a0000), 0x0, 1060864, ) == 0x0
 00339   484   NtClose  (-2147482740, ... ) == 0x0
 00340   484   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 28, ) == 0x0
 00341   484   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00342   484   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482740, ) == 0x0
 00343   484   NtQueryInformationToken  (-2147482740, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00344   484   NtQueryInformationToken  (-2147482740, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00345   484   NtClose  (-2147482740, ... ) == 0x0
 00346   484   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0
 00347   484   NtFreeVirtualMemory  (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0
 00348   484   NtDuplicateObject  (-1, 16, -1, 0x0, 0, 2, ... 36, ) == 0x0
 00349   484   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00350   484   NtQueryValueKey  (-2147482740,  (-2147482740, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00351   484   NtClose  (-2147482740, ... ) == 0x0
 00352   484   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00353   484   NtQueryValueKey  (-2147482740,  (-2147482740, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00354   484   NtClose  (-2147482740, ... ) == 0x0
 00355   484   NtQueryDefaultLocale  (0, -139609780, ... ) == 0x0
 00356   484   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00357   484   NtUserCallNoParam  (24, ... ) == 0x0
 00358   484   NtGdiCreateCompatibleDC  (0, ...
 00359   484   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0
 00358   484   NtGdiCreateCompatibleDC  ... ) == 0xee0105b0
 00360   484   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00361   484   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00362   484   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x76050581
 00363   484   NtGdiCreateSolidBrush  (0, 0, ...
 00364   484   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 9109504, 4096, ) == 0x0
 00363   484   NtGdiCreateSolidBrush  ... ) == 0xa51003d2
 00365   484   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00366   484   NtGdiCreateCompatibleDC  (0, ... ) == 0x5201039b
 00367   484   NtGdiSelectBitmap  (1375798171, 1980040577, ... ) == 0x185000f
 00368   484   NtUserGetThreadDesktop  (484, 0, ... ) == 0x20
 00369   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 40, ) }, ... 40, ) == 0x0
 00370   484   NtQueryValueKey  (40,  (40, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (40, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00371   484   NtClose  (40, ... ) == 0x0
 00372   484   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00373   484   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 673, 128, 0, ... ) == 0x81aec017
 00374   484   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00375   484   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 674, 128, 0, ... ) == 0x81aec01c
 00376   484   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00377   484   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 675, 128, 0, ... ) == 0x81aec01e
 00378   484   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00379   484   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 676, 128, 0, ... ) == 0x81ae8002
 00380   484   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10013
 00381   484   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 677, 128, 0, ... ) == 0x81aec018
 00382   484   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00383   484   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 678, 128, 0, ... ) == 0x81aec01a
 00384   484   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00385   484   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 679, 128, 0, ... ) == 0x81aec01d
 00386   484   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00387   484   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 681, 128, 0, ... ) == 0x81aec026
 00388   484   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00389   484   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 680, 128, 0, ... ) == 0x81aec019
 00390   484   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x81aec020
 00391   484   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x81aec022
 00392   484   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x81aec023
 00393   484   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x81aec024
 00394   484   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x81aec025
 00395   484   NtCallbackReturn  (0, 0, 0, ...
 00396   484   NtGdiInit  (... ) == 0x1
 00397   484   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00398   484   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00399   484   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00400   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 40, ) }, ... 40, ) == 0x0
 00401   484   NtQueryValueKey  (40,  (40, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (40, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00402   484   NtQueryValueKey  (40,  (40, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (40, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00403   484   NtClose  (40, ... ) == 0x0
 00404   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 40, ) }, ... 40, ) == 0x0
 00405   484   NtQueryValueKey  (40,  (40, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00406   484   NtClose  (40, ... ) == 0x0
 00407   484   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 40, ) }, ... 40, ) == 0x0
 00408   484   NtSetInformationObject  (40, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00409   484   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00410   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00411   484   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 9175040, 65536, ) == 0x0
 00412   484   NtAllocateVirtualMemory  (-1, 9175040, 0, 4096, 4096, 4, ... 9175040, 4096, ) == 0x0
 00413   484   NtAllocateVirtualMemory  (-1, 9179136, 0, 8192, 4096, 4, ... 9179136, 8192, ) == 0x0
 00414   484   NtAllocateVirtualMemory  (-1, 9187328, 0, 4096, 4096, 4, ... 9187328, 4096, ) == 0x0
 00415   484   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 44, ) }, ... 44, ) == 0x0
 00416   484   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x8d0000), 0x0, 12288, ) == 0x0
 00417   484   NtClose  (44, ... ) == 0x0
 00418   484   NtAllocateVirtualMemory  (-1, 9191424, 0, 4096, 4096, 4, ... 9191424, 4096, ) == 0x0
 00419   484   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00420   484   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00421   484   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00422   484   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00423   484   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00424   484   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 44, {status=0x0, info=0}, ) }, 7, 16, ... 44, {status=0x0, info=0}, ) == 0x0
 00425   484   NtDeviceIoControlFile  (44, 0, 0x0, 0x0, 0x390008,  (44, 0, 0x0, 0x0, 0x390008, "TyA\233t\335x\325/\230_\312uO8\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00426   484   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00427   484   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00428   484   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00429   484   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00430   484   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00431   484   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00432   484   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00433   484   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0
 00434   484   NtSetValueKey  (-2147482740,  (-2147482740, "Seed", 0, 3, "\26k{\232\336\21\220A\315#\275\342\237\312\243\2004\356j\3232E\13\353$\6\210\220\232\15\277\34\375\21\235\362\263D~\271\330\205\253,\240.\241{\250Q_.L\10\305\o\321\353m\337\354\346\4\323\273\237\2068\351\11\375\|\251\332\340\23|\206", 80, ... ) , 0, 3,  (-2147482740, "Seed", 0, 3, "\26k{\232\336\21\220A\315#\275\342\237\312\243\2004\356j\3232E\13\353$\6\210\220\232\15\277\34\375\21\235\362\263D~\271\330\205\253,\240.\241{\250Q_.L\10\305\o\321\353m\337\354\346\4\323\273\237\2068\351\11\375\|\251\332\340\23|\206", 80, ... ) , 80, ... ) == 0x0
 00435   484   NtClose  (-2147482740, ... ) == 0x0
 00425   484   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "e\203\270\30\221\0x\12\363\217j\2215\344#\235v;\330\200\355T\353R\347V\330\225\363F\243,\355*Bx`V^j{L\12J\263\212\255\343\363\202\323{\32.}\377\317\23\347\302\372\332mOQ\330\332\376\22\361Vi\351\207f(\333\313\202\6\355\300\264\22\227~\230\5\325\260vJ\242:\215\2301\341v\247\241[\26\260^gY\243\346,\302\25*\20>!>\2338\347\27\11t\262b#\16\21v\243\361\304U\337\3417\\276-\350\234\24\266MY#\347\235\253\251\223\260\55\227\201J\3\256&\205\267+\206<#\325jiN3D\315\340\13\(\232\14{\2550\275Q\305\212\226\245\225xL'\1\273O<\2R\36\365()\3510]\371\201Q\251\200M,\33w)nE\226\232\312!\242\37\36\27\213Z\372\203\212P\227O\275\376\325\331\3545\353\335B\22\357\12A\375\12E4!\254Fj\230", ) , ) == 0x0
 00436   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00437   484   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00438   484   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 48, ) }, ... 48, ) == 0x0
 00439   484   NtQueryValueKey  (48,  (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00440   484   NtClose  (48, ... ) == 0x0
 00441   484   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 48, ) }, ... 48, ) == 0x0
 00442   484   NtQueryValueKey  (48,  (48, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00443   484   NtClose  (48, ... ) == 0x0
 00444   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00445   484   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00446   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00447   484   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00448   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 48, ) }, ... 48, ) == 0x0
 00449   484   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00450   484   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00451   484   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00452   484   NtClose  (48, ... ) == 0x0
 00453   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 48, ) }, ... 48, ) == 0x0
 00454   484   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00455   484   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00456   484   NtClose  (48, ... ) == 0x0
 00457   484   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 48, ) }, ... 48, ) == 0x0
 00458   484   NtOpenEvent  (0x1f0003, {24, 48, 0x0, 0, 0,  (0x1f0003, {24, 48, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00459   484   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077
 00460   484   NtOpenKey  (0x1, {24, 40, 0x40, 0, 0,  (0x1, {24, 40, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00461   484   NtOpenKey  (0x9, {24, 40, 0x40, 0, 0,  (0x9, {24, 40, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00462   484   NtOpenKey  (0x1, {24, 40, 0x40, 0, 0,  (0x1, {24, 40, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00463   484   NtOpenKey  (0x2000000, {24, 40, 0x40, 0, 0,  (0x2000000, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00464   484   NtCreateSemaphore  (0x1f0003, {24, 48, 0x80, 1333696, 0,  (0x1f0003, {24, 48, 0x80, 1333696, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 52, ) }, 0, 2147483647, ... 52, ) == STATUS_OBJECT_NAME_EXISTS
 00465   484   NtOpenKey  (0x1, {24, 40, 0x40, 0, 0,  (0x1, {24, 40, 0x40, 0, 0, "SYSTEM\Setup"}, ... 56, ) }, ... 56, ) == 0x0
 00466   484   NtQueryValueKey  (56,  (56, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (56, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00467   484   NtClose  (56, ... ) == 0x0
 00468   484   NtQueryDefaultUILanguage  (1241692, ...
 00469   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00470   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 00471   484   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00472   484   NtClose  (-2147482740, ... ) == 0x0
 00473   484   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00474   484   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00475   484   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 00476   484   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00477   484   NtClose  (-2147481328, ... ) == 0x0
 00478   484   NtClose  (-2147482740, ... ) == 0x0
 00468   484   NtQueryDefaultUILanguage  ... ) == 0x0
 00479   484   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll"}, 1, 96, ... 56, {status=0x0, info=1}, ) }, 1, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00480   484   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 56, ... 60, ) == 0x0
 00481   484   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x8e0000), 0x0, 8462336, ) == 0x0
 00482   484   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00483   484   NtQueryDefaultUILanguage  (2090319928, ...
 00484   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00485   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 00486   484   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00487   484   NtClose  (-2147482740, ... ) == 0x0
 00488   484   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00489   484   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00490   484   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 00491   484   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00492   484   NtClose  (-2147481328, ... ) == 0x0
 00493   484   NtClose  (-2147482740, ... ) == 0x0
 00483   484   NtQueryDefaultUILanguage  ... ) == 0x0
 00494   484   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 00495   484   NtQueryDefaultLocale  (1, 1239788, ... ) == 0x0
 00496   484   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00497   484   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1240824, 1179817, 1240548}  (24, {128, 156, new_msg, 0, 2088850039, 1240824, 1179817, 1240548} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\18\0\0\0\377\377\377\377\0\0\0\0@ \261\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\354\362\22\0\0\0\0\0" ... {128, 156, reply, 0, 860, 484, 57970, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\18\0\0\0\377\377\377\377\0\0\0\0@ \261\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\354\362\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 860, 484, 57970, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1240824, 1179817, 1240548} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\18\0\0\0\377\377\377\377\0\0\0\0@ \261\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\354\362\22\0\0\0\0\0" ... {128, 156, reply, 0, 860, 484, 57970, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\18\0\0\0\377\377\377\377\0\0\0\0@ \261\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\354\362\22\0\0\0\0\0" )  ) == 0x0
 00498   484   NtClose  (56, ... ) == 0x0
 00499   484   NtClose  (60, ... ) == 0x0
 00500   484   NtUnmapViewOfSection  (-1, 0x8e0000, ... ) == 0x0
 00501   484   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00502   484   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00503   484   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00504   484   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00505   484   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00506   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1238980, ... ) }, 1238980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00507   484   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00508   484   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00509   484   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00510   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1239044, ... ) }, 1239044, ... ) == 0x0
 00511   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 60, {status=0x0, info=1}, ) }, 3, 33, ... 60, {status=0x0, info=1}, ) == 0x0
 00512   484   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00513   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00514   484   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 56, ... 64, ) == 0x0
 00515   484   NtClose  (56, ... ) == 0x0
 00516   484   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8e0000), 0x0, 1056768, ) == 0x0
 00517   484   NtClose  (64, ... ) == 0x0
 00518   484   NtUnmapViewOfSection  (-1, 0x8e0000, ... ) == 0x0
 00519   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 00520   484   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 64, ... 56, ) == 0x0
 00521   484   NtQuerySection  (56, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00522   484   NtClose  (64, ... ) == 0x0
 00523   484   NtMapViewOfSection  (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 00524   484   NtClose  (56, ... ) == 0x0
 00525   484   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00526   484   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00527   484   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00528   484   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00529   484   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00530   484   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00531   484   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00532   484   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00533   484   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00534   484   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00535   484   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00536   484   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00537   484   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00538   484   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00539   484   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00540   484   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00541   484   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00542   484   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00543   484   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00544   484   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00545   484   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00546   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00547   484   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1240524, ... ) , 42, 1240524, ... ) == 0x0
 00548   484   NtQueryDefaultUILanguage  (1239208, ...
 00549   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00550   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 00551   484   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00552   484   NtClose  (-2147482740, ... ) == 0x0
 00553   484   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00554   484   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00555   484   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 00556   484   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00557   484   NtClose  (-2147481328, ... ) == 0x0
 00558   484   NtClose  (-2147482740, ... ) == 0x0
 00548   484   NtQueryDefaultUILanguage  ... ) == 0x0
 00559   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238048, ... ) }, 1238048, ... ) == 0x0
 00560   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00561   484   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 56, ... 64, ) == 0x0
 00562   484   NtClose  (56, ... ) == 0x0
 00563   484   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8e0000), 0x0, 4096, ) == 0x0
 00564   484   NtClose  (64, ... ) == 0x0
 00565   484   NtUnmapViewOfSection  (-1, 0x8e0000, ... ) == 0x0
 00566   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237644, ... ) }, 1237644, ... ) == 0x0
 00567   484   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1238388,  (0x80100080, {24, 0, 0x40, 0, 1238388, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 64, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 64, {status=0x0, info=1}, ) == 0x0
 00568   484   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 64, ... 56, ) == 0x0
 00569   484   NtClose  (64, ... ) == 0x0
 00570   484   NtMapViewOfSection  (56, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x8e0000), {0, 0}, 4096, ) == 0x0
 00571   484   NtClose  (56, ... ) == 0x0
 00572   484   NtUnmapViewOfSection  (-1, 0x8e0000, ... ) == 0x0
 00573   484   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 56, {status=0x0, info=1}, ) }, 1, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00574   484   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 56, ... 64, ) == 0x0
 00575   484   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x8e0000), 0x0, 4096, ) == 0x0
 00576   484   NtQueryInformationFile  (56, 1238040, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00577   484   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00578   484   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1238340, 1179817, 1238064}  (24, {128, 156, new_msg, 0, 2088850039, 1238340, 1179817, 1238064} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 860, 484, 57973, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 860, 484, 57973, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1238340, 1179817, 1238064} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 860, 484, 57973, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\08\351\22\0\0\0\0\0" )  ) == 0x0
 00579   484   NtClose  (56, ... ) == 0x0
 00580   484   NtClose  (64, ... ) == 0x0
 00581   484   NtUnmapViewOfSection  (-1, 0x8e0000, ... ) == 0x0
 00582   484   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00583   484   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00584   484   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 00585   484   NtUserGetDC  (0, ... ) == 0x1010051
 00586   484   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 00587   484   NtUserSystemParametersInfo  (38, 4, 2001086940, 0, ... ) == 0x1
 00588   484   NtUserSystemParametersInfo  (66, 12, 1240040, 0, ... ) == 0x1
 00589   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00590   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 64, ) == 0x0
 00591   484   NtQueryInformationToken  (64, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00592   484   NtClose  (64, ... ) == 0x0
 00593   484   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 64, ) }, ... 64, ) == 0x0
 00594   484   NtOpenProcessToken  (-1, 0x8, ... 56, ) == 0x0
 00595   484   NtAccessCheck  (1332816, 56, 0x1, 1239872, 1239924, 56, 1239904, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00596   484   NtClose  (56, ... ) == 0x0
 00597   484   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "Control Panel\Desktop"}, ... 56, ) }, ... 56, ) == 0x0
 00598   484   NtQueryValueKey  (56,  (56, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00599   484   NtClose  (56, ... ) == 0x0
 00600   484   NtUserSystemParametersInfo  (41, 500, 1240068, 0, ... ) == 0x1
 00601   484   NtOpenProcessToken  (-1, 0x8, ... 56, ) == 0x0
 00602   484   NtAccessCheck  (1332816, 56, 0x1, 1239872, 1239924, 56, 1239904, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00603   484   NtClose  (56, ... ) == 0x0
 00604   484   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 56, ) }, ... 56, ) == 0x0
 00605   484   NtQueryValueKey  (56,  (56, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00606   484   NtClose  (56, ... ) == 0x0
 00607   484   NtUserSystemParametersInfo  (27, 0, 2001085788, 0, ... ) == 0x1
 00608   484   NtUserSystemParametersInfo  (102, 0, 2001086828, 0, ... ) == 0x1
 00609   484   NtClose  (64, ... ) == 0x0
 00610   484   NtUserSystemParametersInfo  (4130, 0, 1240572, 0, ... ) == 0x1
 00611   484   NtOpenKey  (0x1, {24, 40, 0x40, 0, 0,  (0x1, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 64, ) }, ... 64, ) == 0x0
 00612   484   NtEnumerateValueKey  (64, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00613   484   NtClose  (64, ... ) == 0x0
 00614   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00615   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec03b
 00616   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec03d
 00617   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00618   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec03f
 00619   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00620   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec041
 00621   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00622   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec043
 00623   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec045
 00624   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00625   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec047
 00626   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00627   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec049
 00628   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00629   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec04b
 00630   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00631   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec04d
 00632   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00633   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec04f
 00634   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec051
 00635   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00636   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec053
 00637   484   NtUserFindExistingCursorIcon  (1239816, 1239832, 1239880, ... ) == 0x10011
 00638   484   NtUserRegisterClassExWOW  (1239760, 1239828, 1239844, 1239860, 0, 384, 0, ... ) == 0x81aec055
 00639   484   NtUserFindExistingCursorIcon  (1239816, 1239832, 1239880, ... ) == 0x10011
 00640   484   NtUserRegisterClassExWOW  (1239760, 1239828, 1239844, 1239860, 0, 384, 0, ... ) == 0x81aec057
 00641   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00642   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec059
 00643   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10013
 00644   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec05b
 00645   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00646   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec05d
 00647   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00648   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec05f
 00649   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00650   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec017
 00651   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00652   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec019
 00653   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10013
 00654   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec018
 00655   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00656   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec01a
 00657   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00658   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec01c
 00659   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00660   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec01e
 00661   484   NtUserFindExistingCursorIcon  (1239812, 1239828, 1239876, ... ) == 0x10011
 00662   484   NtUserRegisterClassExWOW  (1239812, 1239880, 1239896, 1239912, 0, 384, 0, ... ) == 0x81aec01b
 00663   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00664   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec068
 00665   484   NtUserFindExistingCursorIcon  (1239820, 1239836, 1239884, ... ) == 0x10011
 00666   484   NtUserRegisterClassExWOW  (1239764, 1239832, 1239848, 1239864, 0, 384, 0, ... ) == 0x81aec06a
 00667   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 64, ) }, ... 64, ) == 0x0
 00668   484   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0
 00669   484   NtClose  (64, ... ) == 0x0
 00670   484   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00671   484   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00672   484   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00673   484   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00674   484   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00675   484   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00676   484   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00677   484   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00678   484   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00679   484   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00680   484   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00681   484   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00682   484   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00683   484   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00684   484   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00685   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00686   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00687   484   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 9306112, 65536, ) == 0x0
 00688   484   NtAllocateVirtualMemory  (-1, 9306112, 0, 4096, 4096, 4, ... 9306112, 4096, ) == 0x0
 00689   484   NtAllocateVirtualMemory  (-1, 9310208, 0, 8192, 4096, 4, ... 9310208, 8192, ) == 0x0
 00690   484   NtAllocateVirtualMemory  (-1, 9318400, 0, 4096, 4096, 4, ... 9318400, 4096, ) == 0x0
 00691   484   NtAllocateVirtualMemory  (-1, 9322496, 0, 4096, 4096, 4, ... 9322496, 4096, ) == 0x0
 00692   484   NtQueryDefaultUILanguage  (1239820, ...
 00693   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00694   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 00695   484   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00696   484   NtClose  (-2147482740, ... ) == 0x0
 00697   484   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00698   484   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00699   484   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 00700   484   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00701   484   NtClose  (-2147481328, ... ) == 0x0
 00702   484   NtClose  (-2147482740, ... ) == 0x0
 00692   484   NtQueryDefaultUILanguage  ... ) == 0x0
 00703   484   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll"}, 1, 96, ... 64, {status=0x0, info=1}, ) }, 1, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 00704   484   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 64, ... 56, ) == 0x0
 00705   484   NtMapViewOfSection  (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x900000), 0x0, 618496, ) == 0x0
 00706   484   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00707   484   NtQueryDefaultLocale  (1, 1237916, ... ) == 0x0
 00708   484   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00709   484   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1238952, 1179817, 1238676}  (24, {128, 156, new_msg, 0, 2088850039, 1238952, 1179817, 1238676} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1@\0\0\0\377\377\377\377\0\0\0\0\340q\227\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0\234\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 860, 484, 57974, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1@\0\0\0\377\377\377\377\0\0\0\0\340q\227\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0\234\353\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 860, 484, 57974, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1238952, 1179817, 1238676} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1@\0\0\0\377\377\377\377\0\0\0\0\340q\227\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0\234\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 860, 484, 57974, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1@\0\0\0\377\377\377\377\0\0\0\0\340q\227\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0\234\353\22\0\0\0\0\0" )  ) == 0x0
 00710   484   NtClose  (64, ... ) == 0x0
 00711   484   NtClose  (56, ... ) == 0x0
 00712   484   NtUnmapViewOfSection  (-1, 0x900000, ... ) == 0x0
 00713   484   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00714   484   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {860, 0}, ... 56, ) == 0x0
 00715   484   NtQueryInformationProcess  (56, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00716   484   NtClose  (56, ... ) == 0x0
 00717   484   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00718   484   NtUserSystemParametersInfo  (104, 0, 1561338260, 0, ... ) == 0x1
 00719   484   NtUserSystemParametersInfo  (38, 4, 1561337988, 0, ... ) == 0x1
 00720   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00721   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 56, ) == 0x0
 00722   484   NtQueryInformationToken  (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00723   484   NtClose  (56, ... ) == 0x0
 00724   484   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 56, ) }, ... 56, ) == 0x0
 00725   484   NtOpenProcessToken  (-1, 0x8, ... 64, ) == 0x0
 00726   484   NtAccessCheck  (1332816, 64, 0x1, 1241012, 1241064, 56, 1241044, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00727   484   NtClose  (64, ... ) == 0x0
 00728   484   NtOpenKey  (0x20019, {24, 56, 0x40, 0, 0,  (0x20019, {24, 56, 0x40, 0, 0, "Control Panel\Desktop"}, ... 64, ) }, ... 64, ) == 0x0
 00729   484   NtQueryValueKey  (64,  (64, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00730   484   NtClose  (64, ... ) == 0x0
 00731   484   NtUserSystemParametersInfo  (41, 500, 1241192, 0, ... ) == 0x1
 00732   484   NtUserSystemParametersInfo  (102, 0, 1561338280, 0, ... ) == 0x1
 00733   484   NtClose  (56, ... ) == 0x0
 00734   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00735   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec03b
 00736   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec03d
 00737   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00738   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec03f
 00739   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00740   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec041
 00741   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00742   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec043
 00743   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec045
 00744   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00745   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec047
 00746   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00747   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec049
 00748   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00749   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec04b
 00750   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00751   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec04d
 00752   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00753   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec04f
 00754   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec051
 00755   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00756   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec053
 00757   484   NtUserFindExistingCursorIcon  (1240940, 1240956, 1241004, ... ) == 0x10011
 00758   484   NtUserRegisterClassExWOW  (1240884, 1240952, 1240968, 1240984, 0, 384, 0, ... ) == 0x81aec055
 00759   484   NtUserFindExistingCursorIcon  (1240940, 1240956, 1241004, ... ) == 0x10011
 00760   484   NtUserRegisterClassExWOW  (1240884, 1240952, 1240968, 1240984, 0, 384, 0, ... ) == 0x81aec057
 00761   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00762   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec059
 00763   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10013
 00764   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec05b
 00765   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00766   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec05d
 00767   484   NtUserFindExistingCursorIcon  (1240944, 1240960, 1241008, ... ) == 0x10011
 00768   484   NtUserRegisterClassExWOW  (1240888, 1240956, 1240972, 1240988, 0, 384, 0, ... ) == 0x81aec05f
 00769   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00770   484   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00771   484   NtTestAlert  (... ) == 0x0
 00772   484   NtContinue  (1244464, 1, ...
 00773   484   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x401000,}, 4, ... ) == 0x0
 00774   484   NtAllocateVirtualMemory  (-1, 0, 0, 196608, 4096, 64, ... 9437184, 196608, ) == 0x0
 00775   484   NtAllocateVirtualMemory  (-1, 0, 0, 196608, 4096, 64, ... 9633792, 196608, ) == 0x0
 00776   484   NtFreeVirtualMemory  (-1, (0x900000), 0, 32768, ... (0x900000), 196608, ) == 0x0
 00777   484   NtAllocateVirtualMemory  (-1, 0, 0, 1350, 4096, 4, ... 9437184, 4096, ) == 0x0
 00778   484   NtFreeVirtualMemory  (-1, (0x900000), 0, 32768, ... (0x900000), 4096, ) == 0x0
 00779   484   NtAllocateVirtualMemory  (-1, 0, 0, 148480, 4096, 4, ... 9437184, 151552, ) == 0x0
 00780   484   NtFreeVirtualMemory  (-1, (0x900000), 0, 32768, ... (0x900000), 151552, ) == 0x0
 00781   484   NtAllocateVirtualMemory  (-1, 0, 0, 2560, 4096, 4, ... 9437184, 4096, ) == 0x0
 00782   484   NtFreeVirtualMemory  (-1, (0x900000), 0, 32768, ... (0x900000), 4096, ) == 0x0
 00783   484   NtAllocateVirtualMemory  (-1, 0, 0, 3584, 4096, 4, ... 9437184, 4096, ) == 0x0
 00784   484   NtFreeVirtualMemory  (-1, (0x900000), 0, 32768, ... (0x900000), 4096, ) == 0x0
 00785   484   NtAllocateVirtualMemory  (-1, 0, 0, 8704, 4096, 4, ... 9437184, 12288, ) == 0x0
 00786   484   NtFreeVirtualMemory  (-1, (0x900000), 0, 32768, ... (0x900000), 12288, ) == 0x0
 00787   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "version.dll"}, ... 56, ) }, ... 56, ) == 0x0
 00788   484   NtMapViewOfSection  (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 32768, ) == 0x0
 00789   484   NtClose  (56, ... ) == 0x0
 00790   484   NtProtectVirtualMemory  (-1, (0x77c01000), 304, 4, ... (0x77c01000), 4096, 32, ) == 0x0
 00791   484   NtProtectVirtualMemory  (-1, (0x77c01000), 4096, 32, ... (0x77c01000), 4096, 4, ) == 0x0
 00792   484   NtFlushInstructionCache  (-1, 2009075712, 304, ... ) == 0x0
 00793   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\version.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00794   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00795   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\wsock32.dll"}, 1242940, ... ) }, 1242940, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00796   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wsock32.dll"}, 1242940, ... ) }, 1242940, ... ) == 0x0
 00797   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wsock32.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00798   484   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 56, ... 64, ) == 0x0
 00799   484   NtQuerySection  (64, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00800   484   NtClose  (56, ... ) == 0x0
 00801   484   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 36864, ) == 0x0
 00802   484   NtClose  (64, ... ) == 0x0
 00803   484   NtProtectVirtualMemory  (-1, (0x71ad1000), 52, 4, ... (0x71ad1000), 4096, 32, ) == 0x0
 00804   484   NtProtectVirtualMemory  (-1, (0x71ad1000), 4096, 32, ... (0x71ad1000), 4096, 4, ) == 0x0
 00805   484   NtFlushInstructionCache  (-1, 1907167232, 52, ... ) == 0x0
 00806   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00807   484   NtQueryPerformanceCounter  (... {925237127, 10}, {3579545, 0}, ) == 0x0
 00808   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00809   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 64, ) == 0x0
 00810   484   NtQueryInformationToken  (64, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00811   484   NtClose  (64, ... ) == 0x0
 00812   484   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 64, ) }, ... 64, ) == 0x0
 00813   484   NtSetInformationObject  (64, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00814   484   NtOpenKey  (0xf003f, {24, 64, 0x40, 0, 0,  (0xf003f, {24, 64, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00815   484   NtOpenKey  (0xf003f, {24, 64, 0x40, 0, 0,  (0xf003f, {24, 64, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00816   484   NtOpenProcessToken  (-1, 0x8, ... 56, ) == 0x0
 00817   484   NtQueryInformationToken  (56, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00818   484   NtClose  (56, ... ) == 0x0
 00819   484   NtUserCallOneParam  (0, 41, ... ) == 0x4
 00820   484   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00821   484   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 1, ... 10158080, 1048576, ) == 0x0
 00822   484   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00823   484   NtAllocateVirtualMemory  (-1, 10158080, 0, 16384, 4096, 4, ... 10158080, 16384, ) == 0x0
 00824   484   NtUserCallNoParam  (29, ...
 00825   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242224, ... ) }, 1242224, ... ) == 0x0
 00826   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00827   484   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 56, ... 68, ) == 0x0
 00828   484   NtClose  (56, ... ) == 0x0
 00829   484   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x960000), 0x0, 221184, ) == 0x0
 00830   484   NtClose  (68, ... ) == 0x0
 00831   484   NtUnmapViewOfSection  (-1, 0x960000, ... ) == 0x0
 00832   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242532, ... ) }, 1242532, ... ) == 0x0
 00833   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00834   484   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 68, ... 56, ) == 0x0
 00835   484   NtQuerySection  (56, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00836   484   NtClose  (68, ... ) == 0x0
 00837   484   NtMapViewOfSection  (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 229376, ) == 0x0
 00838   484   NtClose  (56, ... ) == 0x0
 00839   484   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00840   484   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00841   484   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00842   484   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00843   484   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00844   484   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00845   484   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00846   484   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00847   484   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00848   484   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00849   484   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00850   484   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00851   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uxtheme.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00852   484   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00853   484   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00854   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00855   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 56, ) == 0x0
 00856   484   NtQueryInformationToken  (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00857   484   NtClose  (56, ... ) == 0x0
 00858   484   NtOpenKey  (0x2001f, {24, 0, 0x640, 0, 0,  (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 56, ) }, ... 56, ) == 0x0
 00859   484   NtOpenKey  (0x1, {24, 56, 0x40, 0, 0,  (0x1, {24, 56, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 68, ) }, ... 68, ) == 0x0
 00860   484   NtQueryValueKey  (68,  (68, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00861   484   NtClose  (68, ... ) == 0x0
 00862   484   NtClose  (56, ... ) == 0x0
 00863   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00864   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 56, ) == 0x0
 00865   484   NtQueryInformationToken  (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00866   484   NtClose  (56, ... ) == 0x0
 00867   484   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 56, ) }, ... 56, ) == 0x0
 00868   484   NtOpenKey  (0x1, {24, 56, 0x40, 0, 0,  (0x1, {24, 56, 0x40, 0, 0, "Control Panel\Desktop"}, ... 68, ) }, ... 68, ) == 0x0
 00869   484   NtQueryValueKey  (68,  (68, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00870   484   NtClose  (68, ... ) == 0x0
 00871   484   NtClose  (56, ... ) == 0x0
 00872   484   NtUserGetProcessWindowStation  (... ) == 0x10
 00873   484   NtUserGetObjectInformation  (16, 2, 1244320, 64, 1244316, ... ) == 0x1
 00874   484   NtUserGetGUIThreadInfo  (484, 1244340, ... ) == 0x1
 00875   484   NtConnectPort  ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1244184, 64, ... 56, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1244184, 64, ... 56, 0x0, 0x0, 0x0, 64, ) == 0x0
 00876   484   NtRequestWaitReplyPort  (56, {32, 56, new_msg, 0, 0, 0, 0, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 860, 484, 57976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 860, 484, 57976, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 860, 484, 57976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00877   484   NtRequestWaitReplyPort  (56, {32, 56, new_msg, 0, 0, 0, 0, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 860, 484, 57977, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 860, 484, 57977, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 860, 484, 57977, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00878   484   NtUserCallNoParam  (29, ...
 00879   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241580, ... ) }, 1241580, ... ) == 0x0
 00878   484   NtUserCallNoParam  ... ) == 0x0
 00880   484   NtUserSystemParametersInfo  (41, 0, 1524240760, 0, ... ) == 0x1
 00881   484   NtGdiHfontCreate  (1243708, 356, 0, 0, 1332888, ... ) == 0x340a04e1
 00882   484   NtGdiHfontCreate  (1243708, 356, 0, 0, 1332880, ... ) == 0x520a0634
 00883   484   NtRequestWaitReplyPort  (56, {32, 56, new_msg, 0, 0, 0, 0, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 860, 484, 57978, 0} "\0\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 860, 484, 57978, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 860, 484, 57978, 0} "\0\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00884   484   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xab0000), {0, 0}, 327680, ) == 0x0
 00885   484   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00886   484   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00887   484   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00888   484   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00889   484   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00890   484   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00891   484   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00892   484   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00893   484   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00894   484   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00895   484   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00896   484   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00897   484   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00898   484   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00899   484   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00900   484   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00901   484   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00902   484   NtGdiCreatePatternBrushInternal  (59048383, 0, 0, ... ) == 0x72100798
 00903   484   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00904   484   NtUserCallNoParam  (29, ...
 00905   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241020, ... ) }, 1241020, ... ) == 0x0
 00904   484   NtUserCallNoParam  ... ) == 0x0
 00906   484   NtUserCallNoParam  (29, ...
 00907   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241016, ... ) }, 1241016, ... ) == 0x0
 00906   484   NtUserCallNoParam  ... ) == 0x0
 00824   484   NtUserCallNoParam  ... ) == 0x1
 00908   484   NtOpenKey  (0x2000000, {24, 40, 0x40, 0, 0,  (0x2000000, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 72, ) }, ... 72, ) == 0x0
 00909   484   NtQueryValueKey  (72,  (72, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (72, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00910   484   NtQueryValueKey  (72,  (72, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (72, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00911   484   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 76, ) == 0x0
 00912   484   NtOpenKey  (0x2000000, {24, 72, 0x40, 0, 0,  (0x2000000, {24, 72, 0x40, 0, 0, "Protocol_Catalog9"}, ... 80, ) }, ... 80, ) == 0x0
 00913   484   NtQueryValueKey  (80,  (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00914   484   NtNotifyChangeKey  (80, 76, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 00915   484   NtQueryValueKey  (80,  (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00916   484   NtOpenKey  (0x2000000, {24, 80, 0x40, 0, 0,  (0x2000000, {24, 80, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00917   484   NtQueryValueKey  (80,  (80, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 00918   484   NtQueryValueKey  (80,  (80, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 00919   484   NtOpenKey  (0x2000000, {24, 80, 0x40, 0, 0,  (0x2000000, {24, 80, 0x40, 0, 0, "Catalog_Entries"}, ... 84, ) }, ... 84, ) == 0x0
 00920   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000001"}, ... 88, ) }, ... 88, ) == 0x0
 00921   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00922   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00923   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\234\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\234\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\235\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\235\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\236\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\236\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\237\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\234\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\234\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\235\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\235\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\236\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\236\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\237\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\236\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\237\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\234\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\234\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\235\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\235\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\236\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\236\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\237\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00924   484   NtClose  (88, ... ) == 0x0
 00925   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000002"}, ... 88, ) }, ... 88, ) == 0x0
 00926   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00927   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00928   484   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 00929   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\242\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\242\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\243\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\243\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\244\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\244\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\245\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\242\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\242\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\243\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\243\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\244\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\244\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\245\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\244\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\245\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\242\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\242\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\243\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\243\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\244\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\244\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\245\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00930   484   NtClose  (88, ... ) == 0x0
 00931   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000003"}, ... 88, ) }, ... 88, ) == 0x0
 00932   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00933   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00934   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\247\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\247\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\250\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\250\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\251\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\251\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\252\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\247\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\247\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\250\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\250\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\251\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\251\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\252\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\251\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\252\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\247\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\247\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\250\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\250\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\251\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\251\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\252\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00935   484   NtClose  (88, ... ) == 0x0
 00936   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000004"}, ... 88, ) }, ... 88, ) == 0x0
 00937   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00938   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00939   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\254\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\254\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\255\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\255\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\256\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\256\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\257\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\254\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\254\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\255\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\255\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\256\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\256\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\257\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\256\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\257\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\254\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\254\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\255\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\255\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\256\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\256\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\257\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00940   484   NtClose  (88, ... ) == 0x0
 00941   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000005"}, ... 88, ) }, ... 88, ) == 0x0
 00942   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00943   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00944   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\261\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\261\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\262\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\262\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\263\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\263\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\264\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\261\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\261\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\262\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\262\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\263\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\263\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\264\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\263\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\264\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\261\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\261\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\262\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\262\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\263\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\263\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\264\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00945   484   NtClose  (88, ... ) == 0x0
 00946   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000006"}, ... 88, ) }, ... 88, ) == 0x0
 00947   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00948   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00949   484   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 00950   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\267\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\267\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\270\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\270\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\271\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\271\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\272\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\267\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\267\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\270\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\270\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\271\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\271\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\272\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\271\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\272\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\267\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\267\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\270\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\270\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\271\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\271\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\272\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00951   484   NtClose  (88, ... ) == 0x0
 00952   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000007"}, ... 88, ) }, ... 88, ) == 0x0
 00953   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00954   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00955   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\274\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\274\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\275\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\275\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\276\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\276\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\277\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\274\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\274\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\275\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\275\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\276\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\276\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\277\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\276\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\277\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\274\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\274\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\275\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\275\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\276\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\276\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\277\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00956   484   NtClose  (88, ... ) == 0x0
 00957   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000008"}, ... 88, ) }, ... 88, ) == 0x0
 00958   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00959   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00960   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\301\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\301\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\302\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\302\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\303\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\303\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\304\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\301\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\301\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\302\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\302\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\303\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\303\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\304\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\303\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\304\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\301\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\301\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\302\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\302\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\303\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\303\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\304\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00961   484   NtClose  (88, ... ) == 0x0
 00962   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000009"}, ... 88, ) }, ... 88, ) == 0x0
 00963   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00964   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00965   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\306\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\306\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\307\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\307\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\310\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\310\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\311\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\306\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\306\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\307\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\307\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\310\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\310\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\311\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\310\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\311\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\306\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\306\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\307\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\307\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\310\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\310\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\311\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00966   484   NtClose  (88, ... ) == 0x0
 00967   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000010"}, ... 88, ) }, ... 88, ) == 0x0
 00968   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00969   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00970   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\313\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\313\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\314\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\314\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\315\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\315\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\316\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\313\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\313\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\314\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\314\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\315\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\315\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\316\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\315\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\316\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\313\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\313\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\314\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\314\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\315\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\315\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\316\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00971   484   NtClose  (88, ... ) == 0x0
 00972   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000011"}, ... 88, ) }, ... 88, ) == 0x0
 00973   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00974   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00975   484   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00976   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\321\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\321\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\322\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\322\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\323\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\323\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\324\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\321\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\321\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\322\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\322\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\323\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\323\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\324\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\323\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\324\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\321\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\321\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\322\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\322\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\323\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\323\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\324\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00977   484   NtClose  (88, ... ) == 0x0
 00978   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000012"}, ... 88, ) }, ... 88, ) == 0x0
 00979   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00980   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00981   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\326\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\326\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\327\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\327\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\330\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\330\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\331\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\326\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\326\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\327\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\327\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\330\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\330\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\331\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\330\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\331\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\326\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\326\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\327\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\327\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\330\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\330\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\331\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00982   484   NtClose  (88, ... ) == 0x0
 00983   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000013"}, ... 88, ) }, ... 88, ) == 0x0
 00984   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00985   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00986   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\333\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\333\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\334\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\334\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\335\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\335\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\336\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\333\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\333\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\334\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\334\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\335\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\335\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\336\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\335\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\336\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\333\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\333\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\334\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\334\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\335\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\335\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\336\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00987   484   NtClose  (88, ... ) == 0x0
 00988   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000014"}, ... 88, ) }, ... 88, ) == 0x0
 00989   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00990   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00991   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\340\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\340\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\341\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\341\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\342\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\342\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\343\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\340\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\340\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\341\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\341\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\342\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\342\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\343\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\342\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\343\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\340\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\340\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\341\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\341\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\342\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\342\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\343\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00992   484   NtClose  (88, ... ) == 0x0
 00993   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000015"}, ... 88, ) }, ... 88, ) == 0x0
 00994   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00995   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00996   484   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 00997   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\346\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\346\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\347\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\347\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\350\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\350\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\351\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\346\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\346\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\347\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\347\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\350\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\350\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\351\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\350\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\351\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\346\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\346\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\347\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\347\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\350\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\350\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\351\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00998   484   NtClose  (88, ... ) == 0x0
 00999   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000016"}, ... 88, ) }, ... 88, ) == 0x0
 01000   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01001   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01002   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\353\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\353\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\354\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\354\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\355\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\355\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\356\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\353\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\353\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\354\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\354\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\355\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\355\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\356\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\355\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\356\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\353\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\353\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\354\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\354\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\355\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\355\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\356\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01003   484   NtClose  (88, ... ) == 0x0
 01004   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000017"}, ... 88, ) }, ... 88, ) == 0x0
 01005   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01006   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01007   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\360\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\360\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\361\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\361\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\362\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\362\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\363\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\360\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\360\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\361\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\361\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\362\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\362\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\363\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\362\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\363\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\360\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\360\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\361\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\361\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\362\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\362\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\363\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01008   484   NtClose  (88, ... ) == 0x0
 01009   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000018"}, ... 88, ) }, ... 88, ) == 0x0
 01010   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01011   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01012   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\365\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\365\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\366\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\366\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\367\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\367\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\370\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\365\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\365\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\366\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\366\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\367\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\367\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\370\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\367\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\370\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\365\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\365\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\366\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\366\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\367\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\367\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\370\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01013   484   NtClose  (88, ... ) == 0x0
 01014   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000019"}, ... 88, ) }, ... 88, ) == 0x0
 01015   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01016   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01017   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\372\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\372\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\373\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\373\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\374\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\374\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\375\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\372\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\372\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\373\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\373\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\374\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\374\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\375\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\374\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\375\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\372\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\372\3\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\373\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\373\3\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\374\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\374\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\375\3\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01018   484   NtClose  (88, ... ) == 0x0
 01019   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000020"}, ... 88, ) }, ... 88, ) == 0x0
 01020   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01021   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01022   484   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01023   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\0\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\0\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\1\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\1\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\2\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\2\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\3\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\0\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\0\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\1\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\1\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\2\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\2\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\3\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\2\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\3\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\0\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\0\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\1\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\1\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\2\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\2\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\3\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01024   484   NtClose  (88, ... ) == 0x0
 01025   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000021"}, ... 88, ) }, ... 88, ) == 0x0
 01026   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01027   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01028   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\5\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\5\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\6\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\6\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\7\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\7\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\10\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\5\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\5\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\6\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\6\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\7\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\7\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\10\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\7\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\10\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\5\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\5\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\6\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\10\201\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\6\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\7\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\7\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\10\4\0\0\\3\0\0\344\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01029   484   NtClose  (88, ... ) == 0x0
 01030   484   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "000000000022"}, ... 88, ) }, ... 88, ) == 0x0
 01031   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01032   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01033   484   NtQueryValueKey  (88,  (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\12\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\12\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\13\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\13\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\4\0\0\\3\0\0\344\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\4\0\0\\3\0\0\344\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\15\4\0\0\\3\0\0\344\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\15\4\0\0\\3\0\0\344\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\16\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0H\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\330\200\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\12\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\12\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\13\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\13\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\4\0\0\\3\0\0\344\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\4\0\0\\3\0\0\344\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\15\4\0\0\\3\0\0\344\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\15\4\0\0\\3\0\0\344\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\16\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0H\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\330\200\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\12\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\12\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\13\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\13\4\0\0\\3\0\0\344\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\4\0\0\\3\0\0\344\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\4\0\0\\3\0\0\344\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\15\4\0\0\\3\0\0\344\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\15\4\0\0\\3\0\0\344\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\16\4\0\0\\3\0\0\344\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0H\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\330\200\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 01034   484   NtClose  (88, ... ) == 0x0
 01035   484   NtClose  (84, ... ) == 0x0
 01036   484   NtWaitForSingleObject  (76, 0, {0, 0}, ... ) == 0x102
 01037   484   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 84, ) == 0x0
 01038   484   NtOpenKey  (0x2000000, {24, 72, 0x40, 0, 0,  (0x2000000, {24, 72, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 88, ) }, ... 88, ) == 0x0
 01039   484   NtQueryValueKey  (88,  (88, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01040   484   NtNotifyChangeKey  (88, 84, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01041   484   NtQueryValueKey  (88,  (88, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01042   484   NtOpenKey  (0x2000000, {24, 88, 0x40, 0, 0,  (0x2000000, {24, 88, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01043   484   NtQueryValueKey  (88,  (88, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 01044   484   NtOpenKey  (0x2000000, {24, 88, 0x40, 0, 0,  (0x2000000, {24, 88, 0x40, 0, 0, "Catalog_Entries"}, ... 92, ) }, ... 92, ) == 0x0
 01045   484   NtOpenKey  (0x20019, {24, 92, 0x40, 0, 0,  (0x20019, {24, 92, 0x40, 0, 0, "000000000001"}, ... 96, ) }, ... 96, ) == 0x0
 01046   484   NtQueryValueKey  (96,  (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01047   484   NtQueryValueKey  (96,  (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01048   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01049   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01050   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01051   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01052   484   NtQueryValueKey  (96,  (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 01053   484   NtQueryValueKey  (96,  (96, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01054   484   NtQueryValueKey  (96,  (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 01055   484   NtQueryValueKey  (96,  (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01056   484   NtQueryValueKey  (96,  (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01057   484   NtQueryValueKey  (96,  (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01058   484   NtClose  (96, ... ) == 0x0
 01059   484   NtOpenKey  (0x20019, {24, 92, 0x40, 0, 0,  (0x20019, {24, 92, 0x40, 0, 0, "000000000002"}, ... 96, ) }, ... 96, ) == 0x0
 01060   484   NtQueryValueKey  (96,  (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01061   484   NtQueryValueKey  (96,  (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01062   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01063   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01064   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01065   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01066   484   NtQueryValueKey  (96,  (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 01067   484   NtQueryValueKey  (96,  (96, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01068   484   NtQueryValueKey  (96,  (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 01069   484   NtQueryValueKey  (96,  (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01070   484   NtQueryValueKey  (96,  (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01071   484   NtQueryValueKey  (96,  (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01072   484   NtClose  (96, ... ) == 0x0
 01073   484   NtOpenKey  (0x20019, {24, 92, 0x40, 0, 0,  (0x20019, {24, 92, 0x40, 0, 0, "000000000003"}, ... 96, ) }, ... 96, ) == 0x0
 01074   484   NtQueryValueKey  (96,  (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01075   484   NtQueryValueKey  (96,  (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01076   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01077   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01078   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01079   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01080   484   NtQueryValueKey  (96,  (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 01081   484   NtQueryValueKey  (96,  (96, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01082   484   NtQueryValueKey  (96,  (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 01083   484   NtQueryValueKey  (96,  (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01084   484   NtQueryValueKey  (96,  (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01085   484   NtQueryValueKey  (96,  (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01086   484   NtClose  (96, ... ) == 0x0
 01087   484   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 01088   484   NtOpenKey  (0x20019, {24, 92, 0x40, 0, 0,  (0x20019, {24, 92, 0x40, 0, 0, "000000000004"}, ... 96, ) }, ... 96, ) == 0x0
 01089   484   NtQueryValueKey  (96,  (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01090   484   NtQueryValueKey  (96,  (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01091   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01092   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01093   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01094   484   NtQueryValueKey  (96,  (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01095   484   NtQueryValueKey  (96,  (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 01096   484   NtQueryValueKey  (96,  (96, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01097   484   NtQueryValueKey  (96,  (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01098   484   NtQueryValueKey  (96,  (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01099   484   NtQueryValueKey  (96,  (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01100   484   NtQueryValueKey  (96,  (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01101   484   NtClose  (96, ... ) == 0x0
 01102   484   NtClose  (92, ... ) == 0x0
 01103   484   NtWaitForSingleObject  (84, 0, {0, 0}, ... ) == 0x102
 01104   484   NtClose  (72, ... ) == 0x0
 01105   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01106   484   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01107   484   NtOpenKey  (0x1, {24, 40, 0x40, 0, 0,  (0x1, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 72, ) }, ... 72, ) == 0x0
 01108   484   NtQueryValueKey  (72,  (72, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01109   484   NtClose  (72, ... ) == 0x0
 01110   484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 72, ) == 0x0
 01111   484   NtAllocateVirtualMemory  (-1, 0, 0, 17, 4096, 64, ... 9437184, 4096, ) == 0x0
 01112   484   NtAllocateVirtualMemory  (-1, 0, 0, 26, 4096, 64, ... 9502720, 4096, ) == 0x0
 01113   484   NtAllocateVirtualMemory  (-1, 10174464, 0, 16384, 4096, 4, ... 10174464, 16384, ) == 0x0
 01114   484   NtAllocateVirtualMemory  (-1, 0, 0, 326, 4096, 64, ... 9568256, 4096, ) == 0x0
 01115   484   NtFreeVirtualMemory  (-1, (0x9b4000), 16384, 16384, ... (0x9b4000), 16384, ) == 0x0
 01116   484   NtAllocateVirtualMemory  (-1, 10174464, 0, 81920, 4096, 4, ... 10174464, 81920, ) == 0x0
 01117   484   NtFreeVirtualMemory  (-1, (0x9c4000), 16384, 16384, ... (0x9c4000), 16384, ) == 0x0
 01118   484   NtFreeVirtualMemory  (-1, (0x9b4000), 65536, 16384, ... (0x9b4000), 65536, ) == 0x0
 01119   484   NtAllocateVirtualMemory  (-1, 10174464, 0, 32768, 4096, 4, ... 10174464, 32768, ) == 0x0
 01120   484   NtFreeVirtualMemory  (-1, (0x9b4000), 32768, 16384, ... (0x9b4000), 32768, ) == 0x0
 01121   484   NtAllocateVirtualMemory  (-1, 10174464, 0, 81920, 4096, 4, ... 10174464, 81920, ) == 0x0
 01122   484   NtFreeVirtualMemory  (-1, (0x9b4000), 81920, 16384, ... (0x9b4000), 81920, ) == 0x0
 01123   484   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243880,  (0xc0100080, {24, 0, 0x40, 0, 1243880, "\??\Scsi0:"}, 0x0, 0, 3, 1, 96, 0, 0, ... 92, {status=0x0, info=0}, ) }, 0x0, 0, 3, 1, 96, 0, 0, ... 92, {status=0x0, info=0}, ) == 0x0
 01124   484   NtDeviceIoControlFile  (92, 0, 0x0, 0x0, 0x4d008,  (92, 0, 0x0, 0x0, 0x4d008, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\1\1\0\0\240\354\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 572, 572, ... {status=0x0, info=572}, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0zB\377?\0\0\17\0\0\0\0\0?\0\0\0\0\0\0\000000000000000000010\0\0@\0\0\000000010MVawerV riutlaI EDH ra drDvi e          @\200\0\0\0/\0\0\0\2\0\0\7\0CD\17\0?\0S\373\354\0@\1\0\0\0\1\0\0\7\0\3\0x\0x\0\240\0x\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\36\0\27\0\10@\10@\0@\10@\0@\0@\7\4\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 572, 572, ... {status=0x0, info=572},  (92, 0, 0x0, 0x0, 0x4d008, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\1\1\0\0\240\354\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 572, 572, ... {status=0x0, info=572}, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0zB\377?\0\0\17\0\0\0\0\0?\0\0\0\0\0\0\000000000000000000010\0\0@\0\0\000000010MVawerV riutlaI EDH ra drDvi e          @\200\0\0\0/\0\0\0\2\0\0\7\0CD\17\0?\0S\373\354\0@\1\0\0\0\1\0\0\7\0\3\0x\0x\0\240\0x\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\36\0\27\0\10@\10@\0@\10@\0@\0@\7\4\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01125   484   NtClose  (92, ... ) == 0x0
 01126   484   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01127   484   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 92, {status=0x0, info=1}, ) }, 3, 16417, ... 92, {status=0x0, info=1}, ) == 0x0
 01128   484   NtQueryInformationFile  (92, 1244036, 528, Name, ... {status=0x0, info=6}, ) == 0x0
 01129   484   NtQueryVolumeInformationFile  (92, 1369064, 284, Volume, ... {status=0x0, info=18}, ) == 0x0
 01130   484   NtQueryVolumeInformationFile  (92, 1369360, 276, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01131   484   NtClose  (92, ... ) == 0x0
 01132   484   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 92, {status=0x0, info=1}, ) }, 3, 8388641, ... 92, {status=0x0, info=1}, ) == 0x0
 01133   484   NtQueryVolumeInformationFile  (92, 1244780, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 01134   484   NtClose  (92, ... ) == 0x0
 01135   484   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01136   484   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 92, {status=0x0, info=1}, ) }, 3, 16417, ... 92, {status=0x0, info=1}, ) == 0x0
 01137   484   NtQueryInformationFile  (92, 1244040, 528, Name, ... {status=0x0, info=6}, ) == 0x0
 01138   484   NtQueryVolumeInformationFile  (92, 1369064, 284, Volume, ... {status=0x0, info=18}, ) == 0x0
 01139   484   NtQueryVolumeInformationFile  (92, 1369360, 276, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01140   484   NtClose  (92, ... ) == 0x0
 01141   484   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 92, {status=0x0, info=1}, ) }, 3, 8388641, ... 92, {status=0x0, info=1}, ) == 0x0
 01142   484   NtQueryVolumeInformationFile  (92, 1244784, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 01143   484   NtClose  (92, ... ) == 0x0
 01144   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01145   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 92, ) == 0x0
 01146   484   NtQueryInformationToken  (92, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01147   484   NtClose  (92, ... ) == 0x0
 01148   484   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_Classes"}, ... 92, ) }, ... 92, ) == 0x0
 01149   484   NtSetInformationObject  (94, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 01150   484   NtQueryKey  (94, Name, 382, ... {Name= (94, Name, 382, ... {Name="\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_CLASSES"}, 140, ) }, 140, ) == 0x0
 01151   484   NtOpenKey  (0x2000000, {24, 94, 0x40, 0, 0,  (0x2000000, {24, 94, 0x40, 0, 0, ".key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01152   484   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes"}, ... 96, ) }, ... 96, ) == 0x0
 01153   484   NtCreateKey  (0x2, {24, 96, 0x40, 0, 0,  (0x2, {24, 96, 0x40, 0, 0, ".key"}, 0, 0x0, 0, ... 100, 2, ) }, 0, 0x0, 0, ... 100, 2, ) == 0x0
 01154   484   NtClose  (96, ... ) == 0x0
 01155   484   NtQueryKey  (102, Name, 392, ... {Name= (102, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.keyo"}, 82, ) }, 82, ) == 0x0
 01156   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01157   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 96, ) == 0x0
 01158   484   NtQueryInformationToken  (96, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01159   484   NtClose  (96, ... ) == 0x0
 01160   484   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_Classes\.key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01161   484   NtSetValueKey  (102, 0x0, 0, 1,  (102, 0x0, 0, 1, "\0\0", 2, ... , 2, ...
 01162   484   NtSetInformationFile  (-2147482448, -139610320, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01161   484   NtSetValueKey  ... ) == 0x0
 01163   484   NtClose  (102, ... ) == 0x0
 01164   484   NtQueryKey  (94, Name, 384, ... {Name= (94, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_CLASSES"}, 140, ) }, 140, ) == 0x0
 01165   484   NtOpenKey  (0x2, {24, 94, 0x40, 0, 0,  (0x2, {24, 94, 0x40, 0, 0, ".key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01166   484   NtOpenKey  (0x2, {24, 0, 0x40, 0, 0,  (0x2, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\.key"}, ... 100, ) }, ... 100, ) == 0x0
 01167   484   NtQueryKey  (102, Name, 392, ... {Name= (102, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.keyo"}, 82, ) }, 82, ) == 0x0
 01168   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01169   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 96, ) == 0x0
 01170   484   NtQueryInformationToken  (96, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01171   484   NtClose  (96, ... ) == 0x0
 01172   484   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003_Classes\.key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01173   484   NtSetValueKey  (102, " (102, "", 0, 1, "r\0e\0g\0f\0i\0l\0e\0\0\0", 16, ... ) r\0e\0g\0f\0i\0l\0e\0\0\0", 16, ... ) == 0x0
 01174   484   NtClose  (102, ... ) == 0x0
 01175   484   NtQueryVirtualMemory  (-1, 0x47d625, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01176   484   NtContinue  (1244252, 0, ...
 01177   484   NtAllocateVirtualMemory  (-1, 0, 0, 122368, 4096, 4, ... 9830400, 122880, ) == 0x0
 01178   484   NtQueryVirtualMemory  (-1, 0x47d8a0, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01179   484   NtContinue  (1244236, 0, ...
 01180   484   NtAllocateVirtualMemory  (-1, 0, 0, 147456, 4096, 4, ... 11534336, 147456, ) == 0x0
 01181   484   NtQueryVirtualMemory  (-1, 0x47d9ca, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01182   484   NtContinue  (1244236, 0, ...
 01183   484   NtQueryVirtualMemory  (-1, 0x47dabd, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01184   484   NtContinue  (1244244, 0, ...
 01185   484   NtQueryVirtualMemory  (-1, 0x47dba9, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01186   484   NtContinue  (1244232, 0, ...
 01187   484   NtQueryVirtualMemory  (-1, 0x47dccd, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01188   484   NtContinue  (1244244, 0, ...
 01189   484   NtQueryVirtualMemory  (-1, 0x47dde5, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01190   484   NtContinue  (1244252, 0, ...
 01191   484   NtQueryVirtualMemory  (-1, 0x47df9e, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01192   484   NtContinue  (1244244, 0, ...
 01193   484   NtQueryVirtualMemory  (-1, 0x47df9e, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01194   484   NtContinue  (1244244, 0, ...
 01195   484   NtQueryVirtualMemory  (-1, 0x47df9e, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01196   484   NtContinue  (1244244, 0, ...
 01197   484   NtQueryVirtualMemory  (-1, 0x47df9e, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01198   484   NtContinue  (1244244, 0, ...
 01199   484   NtQueryVirtualMemory  (-1, 0x47df9e, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01200   484   NtContinue  (1244244, 0, ...
 01201   484   NtQueryVirtualMemory  (-1, 0x47df9e, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01202   484   NtContinue  (1244244, 0, ...
 01203   484   NtQueryVirtualMemory  (-1, 0x47df9e, Basic, 28, ... {BaseAddress=0x47d000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01204   484   NtContinue  (1244244, 0, ...
 01205   484   NtFreeVirtualMemory  (-1, (0x960000), 122368, 16384, ... (0x960000), 122880, ) == 0x0
 01206   484   NtQueryVirtualMemory  (-1, 0x47e2b8, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01207   484   NtContinue  (1244252, 0, ...
 01208   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01209   484   NtContinue  (1244252, 0, ...
 01210   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01211   484   NtContinue  (1244252, 0, ...
 01212   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01213   484   NtContinue  (1244252, 0, ...
 01214   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01215   484   NtContinue  (1244252, 0, ...
 01216   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01217   484   NtContinue  (1244252, 0, ...
 01218   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01219   484   NtContinue  (1244252, 0, ...
 01220   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01221   484   NtContinue  (1244252, 0, ...
 01222   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01223   484   NtContinue  (1244252, 0, ...
 01224   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01225   484   NtContinue  (1244252, 0, ...
 01226   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01227   484   NtContinue  (1244252, 0, ...
 01228   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01229   484   NtContinue  (1244252, 0, ...
 01230   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01231   484   NtContinue  (1244252, 0, ...
 01232   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01233   484   NtContinue  (1244252, 0, ...
 01234   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01235   484   NtContinue  (1244252, 0, ...
 01236   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01237   484   NtContinue  (1244252, 0, ...
 01238   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01239   484   NtContinue  (1244252, 0, ...
 01240   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01241   484   NtContinue  (1244252, 0, ...
 01242   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01243   484   NtContinue  (1244252, 0, ...
 01244   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01245   484   NtContinue  (1244252, 0, ...
 01246   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01247   484   NtContinue  (1244252, 0, ...
 01248   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01249   484   NtContinue  (1244252, 0, ...
 01250   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01251   484   NtContinue  (1244252, 0, ...
 01252   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01253   484   NtContinue  (1244252, 0, ...
 01254   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01255   484   NtContinue  (1244252, 0, ...
 01256   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01257   484   NtContinue  (1244252, 0, ...
 01258   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01259   484   NtContinue  (1244252, 0, ...
 01260   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01261   484   NtContinue  (1244252, 0, ...
 01262   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01263   484   NtContinue  (1244252, 0, ...
 01264   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01265   484   NtContinue  (1244252, 0, ...
 01266   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01267   484   NtContinue  (1244252, 0, ...
 01268   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01269   484   NtContinue  (1244252, 0, ...
 01270   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01271   484   NtContinue  (1244252, 0, ...
 01272   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01273   484   NtContinue  (1244252, 0, ...
 01274   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01275   484   NtContinue  (1244252, 0, ...
 01276   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01277   484   NtContinue  (1244252, 0, ...
 01278   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01279   484   NtContinue  (1244252, 0, ...
 01280   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01281   484   NtContinue  (1244252, 0, ...
 01282   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01283   484   NtContinue  (1244252, 0, ...
 01284   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01285   484   NtContinue  (1244252, 0, ...
 01286   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01287   484   NtContinue  (1244252, 0, ...
 01288   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01289   484   NtContinue  (1244252, 0, ...
 01290   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01291   484   NtContinue  (1244252, 0, ...
 01292   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01293   484   NtContinue  (1244252, 0, ...
 01294   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01295   484   NtContinue  (1244252, 0, ...
 01296   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01297   484   NtContinue  (1244252, 0, ...
 01298   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01299   484   NtContinue  (1244252, 0, ...
 01300   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01301   484   NtContinue  (1244252, 0, ...
 01302   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01303   484   NtContinue  (1244252, 0, ...
 01304   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01305   484   NtContinue  (1244252, 0, ...
 01306   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01307   484   NtContinue  (1244252, 0, ...
 01308   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01309   484   NtContinue  (1244252, 0, ...
 01310   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01311   484   NtContinue  (1244252, 0, ...
 01312   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01313   484   NtContinue  (1244252, 0, ...
 01314   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01315   484   NtContinue  (1244252, 0, ...
 01316   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01317   484   NtContinue  (1244252, 0, ...
 01318   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01319   484   NtContinue  (1244252, 0, ...
 01320   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01321   484   NtContinue  (1244252, 0, ...
 01322   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01323   484   NtContinue  (1244252, 0, ...
 01324   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01325   484   NtContinue  (1244252, 0, ...
 01326   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01327   484   NtContinue  (1244252, 0, ...
 01328   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01329   484   NtContinue  (1244252, 0, ...
 01330   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01331   484   NtContinue  (1244252, 0, ...
 01332   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01333   484   NtContinue  (1244252, 0, ...
 01334   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01335   484   NtContinue  (1244252, 0, ...
 01336   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01337   484   NtContinue  (1244252, 0, ...
 01338   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01339   484   NtContinue  (1244252, 0, ...
 01340   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01341   484   NtContinue  (1244252, 0, ...
 01342   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01343   484   NtContinue  (1244252, 0, ...
 01344   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01345   484   NtContinue  (1244252, 0, ...
 01346   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01347   484   NtContinue  (1244252, 0, ...
 01348   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01349   484   NtContinue  (1244252, 0, ...
 01350   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01351   484   NtContinue  (1244252, 0, ...
 01352   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01353   484   NtContinue  (1244252, 0, ...
 01354   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01355   484   NtContinue  (1244252, 0, ...
 01356   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01357   484   NtContinue  (1244252, 0, ...
 01358   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01359   484   NtContinue  (1244252, 0, ...
 01360   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01361   484   NtContinue  (1244252, 0, ...
 01362   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01363   484   NtContinue  (1244252, 0, ...
 01364   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01365   484   NtContinue  (1244252, 0, ...
 01366   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01367   484   NtContinue  (1244252, 0, ...
 01368   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01369   484   NtContinue  (1244252, 0, ...
 01370   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01371   484   NtContinue  (1244252, 0, ...
 01372   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01373   484   NtContinue  (1244252, 0, ...
 01374   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01375   484   NtContinue  (1244252, 0, ...
 01376   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01377   484   NtContinue  (1244252, 0, ...
 01378   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01379   484   NtContinue  (1244252, 0, ...
 01380   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01381   484   NtContinue  (1244252, 0, ...
 01382   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01383   484   NtContinue  (1244252, 0, ...
 01384   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01385   484   NtContinue  (1244252, 0, ...
 01386   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01387   484   NtContinue  (1244252, 0, ...
 01388   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01389   484   NtContinue  (1244252, 0, ...
 01390   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01391   484   NtContinue  (1244252, 0, ...
 01392   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01393   484   NtContinue  (1244252, 0, ...
 01394   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01395   484   NtContinue  (1244252, 0, ...
 01396   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01397   484   NtContinue  (1244252, 0, ...
 01398   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01399   484   NtContinue  (1244252, 0, ...
 01400   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01401   484   NtContinue  (1244252, 0, ...
 01402   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01403   484   NtContinue  (1244252, 0, ...
 01404   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01405   484   NtContinue  (1244252, 0, ...
 01406   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01407   484   NtContinue  (1244252, 0, ...
 01408   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01409   484   NtContinue  (1244252, 0, ...
 01410   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01411   484   NtContinue  (1244252, 0, ...
 01412   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01413   484   NtContinue  (1244252, 0, ...
 01414   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01415   484   NtContinue  (1244252, 0, ...
 01416   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01417   484   NtContinue  (1244252, 0, ...
 01418   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01419   484   NtContinue  (1244252, 0, ...
 01420   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01421   484   NtContinue  (1244252, 0, ...
 01422   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01423   484   NtContinue  (1244252, 0, ...
 01424   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01425   484   NtContinue  (1244252, 0, ...
 01426   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01427   484   NtContinue  (1244252, 0, ...
 01428   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01429   484   NtContinue  (1244252, 0, ...
 01430   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01431   484   NtContinue  (1244252, 0, ...
 01432   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01433   484   NtContinue  (1244252, 0, ...
 01434   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01435   484   NtContinue  (1244252, 0, ...
 01436   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01437   484   NtContinue  (1244252, 0, ...
 01438   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01439   484   NtContinue  (1244252, 0, ...
 01440   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01441   484   NtContinue  (1244252, 0, ...
 01442   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01443   484   NtContinue  (1244252, 0, ...
 01444   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01445   484   NtContinue  (1244252, 0, ...
 01446   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01447   484   NtContinue  (1244252, 0, ...
 01448   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01449   484   NtContinue  (1244252, 0, ...
 01450   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01451   484   NtContinue  (1244252, 0, ...
 01452   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01453   484   NtContinue  (1244252, 0, ...
 01454   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01455   484   NtContinue  (1244252, 0, ...
 01456   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01457   484   NtContinue  (1244252, 0, ...
 01458   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01459   484   NtContinue  (1244252, 0, ...
 01460   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01461   484   NtContinue  (1244252, 0, ...
 01462   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01463   484   NtContinue  (1244252, 0, ...
 01464   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01465   484   NtContinue  (1244252, 0, ...
 01466   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01467   484   NtContinue  (1244252, 0, ...
 01468   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01469   484   NtContinue  (1244252, 0, ...
 01470   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01471   484   NtContinue  (1244252, 0, ...
 01472   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01473   484   NtContinue  (1244252, 0, ...
 01474   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01475   484   NtContinue  (1244252, 0, ...
 01476   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01477   484   NtContinue  (1244252, 0, ...
 01478   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01479   484   NtContinue  (1244252, 0, ...
 01480   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01481   484   NtContinue  (1244252, 0, ...
 01482   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01483   484   NtContinue  (1244252, 0, ...
 01484   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01485   484   NtContinue  (1244252, 0, ...
 01486   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01487   484   NtContinue  (1244252, 0, ...
 01488   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01489   484   NtContinue  (1244252, 0, ...
 01490   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01491   484   NtContinue  (1244252, 0, ...
 01492   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01493   484   NtContinue  (1244252, 0, ...
 01494   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01495   484   NtContinue  (1244252, 0, ...
 01496   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01497   484   NtContinue  (1244252, 0, ...
 01498   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01499   484   NtContinue  (1244252, 0, ...
 01500   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01501   484   NtContinue  (1244252, 0, ...
 01502   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01503   484   NtContinue  (1244252, 0, ...
 01504   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01505   484   NtContinue  (1244252, 0, ...
 01506   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01507   484   NtContinue  (1244252, 0, ...
 01508   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01509   484   NtContinue  (1244252, 0, ...
 01510   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01511   484   NtContinue  (1244252, 0, ...
 01512   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01513   484   NtContinue  (1244252, 0, ...
 01514   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01515   484   NtContinue  (1244252, 0, ...
 01516   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01517   484   NtContinue  (1244252, 0, ...
 01518   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01519   484   NtContinue  (1244252, 0, ...
 01520   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01521   484   NtContinue  (1244252, 0, ...
 01522   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01523   484   NtContinue  (1244252, 0, ...
 01524   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01525   484   NtContinue  (1244252, 0, ...
 01526   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01527   484   NtContinue  (1244252, 0, ...
 01528   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01529   484   NtContinue  (1244252, 0, ...
 01530   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01531   484   NtContinue  (1244252, 0, ...
 01532   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01533   484   NtContinue  (1244252, 0, ...
 01534   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01535   484   NtContinue  (1244252, 0, ...
 01536   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01537   484   NtContinue  (1244252, 0, ...
 01538   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01539   484   NtContinue  (1244252, 0, ...
 01540   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01541   484   NtContinue  (1244252, 0, ...
 01542   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01543   484   NtContinue  (1244252, 0, ...
 01544   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01545   484   NtContinue  (1244252, 0, ...
 01546   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01547   484   NtContinue  (1244252, 0, ...
 01548   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01549   484   NtContinue  (1244252, 0, ...
 01550   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01551   484   NtContinue  (1244252, 0, ...
 01552   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01553   484   NtContinue  (1244252, 0, ...
 01554   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01555   484   NtContinue  (1244252, 0, ...
 01556   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01557   484   NtContinue  (1244252, 0, ...
 01558   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01559   484   NtContinue  (1244252, 0, ...
 01560   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01561   484   NtContinue  (1244252, 0, ...
 01562   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01563   484   NtContinue  (1244252, 0, ...
 01564   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01565   484   NtContinue  (1244252, 0, ...
 01566   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01567   484   NtContinue  (1244252, 0, ...
 01568   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01569   484   NtContinue  (1244252, 0, ...
 01570   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01571   484   NtContinue  (1244252, 0, ...
 01572   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01573   484   NtContinue  (1244252, 0, ...
 01574   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01575   484   NtContinue  (1244252, 0, ...
 01576   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01577   484   NtContinue  (1244252, 0, ...
 01578   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01579   484   NtContinue  (1244252, 0, ...
 01580   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01581   484   NtContinue  (1244252, 0, ...
 01582   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01583   484   NtContinue  (1244252, 0, ...
 01584   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01585   484   NtContinue  (1244252, 0, ...
 01586   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01587   484   NtContinue  (1244252, 0, ...
 01588   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01589   484   NtContinue  (1244252, 0, ...
 01590   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01591   484   NtContinue  (1244252, 0, ...
 01592   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01593   484   NtContinue  (1244252, 0, ...
 01594   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01595   484   NtContinue  (1244252, 0, ...
 01596   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01597   484   NtContinue  (1244252, 0, ...
 01598   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01599   484   NtContinue  (1244252, 0, ...
 01600   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01601   484   NtContinue  (1244252, 0, ...
 01602   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01603   484   NtContinue  (1244252, 0, ...
 01604   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01605   484   NtContinue  (1244252, 0, ...
 01606   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01607   484   NtContinue  (1244252, 0, ...
 01608   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01609   484   NtContinue  (1244252, 0, ...
 01610   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01611   484   NtContinue  (1244252, 0, ...
 01612   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01613   484   NtContinue  (1244252, 0, ...
 01614   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01615   484   NtContinue  (1244252, 0, ...
 01616   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01617   484   NtContinue  (1244252, 0, ...
 01618   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01619   484   NtContinue  (1244252, 0, ...
 01620   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01621   484   NtContinue  (1244252, 0, ...
 01622   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01623   484   NtContinue  (1244252, 0, ...
 01624   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01625   484   NtContinue  (1244252, 0, ...
 01626   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01627   484   NtContinue  (1244252, 0, ...
 01628   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01629   484   NtContinue  (1244252, 0, ...
 01630   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01631   484   NtContinue  (1244252, 0, ...
 01632   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01633   484   NtContinue  (1244252, 0, ...
 01634   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01635   484   NtContinue  (1244252, 0, ...
 01636   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01637   484   NtContinue  (1244252, 0, ...
 01638   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01639   484   NtContinue  (1244252, 0, ...
 01640   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01641   484   NtContinue  (1244252, 0, ...
 01642   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01643   484   NtContinue  (1244252, 0, ...
 01644   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01645   484   NtContinue  (1244252, 0, ...
 01646   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01647   484   NtContinue  (1244252, 0, ...
 01648   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01649   484   NtContinue  (1244252, 0, ...
 01650   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01651   484   NtContinue  (1244252, 0, ...
 01652   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01653   484   NtContinue  (1244252, 0, ...
 01654   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01655   484   NtContinue  (1244252, 0, ...
 01656   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01657   484   NtContinue  (1244252, 0, ...
 01658   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01659   484   NtContinue  (1244252, 0, ...
 01660   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01661   484   NtContinue  (1244252, 0, ...
 01662   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01663   484   NtContinue  (1244252, 0, ...
 01664   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01665   484   NtContinue  (1244252, 0, ...
 01666   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01667   484   NtContinue  (1244252, 0, ...
 01668   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01669   484   NtContinue  (1244252, 0, ...
 01670   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01671   484   NtContinue  (1244252, 0, ...
 01672   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01673   484   NtContinue  (1244252, 0, ...
 01674   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01675   484   NtContinue  (1244252, 0, ...
 01676   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01677   484   NtContinue  (1244252, 0, ...
 01678   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01679   484   NtContinue  (1244252, 0, ...
 01680   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01681   484   NtContinue  (1244252, 0, ...
 01682   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01683   484   NtContinue  (1244252, 0, ...
 01684   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01685   484   NtContinue  (1244252, 0, ...
 01686   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01687   484   NtContinue  (1244252, 0, ...
 01688   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01689   484   NtContinue  (1244252, 0, ...
 01690   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01691   484   NtContinue  (1244252, 0, ...
 01692   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01693   484   NtContinue  (1244252, 0, ...
 01694   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01695   484   NtContinue  (1244252, 0, ...
 01696   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01697   484   NtContinue  (1244252, 0, ...
 01698   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01699   484   NtContinue  (1244252, 0, ...
 01700   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01701   484   NtContinue  (1244252, 0, ...
 01702   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01703   484   NtContinue  (1244252, 0, ...
 01704   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01705   484   NtContinue  (1244252, 0, ...
 01706   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01707   484   NtContinue  (1244252, 0, ...
 01708   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01709   484   NtContinue  (1244252, 0, ...
 01710   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01711   484   NtContinue  (1244252, 0, ...
 01712   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01713   484   NtContinue  (1244252, 0, ...
 01714   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01715   484   NtContinue  (1244252, 0, ...
 01716   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01717   484   NtContinue  (1244252, 0, ...
 01718   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01719   484   NtContinue  (1244252, 0, ...
 01720   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01721   484   NtContinue  (1244252, 0, ...
 01722   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01723   484   NtContinue  (1244252, 0, ...
 01724   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01725   484   NtContinue  (1244252, 0, ...
 01726   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01727   484   NtContinue  (1244252, 0, ...
 01728   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01729   484   NtContinue  (1244252, 0, ...
 01730   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01731   484   NtContinue  (1244252, 0, ...
 01732   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01733   484   NtContinue  (1244252, 0, ...
 01734   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01735   484   NtContinue  (1244252, 0, ...
 01736   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01737   484   NtContinue  (1244252, 0, ...
 01738   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01739   484   NtContinue  (1244252, 0, ...
 01740   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01741   484   NtContinue  (1244252, 0, ...
 01742   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01743   484   NtContinue  (1244252, 0, ...
 01744   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01745   484   NtContinue  (1244252, 0, ...
 01746   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01747   484   NtContinue  (1244252, 0, ...
 01748   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01749   484   NtContinue  (1244252, 0, ...
 01750   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01751   484   NtContinue  (1244252, 0, ...
 01752   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01753   484   NtContinue  (1244252, 0, ...
 01754   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01755   484   NtContinue  (1244252, 0, ...
 01756   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01757   484   NtContinue  (1244252, 0, ...
 01758   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01759   484   NtContinue  (1244252, 0, ...
 01760   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01761   484   NtContinue  (1244252, 0, ...
 01762   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01763   484   NtContinue  (1244252, 0, ...
 01764   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01765   484   NtContinue  (1244252, 0, ...
 01766   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01767   484   NtContinue  (1244252, 0, ...
 01768   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01769   484   NtContinue  (1244252, 0, ...
 01770   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01771   484   NtContinue  (1244252, 0, ...
 01772   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01773   484   NtContinue  (1244252, 0, ...
 01774   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01775   484   NtContinue  (1244252, 0, ...
 01776   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01777   484   NtContinue  (1244252, 0, ...
 01778   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01779   484   NtContinue  (1244252, 0, ...
 01780   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01781   484   NtContinue  (1244252, 0, ...
 01782   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01783   484   NtContinue  (1244252, 0, ...
 01784   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01785   484   NtContinue  (1244252, 0, ...
 01786   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01787   484   NtContinue  (1244252, 0, ...
 01788   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01789   484   NtContinue  (1244252, 0, ...
 01790   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01791   484   NtContinue  (1244252, 0, ...
 01792   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01793   484   NtContinue  (1244252, 0, ...
 01794   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01795   484   NtContinue  (1244252, 0, ...
 01796   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01797   484   NtContinue  (1244252, 0, ...
 01798   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01799   484   NtContinue  (1244252, 0, ...
 01800   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01801   484   NtContinue  (1244252, 0, ...
 01802   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01803   484   NtContinue  (1244252, 0, ...
 01804   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01805   484   NtContinue  (1244252, 0, ...
 01806   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01807   484   NtContinue  (1244252, 0, ...
 01808   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01809   484   NtContinue  (1244252, 0, ...
 01810   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01811   484   NtContinue  (1244252, 0, ...
 01812   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01813   484   NtContinue  (1244252, 0, ...
 01814   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01815   484   NtContinue  (1244252, 0, ...
 01816   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01817   484   NtContinue  (1244252, 0, ...
 01818   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01819   484   NtContinue  (1244252, 0, ...
 01820   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01821   484   NtContinue  (1244252, 0, ...
 01822   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01823   484   NtContinue  (1244252, 0, ...
 01824   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01825   484   NtContinue  (1244252, 0, ...
 01826   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01827   484   NtContinue  (1244252, 0, ...
 01828   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01829   484   NtContinue  (1244252, 0, ...
 01830   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01831   484   NtContinue  (1244252, 0, ...
 01832   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01833   484   NtContinue  (1244252, 0, ...
 01834   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01835   484   NtContinue  (1244252, 0, ...
 01836   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01837   484   NtContinue  (1244252, 0, ...
 01838   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01839   484   NtContinue  (1244252, 0, ...
 01840   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01841   484   NtContinue  (1244252, 0, ...
 01842   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01843   484   NtContinue  (1244252, 0, ...
 01844   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01845   484   NtContinue  (1244252, 0, ...
 01846   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01847   484   NtContinue  (1244252, 0, ...
 01848   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01849   484   NtContinue  (1244252, 0, ...
 01850   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01851   484   NtContinue  (1244252, 0, ...
 01852   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01853   484   NtContinue  (1244252, 0, ...
 01854   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01855   484   NtContinue  (1244252, 0, ...
 01856   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01857   484   NtContinue  (1244252, 0, ...
 01858   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01859   484   NtContinue  (1244252, 0, ...
 01860   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01861   484   NtContinue  (1244252, 0, ...
 01862   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01863   484   NtContinue  (1244252, 0, ...
 01864   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01865   484   NtContinue  (1244252, 0, ...
 01866   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01867   484   NtContinue  (1244252, 0, ...
 01868   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01869   484   NtContinue  (1244252, 0, ...
 01870   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01871   484   NtContinue  (1244252, 0, ...
 01872   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01873   484   NtContinue  (1244252, 0, ...
 01874   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01875   484   NtContinue  (1244252, 0, ...
 01876   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01877   484   NtContinue  (1244252, 0, ...
 01878   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01879   484   NtContinue  (1244252, 0, ...
 01880   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01881   484   NtContinue  (1244252, 0, ...
 01882   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01883   484   NtContinue  (1244252, 0, ...
 01884   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01885   484   NtContinue  (1244252, 0, ...
 01886   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01887   484   NtContinue  (1244252, 0, ...
 01888   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01889   484   NtContinue  (1244252, 0, ...
 01890   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01891   484   NtContinue  (1244252, 0, ...
 01892   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01893   484   NtContinue  (1244252, 0, ...
 01894   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01895   484   NtContinue  (1244252, 0, ...
 01896   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01897   484   NtContinue  (1244252, 0, ...
 01898   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01899   484   NtContinue  (1244252, 0, ...
 01900   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01901   484   NtContinue  (1244252, 0, ...
 01902   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01903   484   NtContinue  (1244252, 0, ...
 01904   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01905   484   NtContinue  (1244252, 0, ...
 01906   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01907   484   NtContinue  (1244252, 0, ...
 01908   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01909   484   NtContinue  (1244252, 0, ...
 01910   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01911   484   NtContinue  (1244252, 0, ...
 01912   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01913   484   NtContinue  (1244252, 0, ...
 01914   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01915   484   NtContinue  (1244252, 0, ...
 01916   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01917   484   NtContinue  (1244252, 0, ...
 01918   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01919   484   NtContinue  (1244252, 0, ...
 01920   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01921   484   NtContinue  (1244252, 0, ...
 01922   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01923   484   NtContinue  (1244252, 0, ...
 01924   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01925   484   NtContinue  (1244252, 0, ...
 01926   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01927   484   NtContinue  (1244252, 0, ...
 01928   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01929   484   NtContinue  (1244252, 0, ...
 01930   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01931   484   NtContinue  (1244252, 0, ...
 01932   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01933   484   NtContinue  (1244252, 0, ...
 01934   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01935   484   NtContinue  (1244252, 0, ...
 01936   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01937   484   NtContinue  (1244252, 0, ...
 01938   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01939   484   NtContinue  (1244252, 0, ...
 01940   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01941   484   NtContinue  (1244252, 0, ...
 01942   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01943   484   NtContinue  (1244252, 0, ...
 01944   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01945   484   NtContinue  (1244252, 0, ...
 01946   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01947   484   NtContinue  (1244252, 0, ...
 01948   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01949   484   NtContinue  (1244252, 0, ...
 01950   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01951   484   NtContinue  (1244252, 0, ...
 01952   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01953   484   NtContinue  (1244252, 0, ...
 01954   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01955   484   NtContinue  (1244252, 0, ...
 01956   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01957   484   NtContinue  (1244252, 0, ...
 01958   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01959   484   NtContinue  (1244252, 0, ...
 01960   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01961   484   NtContinue  (1244252, 0, ...
 01962   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01963   484   NtContinue  (1244252, 0, ...
 01964   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01965   484   NtContinue  (1244252, 0, ...
 01966   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01967   484   NtContinue  (1244252, 0, ...
 01968   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01969   484   NtContinue  (1244252, 0, ...
 01970   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01971   484   NtContinue  (1244252, 0, ...
 01972   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01973   484   NtContinue  (1244252, 0, ...
 01974   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01975   484   NtContinue  (1244252, 0, ...
 01976   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01977   484   NtContinue  (1244252, 0, ...
 01978   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01979   484   NtContinue  (1244252, 0, ...
 01980   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01981   484   NtContinue  (1244252, 0, ...
 01982   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01983   484   NtContinue  (1244252, 0, ...
 01984   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01985   484   NtContinue  (1244252, 0, ...
 01986   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01987   484   NtContinue  (1244252, 0, ...
 01988   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01989   484   NtContinue  (1244252, 0, ...
 01990   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01991   484   NtContinue  (1244252, 0, ...
 01992   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01993   484   NtContinue  (1244252, 0, ...
 01994   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01995   484   NtContinue  (1244252, 0, ...
 01996   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01997   484   NtContinue  (1244252, 0, ...
 01998   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01999   484   NtContinue  (1244252, 0, ...
 02000   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02001   484   NtContinue  (1244252, 0, ...
 02002   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02003   484   NtContinue  (1244252, 0, ...
 02004   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02005   484   NtContinue  (1244252, 0, ...
 02006   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02007   484   NtContinue  (1244252, 0, ...
 02008   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02009   484   NtContinue  (1244252, 0, ...
 02010   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02011   484   NtContinue  (1244252, 0, ...
 02012   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02013   484   NtContinue  (1244252, 0, ...
 02014   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02015   484   NtContinue  (1244252, 0, ...
 02016   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02017   484   NtContinue  (1244252, 0, ...
 02018   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02019   484   NtContinue  (1244252, 0, ...
 02020   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02021   484   NtContinue  (1244252, 0, ...
 02022   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02023   484   NtContinue  (1244252, 0, ...
 02024   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02025   484   NtContinue  (1244252, 0, ...
 02026   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02027   484   NtContinue  (1244252, 0, ...
 02028   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02029   484   NtContinue  (1244252, 0, ...
 02030   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02031   484   NtContinue  (1244252, 0, ...
 02032   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02033   484   NtContinue  (1244252, 0, ...
 02034   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02035   484   NtContinue  (1244252, 0, ...
 02036   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02037   484   NtContinue  (1244252, 0, ...
 02038   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02039   484   NtContinue  (1244252, 0, ...
 02040   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02041   484   NtContinue  (1244252, 0, ...
 02042   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02043   484   NtContinue  (1244252, 0, ...
 02044   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02045   484   NtContinue  (1244252, 0, ...
 02046   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02047   484   NtContinue  (1244252, 0, ...
 02048   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02049   484   NtContinue  (1244252, 0, ...
 02050   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02051   484   NtContinue  (1244252, 0, ...
 02052   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02053   484   NtContinue  (1244252, 0, ...
 02054   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02055   484   NtContinue  (1244252, 0, ...
 02056   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02057   484   NtContinue  (1244252, 0, ...
 02058   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02059   484   NtContinue  (1244252, 0, ...
 02060   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02061   484   NtContinue  (1244252, 0, ...
 02062   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02063   484   NtContinue  (1244252, 0, ...
 02064   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02065   484   NtContinue  (1244252, 0, ...
 02066   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02067   484   NtContinue  (1244252, 0, ...
 02068   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02069   484   NtContinue  (1244252, 0, ...
 02070   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02071   484   NtContinue  (1244252, 0, ...
 02072   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02073   484   NtContinue  (1244252, 0, ...
 02074   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02075   484   NtContinue  (1244252, 0, ...
 02076   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02077   484   NtContinue  (1244252, 0, ...
 02078   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02079   484   NtContinue  (1244252, 0, ...
 02080   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02081   484   NtContinue  (1244252, 0, ...
 02082   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02083   484   NtContinue  (1244252, 0, ...
 02084   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02085   484   NtContinue  (1244252, 0, ...
 02086   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02087   484   NtContinue  (1244252, 0, ...
 02088   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02089   484   NtContinue  (1244252, 0, ...
 02090   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02091   484   NtContinue  (1244252, 0, ...
 02092   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02093   484   NtContinue  (1244252, 0, ...
 02094   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02095   484   NtContinue  (1244252, 0, ...
 02096   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02097   484   NtContinue  (1244252, 0, ...
 02098   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02099   484   NtContinue  (1244252, 0, ...
 02100   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02101   484   NtContinue  (1244252, 0, ...
 02102   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02103   484   NtContinue  (1244252, 0, ...
 02104   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02105   484   NtContinue  (1244252, 0, ...
 02106   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02107   484   NtContinue  (1244252, 0, ...
 02108   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02109   484   NtContinue  (1244252, 0, ...
 02110   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02111   484   NtContinue  (1244252, 0, ...
 02112   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02113   484   NtContinue  (1244252, 0, ...
 02114   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02115   484   NtContinue  (1244252, 0, ...
 02116   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02117   484   NtContinue  (1244252, 0, ...
 02118   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02119   484   NtContinue  (1244252, 0, ...
 02120   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02121   484   NtContinue  (1244252, 0, ...
 02122   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02123   484   NtContinue  (1244252, 0, ...
 02124   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02125   484   NtContinue  (1244252, 0, ...
 02126   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02127   484   NtContinue  (1244252, 0, ...
 02128   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02129   484   NtContinue  (1244252, 0, ...
 02130   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02131   484   NtContinue  (1244252, 0, ...
 02132   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02133   484   NtContinue  (1244252, 0, ...
 02134   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02135   484   NtContinue  (1244252, 0, ...
 02136   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02137   484   NtContinue  (1244252, 0, ...
 02138   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02139   484   NtContinue  (1244252, 0, ...
 02140   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02141   484   NtContinue  (1244252, 0, ...
 02142   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02143   484   NtContinue  (1244252, 0, ...
 02144   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02145   484   NtContinue  (1244252, 0, ...
 02146   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02147   484   NtContinue  (1244252, 0, ...
 02148   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02149   484   NtContinue  (1244252, 0, ...
 02150   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02151   484   NtContinue  (1244252, 0, ...
 02152   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02153   484   NtContinue  (1244252, 0, ...
 02154   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02155   484   NtContinue  (1244252, 0, ...
 02156   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02157   484   NtContinue  (1244252, 0, ...
 02158   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02159   484   NtContinue  (1244252, 0, ...
 02160   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02161   484   NtContinue  (1244252, 0, ...
 02162   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02163   484   NtContinue  (1244252, 0, ...
 02164   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02165   484   NtContinue  (1244252, 0, ...
 02166   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02167   484   NtContinue  (1244252, 0, ...
 02168   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02169   484   NtContinue  (1244252, 0, ...
 02170   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02171   484   NtContinue  (1244252, 0, ...
 02172   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02173   484   NtContinue  (1244252, 0, ...
 02174   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02175   484   NtContinue  (1244252, 0, ...
 02176   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02177   484   NtContinue  (1244252, 0, ...
 02178   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02179   484   NtContinue  (1244252, 0, ...
 02180   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02181   484   NtContinue  (1244252, 0, ...
 02182   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02183   484   NtContinue  (1244252, 0, ...
 02184   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02185   484   NtContinue  (1244252, 0, ...
 02186   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02187   484   NtContinue  (1244252, 0, ...
 02188   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02189   484   NtContinue  (1244252, 0, ...
 02190   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02191   484   NtContinue  (1244252, 0, ...
 02192   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02193   484   NtContinue  (1244252, 0, ...
 02194   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02195   484   NtContinue  (1244252, 0, ...
 02196   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02197   484   NtContinue  (1244252, 0, ...
 02198   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02199   484   NtContinue  (1244252, 0, ...
 02200   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02201   484   NtContinue  (1244252, 0, ...
 02202   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02203   484   NtContinue  (1244252, 0, ...
 02204   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02205   484   NtContinue  (1244252, 0, ...
 02206   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02207   484   NtContinue  (1244252, 0, ...
 02208   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02209   484   NtContinue  (1244252, 0, ...
 02210   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02211   484   NtContinue  (1244252, 0, ...
 02212   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02213   484   NtContinue  (1244252, 0, ...
 02214   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02215   484   NtContinue  (1244252, 0, ...
 02216   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02217   484   NtContinue  (1244252, 0, ...
 02218   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02219   484   NtContinue  (1244252, 0, ...
 02220   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02221   484   NtContinue  (1244252, 0, ...
 02222   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02223   484   NtContinue  (1244252, 0, ...
 02224   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02225   484   NtContinue  (1244252, 0, ...
 02226   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02227   484   NtContinue  (1244252, 0, ...
 02228   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02229   484   NtContinue  (1244252, 0, ...
 02230   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02231   484   NtContinue  (1244252, 0, ...
 02232   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02233   484   NtContinue  (1244252, 0, ...
 02234   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02235   484   NtContinue  (1244252, 0, ...
 02236   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02237   484   NtContinue  (1244252, 0, ...
 02238   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02239   484   NtContinue  (1244252, 0, ...
 02240   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02241   484   NtContinue  (1244252, 0, ...
 02242   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02243   484   NtContinue  (1244252, 0, ...
 02244   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02245   484   NtContinue  (1244252, 0, ...
 02246   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02247   484   NtContinue  (1244252, 0, ...
 02248   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02249   484   NtContinue  (1244252, 0, ...
 02250   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02251   484   NtContinue  (1244252, 0, ...
 02252   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02253   484   NtContinue  (1244252, 0, ...
 02254   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02255   484   NtContinue  (1244252, 0, ...
 02256   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02257   484   NtContinue  (1244252, 0, ...
 02258   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02259   484   NtContinue  (1244252, 0, ...
 02260   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02261   484   NtContinue  (1244252, 0, ...
 02262   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02263   484   NtContinue  (1244252, 0, ...
 02264   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02265   484   NtContinue  (1244252, 0, ...
 02266   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02267   484   NtContinue  (1244252, 0, ...
 02268   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02269   484   NtContinue  (1244252, 0, ...
 02270   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02271   484   NtContinue  (1244252, 0, ...
 02272   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02273   484   NtContinue  (1244252, 0, ...
 02274   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02275   484   NtContinue  (1244252, 0, ...
 02276   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02277   484   NtContinue  (1244252, 0, ...
 02278   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02279   484   NtContinue  (1244252, 0, ...
 02280   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02281   484   NtContinue  (1244252, 0, ...
 02282   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02283   484   NtContinue  (1244252, 0, ...
 02284   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02285   484   NtContinue  (1244252, 0, ...
 02286   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02287   484   NtContinue  (1244252, 0, ...
 02288   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02289   484   NtContinue  (1244252, 0, ...
 02290   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02291   484   NtContinue  (1244252, 0, ...
 02292   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02293   484   NtContinue  (1244252, 0, ...
 02294   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02295   484   NtContinue  (1244252, 0, ...
 02296   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02297   484   NtContinue  (1244252, 0, ...
 02298   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02299   484   NtContinue  (1244252, 0, ...
 02300   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02301   484   NtContinue  (1244252, 0, ...
 02302   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02303   484   NtContinue  (1244252, 0, ...
 02304   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02305   484   NtContinue  (1244252, 0, ...
 02306   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02307   484   NtContinue  (1244252, 0, ...
 02308   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02309   484   NtContinue  (1244252, 0, ...
 02310   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02311   484   NtContinue  (1244252, 0, ...
 02312   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02313   484   NtContinue  (1244252, 0, ...
 02314   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02315   484   NtContinue  (1244252, 0, ...
 02316   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02317   484   NtContinue  (1244252, 0, ...
 02318   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02319   484   NtContinue  (1244252, 0, ...
 02320   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02321   484   NtContinue  (1244252, 0, ...
 02322   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02323   484   NtContinue  (1244252, 0, ...
 02324   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02325   484   NtContinue  (1244252, 0, ...
 02326   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02327   484   NtContinue  (1244252, 0, ...
 02328   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02329   484   NtContinue  (1244252, 0, ...
 02330   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02331   484   NtContinue  (1244252, 0, ...
 02332   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02333   484   NtContinue  (1244252, 0, ...
 02334   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02335   484   NtContinue  (1244252, 0, ...
 02336   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02337   484   NtContinue  (1244252, 0, ...
 02338   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02339   484   NtContinue  (1244252, 0, ...
 02340   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02341   484   NtContinue  (1244252, 0, ...
 02342   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02343   484   NtContinue  (1244252, 0, ...
 02344   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02345   484   NtContinue  (1244252, 0, ...
 02346   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02347   484   NtContinue  (1244252, 0, ...
 02348   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02349   484   NtContinue  (1244252, 0, ...
 02350   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02351   484   NtContinue  (1244252, 0, ...
 02352   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02353   484   NtContinue  (1244252, 0, ...
 02354   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02355   484   NtContinue  (1244252, 0, ...
 02356   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02357   484   NtContinue  (1244252, 0, ...
 02358   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02359   484   NtContinue  (1244252, 0, ...
 02360   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02361   484   NtContinue  (1244252, 0, ...
 02362   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02363   484   NtContinue  (1244252, 0, ...
 02364   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02365   484   NtContinue  (1244252, 0, ...
 02366   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02367   484   NtContinue  (1244252, 0, ...
 02368   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02369   484   NtContinue  (1244252, 0, ...
 02370   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02371   484   NtContinue  (1244252, 0, ...
 02372   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02373   484   NtContinue  (1244252, 0, ...
 02374   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02375   484   NtContinue  (1244252, 0, ...
 02376   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02377   484   NtContinue  (1244252, 0, ...
 02378   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02379   484   NtContinue  (1244252, 0, ...
 02380   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02381   484   NtContinue  (1244252, 0, ...
 02382   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02383   484   NtContinue  (1244252, 0, ...
 02384   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02385   484   NtContinue  (1244252, 0, ...
 02386   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02387   484   NtContinue  (1244252, 0, ...
 02388   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02389   484   NtContinue  (1244252, 0, ...
 02390   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02391   484   NtContinue  (1244252, 0, ...
 02392   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02393   484   NtContinue  (1244252, 0, ...
 02394   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02395   484   NtContinue  (1244252, 0, ...
 02396   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02397   484   NtContinue  (1244252, 0, ...
 02398   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02399   484   NtContinue  (1244252, 0, ...
 02400   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02401   484   NtContinue  (1244252, 0, ...
 02402   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02403   484   NtContinue  (1244252, 0, ...
 02404   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02405   484   NtContinue  (1244252, 0, ...
 02406   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02407   484   NtContinue  (1244252, 0, ...
 02408   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02409   484   NtContinue  (1244252, 0, ...
 02410   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02411   484   NtContinue  (1244252, 0, ...
 02412   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02413   484   NtContinue  (1244252, 0, ...
 02414   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02415   484   NtContinue  (1244252, 0, ...
 02416   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02417   484   NtContinue  (1244252, 0, ...
 02418   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02419   484   NtContinue  (1244252, 0, ...
 02420   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02421   484   NtContinue  (1244252, 0, ...
 02422   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02423   484   NtContinue  (1244252, 0, ...
 02424   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02425   484   NtContinue  (1244252, 0, ...
 02426   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02427   484   NtContinue  (1244252, 0, ...
 02428   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02429   484   NtContinue  (1244252, 0, ...
 02430   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02431   484   NtContinue  (1244252, 0, ...
 02432   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02433   484   NtContinue  (1244252, 0, ...
 02434   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02435   484   NtContinue  (1244252, 0, ...
 02436   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02437   484   NtContinue  (1244252, 0, ...
 02438   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02439   484   NtContinue  (1244252, 0, ...
 02440   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02441   484   NtContinue  (1244252, 0, ...
 02442   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02443   484   NtContinue  (1244252, 0, ...
 02444   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02445   484   NtContinue  (1244252, 0, ...
 02446   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02447   484   NtContinue  (1244252, 0, ...
 02448   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02449   484   NtContinue  (1244252, 0, ...
 02450   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02451   484   NtContinue  (1244252, 0, ...
 02452   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02453   484   NtContinue  (1244252, 0, ...
 02454   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02455   484   NtContinue  (1244252, 0, ...
 02456   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02457   484   NtContinue  (1244252, 0, ...
 02458   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02459   484   NtContinue  (1244252, 0, ...
 02460   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02461   484   NtContinue  (1244252, 0, ...
 02462   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02463   484   NtContinue  (1244252, 0, ...
 02464   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02465   484   NtContinue  (1244252, 0, ...
 02466   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02467   484   NtContinue  (1244252, 0, ...
 02468   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02469   484   NtContinue  (1244252, 0, ...
 02470   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02471   484   NtContinue  (1244252, 0, ...
 02472   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02473   484   NtContinue  (1244252, 0, ...
 02474   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02475   484   NtContinue  (1244252, 0, ...
 02476   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02477   484   NtContinue  (1244252, 0, ...
 02478   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02479   484   NtContinue  (1244252, 0, ...
 02480   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02481   484   NtContinue  (1244252, 0, ...
 02482   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02483   484   NtContinue  (1244252, 0, ...
 02484   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02485   484   NtContinue  (1244252, 0, ...
 02486   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02487   484   NtContinue  (1244252, 0, ...
 02488   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02489   484   NtContinue  (1244252, 0, ...
 02490   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02491   484   NtContinue  (1244252, 0, ...
 02492   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02493   484   NtContinue  (1244252, 0, ...
 02494   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02495   484   NtContinue  (1244252, 0, ...
 02496   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02497   484   NtContinue  (1244252, 0, ...
 02498   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02499   484   NtContinue  (1244252, 0, ...
 02500   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02501   484   NtContinue  (1244252, 0, ...
 02502   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02503   484   NtContinue  (1244252, 0, ...
 02504   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02505   484   NtContinue  (1244252, 0, ...
 02506   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02507   484   NtContinue  (1244252, 0, ...
 02508   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02509   484   NtContinue  (1244252, 0, ...
 02510   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02511   484   NtContinue  (1244252, 0, ...
 02512   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02513   484   NtContinue  (1244252, 0, ...
 02514   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02515   484   NtContinue  (1244252, 0, ...
 02516   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02517   484   NtContinue  (1244252, 0, ...
 02518   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02519   484   NtContinue  (1244252, 0, ...
 02520   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02521   484   NtContinue  (1244252, 0, ...
 02522   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02523   484   NtContinue  (1244252, 0, ...
 02524   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02525   484   NtContinue  (1244252, 0, ...
 02526   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02527   484   NtContinue  (1244252, 0, ...
 02528   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02529   484   NtContinue  (1244252, 0, ...
 02530   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02531   484   NtContinue  (1244252, 0, ...
 02532   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02533   484   NtContinue  (1244252, 0, ...
 02534   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02535   484   NtContinue  (1244252, 0, ...
 02536   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02537   484   NtContinue  (1244252, 0, ...
 02538   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02539   484   NtContinue  (1244252, 0, ...
 02540   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02541   484   NtContinue  (1244252, 0, ...
 02542   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02543   484   NtContinue  (1244252, 0, ...
 02544   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02545   484   NtContinue  (1244252, 0, ...
 02546   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02547   484   NtContinue  (1244252, 0, ...
 02548   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02549   484   NtContinue  (1244252, 0, ...
 02550   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02551   484   NtContinue  (1244252, 0, ...
 02552   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02553   484   NtContinue  (1244252, 0, ...
 02554   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02555   484   NtContinue  (1244252, 0, ...
 02556   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02557   484   NtContinue  (1244252, 0, ...
 02558   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02559   484   NtContinue  (1244252, 0, ...
 02560   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02561   484   NtContinue  (1244252, 0, ...
 02562   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02563   484   NtContinue  (1244252, 0, ...
 02564   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02565   484   NtContinue  (1244252, 0, ...
 02566   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02567   484   NtContinue  (1244252, 0, ...
 02568   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02569   484   NtContinue  (1244252, 0, ...
 02570   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02571   484   NtContinue  (1244252, 0, ...
 02572   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02573   484   NtContinue  (1244252, 0, ...
 02574   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02575   484   NtContinue  (1244252, 0, ...
 02576   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02577   484   NtContinue  (1244252, 0, ...
 02578   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02579   484   NtContinue  (1244252, 0, ...
 02580   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02581   484   NtContinue  (1244252, 0, ...
 02582   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02583   484   NtContinue  (1244252, 0, ...
 02584   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02585   484   NtContinue  (1244252, 0, ...
 02586   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02587   484   NtContinue  (1244252, 0, ...
 02588   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02589   484   NtContinue  (1244252, 0, ...
 02590   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02591   484   NtContinue  (1244252, 0, ...
 02592   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02593   484   NtContinue  (1244252, 0, ...
 02594   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02595   484   NtContinue  (1244252, 0, ...
 02596   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02597   484   NtContinue  (1244252, 0, ...
 02598   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02599   484   NtContinue  (1244252, 0, ...
 02600   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02601   484   NtContinue  (1244252, 0, ...
 02602   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02603   484   NtContinue  (1244252, 0, ...
 02604   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02605   484   NtContinue  (1244252, 0, ...
 02606   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02607   484   NtContinue  (1244252, 0, ...
 02608   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02609   484   NtContinue  (1244252, 0, ...
 02610   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02611   484   NtContinue  (1244252, 0, ...
 02612   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02613   484   NtContinue  (1244252, 0, ...
 02614   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02615   484   NtContinue  (1244252, 0, ...
 02616   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02617   484   NtContinue  (1244252, 0, ...
 02618   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02619   484   NtContinue  (1244252, 0, ...
 02620   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02621   484   NtContinue  (1244252, 0, ...
 02622   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02623   484   NtContinue  (1244252, 0, ...
 02624   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02625   484   NtContinue  (1244252, 0, ...
 02626   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02627   484   NtContinue  (1244252, 0, ...
 02628   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02629   484   NtContinue  (1244252, 0, ...
 02630   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02631   484   NtContinue  (1244252, 0, ...
 02632   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02633   484   NtContinue  (1244252, 0, ...
 02634   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02635   484   NtContinue  (1244252, 0, ...
 02636   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02637   484   NtContinue  (1244252, 0, ...
 02638   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02639   484   NtContinue  (1244252, 0, ...
 02640   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02641   484   NtContinue  (1244252, 0, ...
 02642   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02643   484   NtContinue  (1244252, 0, ...
 02644   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02645   484   NtContinue  (1244252, 0, ...
 02646   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02647   484   NtContinue  (1244252, 0, ...
 02648   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02649   484   NtContinue  (1244252, 0, ...
 02650   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02651   484   NtContinue  (1244252, 0, ...
 02652   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02653   484   NtContinue  (1244252, 0, ...
 02654   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02655   484   NtContinue  (1244252, 0, ...
 02656   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02657   484   NtContinue  (1244252, 0, ...
 02658   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02659   484   NtContinue  (1244252, 0, ...
 02660   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02661   484   NtContinue  (1244252, 0, ...
 02662   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02663   484   NtContinue  (1244252, 0, ...
 02664   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02665   484   NtContinue  (1244252, 0, ...
 02666   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02667   484   NtContinue  (1244252, 0, ...
 02668   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02669   484   NtContinue  (1244252, 0, ...
 02670   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02671   484   NtContinue  (1244252, 0, ...
 02672   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02673   484   NtContinue  (1244252, 0, ...
 02674   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02675   484   NtContinue  (1244252, 0, ...
 02676   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02677   484   NtContinue  (1244252, 0, ...
 02678   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02679   484   NtContinue  (1244252, 0, ...
 02680   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02681   484   NtContinue  (1244252, 0, ...
 02682   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02683   484   NtContinue  (1244252, 0, ...
 02684   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02685   484   NtContinue  (1244252, 0, ...
 02686   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02687   484   NtContinue  (1244252, 0, ...
 02688   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02689   484   NtContinue  (1244252, 0, ...
 02690   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02691   484   NtContinue  (1244252, 0, ...
 02692   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02693   484   NtContinue  (1244252, 0, ...
 02694   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02695   484   NtContinue  (1244252, 0, ...
 02696   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02697   484   NtContinue  (1244252, 0, ...
 02698   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02699   484   NtContinue  (1244252, 0, ...
 02700   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02701   484   NtContinue  (1244252, 0, ...
 02702   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02703   484   NtContinue  (1244252, 0, ...
 02704   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02705   484   NtContinue  (1244252, 0, ...
 02706   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02707   484   NtContinue  (1244252, 0, ...
 02708   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02709   484   NtContinue  (1244252, 0, ...
 02710   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02711   484   NtContinue  (1244252, 0, ...
 02712   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02713   484   NtContinue  (1244252, 0, ...
 02714   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02715   484   NtContinue  (1244252, 0, ...
 02716   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02717   484   NtContinue  (1244252, 0, ...
 02718   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02719   484   NtContinue  (1244252, 0, ...
 02720   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02721   484   NtContinue  (1244252, 0, ...
 02722   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02723   484   NtContinue  (1244252, 0, ...
 02724   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02725   484   NtContinue  (1244252, 0, ...
 02726   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02727   484   NtContinue  (1244252, 0, ...
 02728   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02729   484   NtContinue  (1244252, 0, ...
 02730   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02731   484   NtContinue  (1244252, 0, ...
 02732   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02733   484   NtContinue  (1244252, 0, ...
 02734   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02735   484   NtContinue  (1244252, 0, ...
 02736   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02737   484   NtContinue  (1244252, 0, ...
 02738   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02739   484   NtContinue  (1244252, 0, ...
 02740   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02741   484   NtContinue  (1244252, 0, ...
 02742   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02743   484   NtContinue  (1244252, 0, ...
 02744   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02745   484   NtContinue  (1244252, 0, ...
 02746   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02747   484   NtContinue  (1244252, 0, ...
 02748   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02749   484   NtContinue  (1244252, 0, ...
 02750   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02751   484   NtContinue  (1244252, 0, ...
 02752   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02753   484   NtContinue  (1244252, 0, ...
 02754   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02755   484   NtContinue  (1244252, 0, ...
 02756   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02757   484   NtContinue  (1244252, 0, ...
 02758   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02759   484   NtContinue  (1244252, 0, ...
 02760   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02761   484   NtContinue  (1244252, 0, ...
 02762   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02763   484   NtContinue  (1244252, 0, ...
 02764   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02765   484   NtContinue  (1244252, 0, ...
 02766   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02767   484   NtContinue  (1244252, 0, ...
 02768   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02769   484   NtContinue  (1244252, 0, ...
 02770   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02771   484   NtContinue  (1244252, 0, ...
 02772   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02773   484   NtContinue  (1244252, 0, ...
 02774   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02775   484   NtContinue  (1244252, 0, ...
 02776   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02777   484   NtContinue  (1244252, 0, ...
 02778   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02779   484   NtContinue  (1244252, 0, ...
 02780   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02781   484   NtContinue  (1244252, 0, ...
 02782   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02783   484   NtContinue  (1244252, 0, ...
 02784   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02785   484   NtContinue  (1244252, 0, ...
 02786   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02787   484   NtContinue  (1244252, 0, ...
 02788   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02789   484   NtContinue  (1244252, 0, ...
 02790   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02791   484   NtContinue  (1244252, 0, ...
 02792   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02793   484   NtContinue  (1244252, 0, ...
 02794   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02795   484   NtContinue  (1244252, 0, ...
 02796   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02797   484   NtContinue  (1244252, 0, ...
 02798   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02799   484   NtContinue  (1244252, 0, ...
 02800   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02801   484   NtContinue  (1244252, 0, ...
 02802   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02803   484   NtContinue  (1244252, 0, ...
 02804   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02805   484   NtContinue  (1244252, 0, ...
 02806   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02807   484   NtContinue  (1244252, 0, ...
 02808   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02809   484   NtContinue  (1244252, 0, ...
 02810   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02811   484   NtContinue  (1244252, 0, ...
 02812   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02813   484   NtContinue  (1244252, 0, ...
 02814   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02815   484   NtContinue  (1244252, 0, ...
 02816   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02817   484   NtContinue  (1244252, 0, ...
 02818   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02819   484   NtContinue  (1244252, 0, ...
 02820   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02821   484   NtContinue  (1244252, 0, ...
 02822   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02823   484   NtContinue  (1244252, 0, ...
 02824   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02825   484   NtContinue  (1244252, 0, ...
 02826   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02827   484   NtContinue  (1244252, 0, ...
 02828   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02829   484   NtContinue  (1244252, 0, ...
 02830   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02831   484   NtContinue  (1244252, 0, ...
 02832   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02833   484   NtContinue  (1244252, 0, ...
 02834   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02835   484   NtContinue  (1244252, 0, ...
 02836   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02837   484   NtContinue  (1244252, 0, ...
 02838   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02839   484   NtContinue  (1244252, 0, ...
 02840   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02841   484   NtContinue  (1244252, 0, ...
 02842   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02843   484   NtContinue  (1244252, 0, ...
 02844   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02845   484   NtContinue  (1244252, 0, ...
 02846   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02847   484   NtContinue  (1244252, 0, ...
 02848   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02849   484   NtContinue  (1244252, 0, ...
 02850   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02851   484   NtContinue  (1244252, 0, ...
 02852   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02853   484   NtContinue  (1244252, 0, ...
 02854   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02855   484   NtContinue  (1244252, 0, ...
 02856   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02857   484   NtContinue  (1244252, 0, ...
 02858   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02859   484   NtContinue  (1244252, 0, ...
 02860   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02861   484   NtContinue  (1244252, 0, ...
 02862   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02863   484   NtContinue  (1244252, 0, ...
 02864   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02865   484   NtContinue  (1244252, 0, ...
 02866   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02867   484   NtContinue  (1244252, 0, ...
 02868   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02869   484   NtContinue  (1244252, 0, ...
 02870   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02871   484   NtContinue  (1244252, 0, ...
 02872   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02873   484   NtContinue  (1244252, 0, ...
 02874   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02875   484   NtContinue  (1244252, 0, ...
 02876   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02877   484   NtContinue  (1244252, 0, ...
 02878   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02879   484   NtContinue  (1244252, 0, ...
 02880   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02881   484   NtContinue  (1244252, 0, ...
 02882   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02883   484   NtContinue  (1244252, 0, ...
 02884   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02885   484   NtContinue  (1244252, 0, ...
 02886   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02887   484   NtContinue  (1244252, 0, ...
 02888   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02889   484   NtContinue  (1244252, 0, ...
 02890   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02891   484   NtContinue  (1244252, 0, ...
 02892   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02893   484   NtContinue  (1244252, 0, ...
 02894   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02895   484   NtContinue  (1244252, 0, ...
 02896   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02897   484   NtContinue  (1244252, 0, ...
 02898   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02899   484   NtContinue  (1244252, 0, ...
 02900   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02901   484   NtContinue  (1244252, 0, ...
 02902   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02903   484   NtContinue  (1244252, 0, ...
 02904   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02905   484   NtContinue  (1244252, 0, ...
 02906   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02907   484   NtContinue  (1244252, 0, ...
 02908   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02909   484   NtContinue  (1244252, 0, ...
 02910   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02911   484   NtContinue  (1244252, 0, ...
 02912   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02913   484   NtContinue  (1244252, 0, ...
 02914   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02915   484   NtContinue  (1244252, 0, ...
 02916   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02917   484   NtContinue  (1244252, 0, ...
 02918   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02919   484   NtContinue  (1244252, 0, ...
 02920   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02921   484   NtContinue  (1244252, 0, ...
 02922   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02923   484   NtContinue  (1244252, 0, ...
 02924   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02925   484   NtContinue  (1244252, 0, ...
 02926   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02927   484   NtContinue  (1244252, 0, ...
 02928   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02929   484   NtContinue  (1244252, 0, ...
 02930   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02931   484   NtContinue  (1244252, 0, ...
 02932   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02933   484   NtContinue  (1244252, 0, ...
 02934   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02935   484   NtContinue  (1244252, 0, ...
 02936   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02937   484   NtContinue  (1244252, 0, ...
 02938   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02939   484   NtContinue  (1244252, 0, ...
 02940   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02941   484   NtContinue  (1244252, 0, ...
 02942   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02943   484   NtContinue  (1244252, 0, ...
 02944   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02945   484   NtContinue  (1244252, 0, ...
 02946   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02947   484   NtContinue  (1244252, 0, ...
 02948   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02949   484   NtContinue  (1244252, 0, ...
 02950   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02951   484   NtContinue  (1244252, 0, ...
 02952   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02953   484   NtContinue  (1244252, 0, ...
 02954   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02955   484   NtContinue  (1244252, 0, ...
 02956   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02957   484   NtContinue  (1244252, 0, ...
 02958   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02959   484   NtContinue  (1244252, 0, ...
 02960   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02961   484   NtContinue  (1244252, 0, ...
 02962   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02963   484   NtContinue  (1244252, 0, ...
 02964   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02965   484   NtContinue  (1244252, 0, ...
 02966   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02967   484   NtContinue  (1244252, 0, ...
 02968   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02969   484   NtContinue  (1244252, 0, ...
 02970   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02971   484   NtContinue  (1244252, 0, ...
 02972   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02973   484   NtContinue  (1244252, 0, ...
 02974   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02975   484   NtContinue  (1244252, 0, ...
 02976   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02977   484   NtContinue  (1244252, 0, ...
 02978   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02979   484   NtContinue  (1244252, 0, ...
 02980   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02981   484   NtContinue  (1244252, 0, ...
 02982   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02983   484   NtContinue  (1244252, 0, ...
 02984   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02985   484   NtContinue  (1244252, 0, ...
 02986   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02987   484   NtContinue  (1244252, 0, ...
 02988   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02989   484   NtContinue  (1244252, 0, ...
 02990   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02991   484   NtContinue  (1244252, 0, ...
 02992   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02993   484   NtContinue  (1244252, 0, ...
 02994   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02995   484   NtContinue  (1244252, 0, ...
 02996   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02997   484   NtContinue  (1244252, 0, ...
 02998   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 02999   484   NtContinue  (1244252, 0, ...
 03000   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03001   484   NtContinue  (1244252, 0, ...
 03002   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03003   484   NtContinue  (1244252, 0, ...
 03004   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03005   484   NtContinue  (1244252, 0, ...
 03006   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03007   484   NtContinue  (1244252, 0, ...
 03008   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03009   484   NtContinue  (1244252, 0, ...
 03010   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03011   484   NtContinue  (1244252, 0, ...
 03012   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03013   484   NtContinue  (1244252, 0, ...
 03014   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03015   484   NtContinue  (1244252, 0, ...
 03016   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03017   484   NtContinue  (1244252, 0, ...
 03018   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03019   484   NtContinue  (1244252, 0, ...
 03020   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03021   484   NtContinue  (1244252, 0, ...
 03022   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03023   484   NtContinue  (1244252, 0, ...
 03024   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03025   484   NtContinue  (1244252, 0, ...
 03026   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03027   484   NtContinue  (1244252, 0, ...
 03028   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03029   484   NtContinue  (1244252, 0, ...
 03030   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03031   484   NtContinue  (1244252, 0, ...
 03032   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03033   484   NtContinue  (1244252, 0, ...
 03034   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03035   484   NtContinue  (1244252, 0, ...
 03036   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03037   484   NtContinue  (1244252, 0, ...
 03038   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03039   484   NtContinue  (1244252, 0, ...
 03040   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03041   484   NtContinue  (1244252, 0, ...
 03042   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03043   484   NtContinue  (1244252, 0, ...
 03044   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03045   484   NtContinue  (1244252, 0, ...
 03046   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03047   484   NtContinue  (1244252, 0, ...
 03048   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03049   484   NtContinue  (1244252, 0, ...
 03050   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03051   484   NtContinue  (1244252, 0, ...
 03052   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03053   484   NtContinue  (1244252, 0, ...
 03054   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03055   484   NtContinue  (1244252, 0, ...
 03056   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03057   484   NtContinue  (1244252, 0, ...
 03058   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03059   484   NtContinue  (1244252, 0, ...
 03060   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03061   484   NtContinue  (1244252, 0, ...
 03062   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03063   484   NtContinue  (1244252, 0, ...
 03064   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03065   484   NtContinue  (1244252, 0, ...
 03066   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03067   484   NtContinue  (1244252, 0, ...
 03068   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03069   484   NtContinue  (1244252, 0, ...
 03070   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03071   484   NtContinue  (1244252, 0, ...
 03072   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03073   484   NtContinue  (1244252, 0, ...
 03074   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03075   484   NtContinue  (1244252, 0, ...
 03076   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03077   484   NtContinue  (1244252, 0, ...
 03078   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03079   484   NtContinue  (1244252, 0, ...
 03080   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03081   484   NtContinue  (1244252, 0, ...
 03082   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03083   484   NtContinue  (1244252, 0, ...
 03084   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03085   484   NtContinue  (1244252, 0, ...
 03086   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03087   484   NtContinue  (1244252, 0, ...
 03088   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03089   484   NtContinue  (1244252, 0, ...
 03090   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03091   484   NtContinue  (1244252, 0, ...
 03092   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03093   484   NtContinue  (1244252, 0, ...
 03094   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03095   484   NtContinue  (1244252, 0, ...
 03096   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03097   484   NtContinue  (1244252, 0, ...
 03098   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03099   484   NtContinue  (1244252, 0, ...
 03100   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03101   484   NtContinue  (1244252, 0, ...
 03102   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03103   484   NtContinue  (1244252, 0, ...
 03104   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03105   484   NtContinue  (1244252, 0, ...
 03106   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03107   484   NtContinue  (1244252, 0, ...
 03108   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03109   484   NtContinue  (1244252, 0, ...
 03110   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03111   484   NtContinue  (1244252, 0, ...
 03112   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03113   484   NtContinue  (1244252, 0, ...
 03114   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03115   484   NtContinue  (1244252, 0, ...
 03116   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03117   484   NtContinue  (1244252, 0, ...
 03118   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03119   484   NtContinue  (1244252, 0, ...
 03120   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03121   484   NtContinue  (1244252, 0, ...
 03122   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03123   484   NtContinue  (1244252, 0, ...
 03124   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03125   484   NtContinue  (1244252, 0, ...
 03126   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03127   484   NtContinue  (1244252, 0, ...
 03128   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03129   484   NtContinue  (1244252, 0, ...
 03130   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03131   484   NtContinue  (1244252, 0, ...
 03132   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03133   484   NtContinue  (1244252, 0, ...
 03134   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03135   484   NtContinue  (1244252, 0, ...
 03136   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03137   484   NtContinue  (1244252, 0, ...
 03138   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03139   484   NtContinue  (1244252, 0, ...
 03140   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03141   484   NtContinue  (1244252, 0, ...
 03142   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03143   484   NtContinue  (1244252, 0, ...
 03144   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03145   484   NtContinue  (1244252, 0, ...
 03146   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03147   484   NtContinue  (1244252, 0, ...
 03148   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03149   484   NtContinue  (1244252, 0, ...
 03150   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03151   484   NtContinue  (1244252, 0, ...
 03152   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03153   484   NtContinue  (1244252, 0, ...
 03154   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03155   484   NtContinue  (1244252, 0, ...
 03156   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03157   484   NtContinue  (1244252, 0, ...
 03158   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03159   484   NtContinue  (1244252, 0, ...
 03160   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03161   484   NtContinue  (1244252, 0, ...
 03162   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03163   484   NtContinue  (1244252, 0, ...
 03164   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03165   484   NtContinue  (1244252, 0, ...
 03166   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03167   484   NtContinue  (1244252, 0, ...
 03168   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03169   484   NtContinue  (1244252, 0, ...
 03170   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03171   484   NtContinue  (1244252, 0, ...
 03172   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03173   484   NtContinue  (1244252, 0, ...
 03174   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03175   484   NtContinue  (1244252, 0, ...
 03176   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03177   484   NtContinue  (1244252, 0, ...
 03178   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03179   484   NtContinue  (1244252, 0, ...
 03180   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03181   484   NtContinue  (1244252, 0, ...
 03182   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03183   484   NtContinue  (1244252, 0, ...
 03184   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03185   484   NtContinue  (1244252, 0, ...
 03186   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03187   484   NtContinue  (1244252, 0, ...
 03188   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03189   484   NtContinue  (1244252, 0, ...
 03190   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03191   484   NtContinue  (1244252, 0, ...
 03192   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03193   484   NtContinue  (1244252, 0, ...
 03194   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03195   484   NtContinue  (1244252, 0, ...
 03196   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03197   484   NtContinue  (1244252, 0, ...
 03198   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03199   484   NtContinue  (1244252, 0, ...
 03200   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03201   484   NtContinue  (1244252, 0, ...
 03202   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03203   484   NtContinue  (1244252, 0, ...
 03204   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03205   484   NtContinue  (1244252, 0, ...
 03206   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03207   484   NtContinue  (1244252, 0, ...
 03208   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03209   484   NtContinue  (1244252, 0, ...
 03210   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03211   484   NtContinue  (1244252, 0, ...
 03212   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03213   484   NtContinue  (1244252, 0, ...
 03214   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03215   484   NtContinue  (1244252, 0, ...
 03216   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03217   484   NtContinue  (1244252, 0, ...
 03218   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03219   484   NtContinue  (1244252, 0, ...
 03220   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03221   484   NtContinue  (1244252, 0, ...
 03222   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03223   484   NtContinue  (1244252, 0, ...
 03224   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03225   484   NtContinue  (1244252, 0, ...
 03226   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03227   484   NtContinue  (1244252, 0, ...
 03228   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03229   484   NtContinue  (1244252, 0, ...
 03230   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03231   484   NtContinue  (1244252, 0, ...
 03232   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03233   484   NtContinue  (1244252, 0, ...
 03234   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03235   484   NtContinue  (1244252, 0, ...
 03236   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03237   484   NtContinue  (1244252, 0, ...
 03238   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03239   484   NtContinue  (1244252, 0, ...
 03240   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03241   484   NtContinue  (1244252, 0, ...
 03242   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03243   484   NtContinue  (1244252, 0, ...
 03244   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03245   484   NtContinue  (1244252, 0, ...
 03246   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03247   484   NtContinue  (1244252, 0, ...
 03248   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03249   484   NtContinue  (1244252, 0, ...
 03250   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03251   484   NtContinue  (1244252, 0, ...
 03252   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03253   484   NtContinue  (1244252, 0, ...
 03254   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03255   484   NtContinue  (1244252, 0, ...
 03256   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03257   484   NtContinue  (1244252, 0, ...
 03258   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03259   484   NtContinue  (1244252, 0, ...
 03260   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03261   484   NtContinue  (1244252, 0, ...
 03262   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03263   484   NtContinue  (1244252, 0, ...
 03264   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03265   484   NtContinue  (1244252, 0, ...
 03266   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03267   484   NtContinue  (1244252, 0, ...
 03268   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03269   484   NtContinue  (1244252, 0, ...
 03270   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03271   484   NtContinue  (1244252, 0, ...
 03272   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03273   484   NtContinue  (1244252, 0, ...
 03274   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03275   484   NtContinue  (1244252, 0, ...
 03276   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03277   484   NtContinue  (1244252, 0, ...
 03278   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03279   484   NtContinue  (1244252, 0, ...
 03280   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03281   484   NtContinue  (1244252, 0, ...
 03282   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03283   484   NtContinue  (1244252, 0, ...
 03284   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03285   484   NtContinue  (1244252, 0, ...
 03286   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03287   484   NtContinue  (1244252, 0, ...
 03288   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03289   484   NtContinue  (1244252, 0, ...
 03290   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03291   484   NtContinue  (1244252, 0, ...
 03292   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03293   484   NtContinue  (1244252, 0, ...
 03294   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03295   484   NtContinue  (1244252, 0, ...
 03296   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03297   484   NtContinue  (1244252, 0, ...
 03298   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03299   484   NtContinue  (1244252, 0, ...
 03300   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03301   484   NtContinue  (1244252, 0, ...
 03302   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03303   484   NtContinue  (1244252, 0, ...
 03304   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03305   484   NtContinue  (1244252, 0, ...
 03306   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03307   484   NtContinue  (1244252, 0, ...
 03308   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03309   484   NtContinue  (1244252, 0, ...
 03310   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03311   484   NtContinue  (1244252, 0, ...
 03312   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03313   484   NtContinue  (1244252, 0, ...
 03314   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03315   484   NtContinue  (1244252, 0, ...
 03316   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03317   484   NtContinue  (1244252, 0, ...
 03318   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03319   484   NtContinue  (1244252, 0, ...
 03320   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03321   484   NtContinue  (1244252, 0, ...
 03322   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03323   484   NtContinue  (1244252, 0, ...
 03324   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03325   484   NtContinue  (1244252, 0, ...
 03326   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03327   484   NtContinue  (1244252, 0, ...
 03328   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03329   484   NtContinue  (1244252, 0, ...
 03330   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03331   484   NtContinue  (1244252, 0, ...
 03332   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03333   484   NtContinue  (1244252, 0, ...
 03334   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03335   484   NtContinue  (1244252, 0, ...
 03336   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03337   484   NtContinue  (1244252, 0, ...
 03338   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03339   484   NtContinue  (1244252, 0, ...
 03340   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03341   484   NtContinue  (1244252, 0, ...
 03342   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03343   484   NtContinue  (1244252, 0, ...
 03344   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03345   484   NtContinue  (1244252, 0, ...
 03346   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03347   484   NtContinue  (1244252, 0, ...
 03348   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03349   484   NtContinue  (1244252, 0, ...
 03350   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03351   484   NtContinue  (1244252, 0, ...
 03352   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03353   484   NtContinue  (1244252, 0, ...
 03354   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03355   484   NtContinue  (1244252, 0, ...
 03356   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03357   484   NtContinue  (1244252, 0, ...
 03358   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03359   484   NtContinue  (1244252, 0, ...
 03360   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03361   484   NtContinue  (1244252, 0, ...
 03362   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03363   484   NtContinue  (1244252, 0, ...
 03364   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03365   484   NtContinue  (1244252, 0, ...
 03366   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03367   484   NtContinue  (1244252, 0, ...
 03368   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03369   484   NtContinue  (1244252, 0, ...
 03370   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03371   484   NtContinue  (1244252, 0, ...
 03372   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03373   484   NtContinue  (1244252, 0, ...
 03374   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03375   484   NtContinue  (1244252, 0, ...
 03376   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03377   484   NtContinue  (1244252, 0, ...
 03378   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03379   484   NtContinue  (1244252, 0, ...
 03380   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03381   484   NtContinue  (1244252, 0, ...
 03382   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03383   484   NtContinue  (1244252, 0, ...
 03384   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03385   484   NtContinue  (1244252, 0, ...
 03386   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03387   484   NtContinue  (1244252, 0, ...
 03388   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03389   484   NtContinue  (1244252, 0, ...
 03390   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03391   484   NtContinue  (1244252, 0, ...
 03392   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03393   484   NtContinue  (1244252, 0, ...
 03394   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03395   484   NtContinue  (1244252, 0, ...
 03396   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03397   484   NtContinue  (1244252, 0, ...
 03398   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03399   484   NtContinue  (1244252, 0, ...
 03400   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03401   484   NtContinue  (1244252, 0, ...
 03402   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03403   484   NtContinue  (1244252, 0, ...
 03404   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03405   484   NtContinue  (1244252, 0, ...
 03406   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03407   484   NtContinue  (1244252, 0, ...
 03408   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03409   484   NtContinue  (1244252, 0, ...
 03410   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03411   484   NtContinue  (1244252, 0, ...
 03412   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03413   484   NtContinue  (1244252, 0, ...
 03414   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03415   484   NtContinue  (1244252, 0, ...
 03416   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03417   484   NtContinue  (1244252, 0, ...
 03418   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03419   484   NtContinue  (1244252, 0, ...
 03420   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03421   484   NtContinue  (1244252, 0, ...
 03422   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03423   484   NtContinue  (1244252, 0, ...
 03424   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03425   484   NtContinue  (1244252, 0, ...
 03426   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03427   484   NtContinue  (1244252, 0, ...
 03428   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03429   484   NtContinue  (1244252, 0, ...
 03430   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03431   484   NtContinue  (1244252, 0, ...
 03432   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03433   484   NtContinue  (1244252, 0, ...
 03434   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03435   484   NtContinue  (1244252, 0, ...
 03436   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03437   484   NtContinue  (1244252, 0, ...
 03438   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03439   484   NtContinue  (1244252, 0, ...
 03440   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03441   484   NtContinue  (1244252, 0, ...
 03442   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03443   484   NtContinue  (1244252, 0, ...
 03444   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03445   484   NtContinue  (1244252, 0, ...
 03446   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03447   484   NtContinue  (1244252, 0, ...
 03448   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03449   484   NtContinue  (1244252, 0, ...
 03450   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03451   484   NtContinue  (1244252, 0, ...
 03452   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03453   484   NtContinue  (1244252, 0, ...
 03454   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03455   484   NtContinue  (1244252, 0, ...
 03456   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03457   484   NtContinue  (1244252, 0, ...
 03458   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03459   484   NtContinue  (1244252, 0, ...
 03460   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03461   484   NtContinue  (1244252, 0, ...
 03462   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03463   484   NtContinue  (1244252, 0, ...
 03464   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03465   484   NtContinue  (1244252, 0, ...
 03466   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03467   484   NtContinue  (1244252, 0, ...
 03468   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03469   484   NtContinue  (1244252, 0, ...
 03470   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03471   484   NtContinue  (1244252, 0, ...
 03472   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03473   484   NtContinue  (1244252, 0, ...
 03474   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03475   484   NtContinue  (1244252, 0, ...
 03476   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03477   484   NtContinue  (1244252, 0, ...
 03478   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03479   484   NtContinue  (1244252, 0, ...
 03480   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03481   484   NtContinue  (1244252, 0, ...
 03482   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03483   484   NtContinue  (1244252, 0, ...
 03484   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03485   484   NtContinue  (1244252, 0, ...
 03486   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03487   484   NtContinue  (1244252, 0, ...
 03488   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03489   484   NtContinue  (1244252, 0, ...
 03490   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03491   484   NtContinue  (1244252, 0, ...
 03492   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03493   484   NtContinue  (1244252, 0, ...
 03494   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03495   484   NtContinue  (1244252, 0, ...
 03496   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03497   484   NtContinue  (1244252, 0, ...
 03498   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03499   484   NtContinue  (1244252, 0, ...
 03500   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03501   484   NtContinue  (1244252, 0, ...
 03502   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03503   484   NtContinue  (1244252, 0, ...
 03504   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03505   484   NtContinue  (1244252, 0, ...
 03506   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03507   484   NtContinue  (1244252, 0, ...
 03508   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03509   484   NtContinue  (1244252, 0, ...
 03510   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03511   484   NtContinue  (1244252, 0, ...
 03512   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03513   484   NtContinue  (1244252, 0, ...
 03514   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03515   484   NtContinue  (1244252, 0, ...
 03516   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03517   484   NtContinue  (1244252, 0, ...
 03518   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03519   484   NtContinue  (1244252, 0, ...
 03520   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03521   484   NtContinue  (1244252, 0, ...
 03522   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03523   484   NtContinue  (1244252, 0, ...
 03524   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03525   484   NtContinue  (1244252, 0, ...
 03526   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03527   484   NtContinue  (1244252, 0, ...
 03528   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03529   484   NtContinue  (1244252, 0, ...
 03530   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03531   484   NtContinue  (1244252, 0, ...
 03532   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03533   484   NtContinue  (1244252, 0, ...
 03534   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03535   484   NtContinue  (1244252, 0, ...
 03536   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03537   484   NtContinue  (1244252, 0, ...
 03538   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03539   484   NtContinue  (1244252, 0, ...
 03540   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03541   484   NtContinue  (1244252, 0, ...
 03542   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03543   484   NtContinue  (1244252, 0, ...
 03544   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03545   484   NtContinue  (1244252, 0, ...
 03546   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03547   484   NtContinue  (1244252, 0, ...
 03548   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03549   484   NtContinue  (1244252, 0, ...
 03550   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03551   484   NtContinue  (1244252, 0, ...
 03552   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03553   484   NtContinue  (1244252, 0, ...
 03554   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03555   484   NtContinue  (1244252, 0, ...
 03556   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03557   484   NtContinue  (1244252, 0, ...
 03558   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03559   484   NtContinue  (1244252, 0, ...
 03560   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03561   484   NtContinue  (1244252, 0, ...
 03562   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03563   484   NtContinue  (1244252, 0, ...
 03564   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03565   484   NtContinue  (1244252, 0, ...
 03566   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03567   484   NtContinue  (1244252, 0, ...
 03568   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03569   484   NtContinue  (1244252, 0, ...
 03570   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03571   484   NtContinue  (1244252, 0, ...
 03572   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03573   484   NtContinue  (1244252, 0, ...
 03574   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03575   484   NtContinue  (1244252, 0, ...
 03576   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03577   484   NtContinue  (1244252, 0, ...
 03578   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03579   484   NtContinue  (1244252, 0, ...
 03580   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03581   484   NtContinue  (1244252, 0, ...
 03582   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03583   484   NtContinue  (1244252, 0, ...
 03584   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03585   484   NtContinue  (1244252, 0, ...
 03586   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03587   484   NtContinue  (1244252, 0, ...
 03588   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03589   484   NtContinue  (1244252, 0, ...
 03590   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03591   484   NtContinue  (1244252, 0, ...
 03592   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03593   484   NtContinue  (1244252, 0, ...
 03594   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03595   484   NtContinue  (1244252, 0, ...
 03596   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03597   484   NtContinue  (1244252, 0, ...
 03598   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03599   484   NtContinue  (1244252, 0, ...
 03600   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03601   484   NtContinue  (1244252, 0, ...
 03602   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03603   484   NtContinue  (1244252, 0, ...
 03604   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03605   484   NtContinue  (1244252, 0, ...
 03606   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03607   484   NtContinue  (1244252, 0, ...
 03608   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03609   484   NtContinue  (1244252, 0, ...
 03610   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03611   484   NtContinue  (1244252, 0, ...
 03612   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03613   484   NtContinue  (1244252, 0, ...
 03614   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03615   484   NtContinue  (1244252, 0, ...
 03616   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03617   484   NtContinue  (1244252, 0, ...
 03618   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03619   484   NtContinue  (1244252, 0, ...
 03620   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03621   484   NtContinue  (1244252, 0, ...
 03622   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03623   484   NtContinue  (1244252, 0, ...
 03624   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03625   484   NtContinue  (1244252, 0, ...
 03626   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03627   484   NtContinue  (1244252, 0, ...
 03628   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03629   484   NtContinue  (1244252, 0, ...
 03630   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03631   484   NtContinue  (1244252, 0, ...
 03632   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03633   484   NtContinue  (1244252, 0, ...
 03634   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03635   484   NtContinue  (1244252, 0, ...
 03636   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03637   484   NtContinue  (1244252, 0, ...
 03638   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03639   484   NtContinue  (1244252, 0, ...
 03640   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03641   484   NtContinue  (1244252, 0, ...
 03642   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03643   484   NtContinue  (1244252, 0, ...
 03644   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03645   484   NtContinue  (1244252, 0, ...
 03646   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03647   484   NtContinue  (1244252, 0, ...
 03648   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03649   484   NtContinue  (1244252, 0, ...
 03650   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03651   484   NtContinue  (1244252, 0, ...
 03652   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03653   484   NtContinue  (1244252, 0, ...
 03654   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03655   484   NtContinue  (1244252, 0, ...
 03656   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03657   484   NtContinue  (1244252, 0, ...
 03658   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03659   484   NtContinue  (1244252, 0, ...
 03660   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03661   484   NtContinue  (1244252, 0, ...
 03662   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03663   484   NtContinue  (1244252, 0, ...
 03664   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03665   484   NtContinue  (1244252, 0, ...
 03666   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03667   484   NtContinue  (1244252, 0, ...
 03668   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03669   484   NtContinue  (1244252, 0, ...
 03670   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03671   484   NtContinue  (1244252, 0, ...
 03672   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03673   484   NtContinue  (1244252, 0, ...
 03674   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03675   484   NtContinue  (1244252, 0, ...
 03676   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03677   484   NtContinue  (1244252, 0, ...
 03678   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03679   484   NtContinue  (1244252, 0, ...
 03680   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03681   484   NtContinue  (1244252, 0, ...
 03682   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03683   484   NtContinue  (1244252, 0, ...
 03684   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03685   484   NtContinue  (1244252, 0, ...
 03686   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03687   484   NtContinue  (1244252, 0, ...
 03688   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03689   484   NtContinue  (1244252, 0, ...
 03690   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03691   484   NtContinue  (1244252, 0, ...
 03692   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03693   484   NtContinue  (1244252, 0, ...
 03694   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03695   484   NtContinue  (1244252, 0, ...
 03696   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03697   484   NtContinue  (1244252, 0, ...
 03698   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03699   484   NtContinue  (1244252, 0, ...
 03700   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03701   484   NtContinue  (1244252, 0, ...
 03702   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03703   484   NtContinue  (1244252, 0, ...
 03704   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03705   484   NtContinue  (1244252, 0, ...
 03706   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03707   484   NtContinue  (1244252, 0, ...
 03708   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03709   484   NtContinue  (1244252, 0, ...
 03710   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03711   484   NtContinue  (1244252, 0, ...
 03712   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03713   484   NtContinue  (1244252, 0, ...
 03714   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03715   484   NtContinue  (1244252, 0, ...
 03716   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03717   484   NtContinue  (1244252, 0, ...
 03718   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03719   484   NtContinue  (1244252, 0, ...
 03720   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03721   484   NtContinue  (1244252, 0, ...
 03722   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03723   484   NtContinue  (1244252, 0, ...
 03724   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03725   484   NtContinue  (1244252, 0, ...
 03726   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03727   484   NtContinue  (1244252, 0, ...
 03728   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03729   484   NtContinue  (1244252, 0, ...
 03730   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03731   484   NtContinue  (1244252, 0, ...
 03732   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03733   484   NtContinue  (1244252, 0, ...
 03734   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03735   484   NtContinue  (1244252, 0, ...
 03736   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03737   484   NtContinue  (1244252, 0, ...
 03738   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03739   484   NtContinue  (1244252, 0, ...
 03740   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03741   484   NtContinue  (1244252, 0, ...
 03742   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03743   484   NtContinue  (1244252, 0, ...
 03744   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03745   484   NtContinue  (1244252, 0, ...
 03746   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03747   484   NtContinue  (1244252, 0, ...
 03748   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03749   484   NtContinue  (1244252, 0, ...
 03750   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03751   484   NtContinue  (1244252, 0, ...
 03752   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03753   484   NtContinue  (1244252, 0, ...
 03754   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03755   484   NtContinue  (1244252, 0, ...
 03756   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03757   484   NtContinue  (1244252, 0, ...
 03758   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03759   484   NtContinue  (1244252, 0, ...
 03760   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03761   484   NtContinue  (1244252, 0, ...
 03762   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03763   484   NtContinue  (1244252, 0, ...
 03764   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03765   484   NtContinue  (1244252, 0, ...
 03766   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03767   484   NtContinue  (1244252, 0, ...
 03768   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03769   484   NtContinue  (1244252, 0, ...
 03770   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03771   484   NtContinue  (1244252, 0, ...
 03772   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03773   484   NtContinue  (1244252, 0, ...
 03774   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03775   484   NtContinue  (1244252, 0, ...
 03776   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03777   484   NtContinue  (1244252, 0, ...
 03778   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03779   484   NtContinue  (1244252, 0, ...
 03780   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03781   484   NtContinue  (1244252, 0, ...
 03782   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03783   484   NtContinue  (1244252, 0, ...
 03784   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03785   484   NtContinue  (1244252, 0, ...
 03786   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03787   484   NtContinue  (1244252, 0, ...
 03788   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03789   484   NtContinue  (1244252, 0, ...
 03790   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03791   484   NtContinue  (1244252, 0, ...
 03792   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03793   484   NtContinue  (1244252, 0, ...
 03794   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03795   484   NtContinue  (1244252, 0, ...
 03796   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03797   484   NtContinue  (1244252, 0, ...
 03798   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03799   484   NtContinue  (1244252, 0, ...
 03800   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03801   484   NtContinue  (1244252, 0, ...
 03802   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03803   484   NtContinue  (1244252, 0, ...
 03804   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03805   484   NtContinue  (1244252, 0, ...
 03806   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03807   484   NtContinue  (1244252, 0, ...
 03808   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03809   484   NtContinue  (1244252, 0, ...
 03810   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03811   484   NtContinue  (1244252, 0, ...
 03812   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03813   484   NtContinue  (1244252, 0, ...
 03814   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03815   484   NtContinue  (1244252, 0, ...
 03816   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03817   484   NtContinue  (1244252, 0, ...
 03818   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03819   484   NtContinue  (1244252, 0, ...
 03820   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03821   484   NtContinue  (1244252, 0, ...
 03822   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03823   484   NtContinue  (1244252, 0, ...
 03824   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03825   484   NtContinue  (1244252, 0, ...
 03826   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03827   484   NtContinue  (1244252, 0, ...
 03828   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03829   484   NtContinue  (1244252, 0, ...
 03830   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03831   484   NtContinue  (1244252, 0, ...
 03832   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03833   484   NtContinue  (1244252, 0, ...
 03834   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03835   484   NtContinue  (1244252, 0, ...
 03836   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03837   484   NtContinue  (1244252, 0, ...
 03838   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03839   484   NtContinue  (1244252, 0, ...
 03840   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03841   484   NtContinue  (1244252, 0, ...
 03842   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03843   484   NtContinue  (1244252, 0, ...
 03844   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03845   484   NtContinue  (1244252, 0, ...
 03846   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03847   484   NtContinue  (1244252, 0, ...
 03848   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03849   484   NtContinue  (1244252, 0, ...
 03850   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03851   484   NtContinue  (1244252, 0, ...
 03852   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03853   484   NtContinue  (1244252, 0, ...
 03854   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03855   484   NtContinue  (1244252, 0, ...
 03856   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03857   484   NtContinue  (1244252, 0, ...
 03858   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03859   484   NtContinue  (1244252, 0, ...
 03860   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03861   484   NtContinue  (1244252, 0, ...
 03862   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03863   484   NtContinue  (1244252, 0, ...
 03864   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03865   484   NtContinue  (1244252, 0, ...
 03866   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03867   484   NtContinue  (1244252, 0, ...
 03868   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03869   484   NtContinue  (1244252, 0, ...
 03870   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03871   484   NtContinue  (1244252, 0, ...
 03872   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03873   484   NtContinue  (1244252, 0, ...
 03874   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03875   484   NtContinue  (1244252, 0, ...
 03876   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03877   484   NtContinue  (1244252, 0, ...
 03878   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03879   484   NtContinue  (1244252, 0, ...
 03880   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03881   484   NtContinue  (1244252, 0, ...
 03882   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03883   484   NtContinue  (1244252, 0, ...
 03884   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03885   484   NtContinue  (1244252, 0, ...
 03886   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03887   484   NtContinue  (1244252, 0, ...
 03888   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03889   484   NtContinue  (1244252, 0, ...
 03890   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03891   484   NtContinue  (1244252, 0, ...
 03892   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03893   484   NtContinue  (1244252, 0, ...
 03894   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03895   484   NtContinue  (1244252, 0, ...
 03896   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03897   484   NtContinue  (1244252, 0, ...
 03898   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03899   484   NtContinue  (1244252, 0, ...
 03900   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03901   484   NtContinue  (1244252, 0, ...
 03902   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03903   484   NtContinue  (1244252, 0, ...
 03904   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03905   484   NtContinue  (1244252, 0, ...
 03906   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03907   484   NtContinue  (1244252, 0, ...
 03908   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03909   484   NtContinue  (1244252, 0, ...
 03910   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03911   484   NtContinue  (1244252, 0, ...
 03912   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03913   484   NtContinue  (1244252, 0, ...
 03914   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03915   484   NtContinue  (1244252, 0, ...
 03916   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03917   484   NtContinue  (1244252, 0, ...
 03918   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03919   484   NtContinue  (1244252, 0, ...
 03920   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03921   484   NtContinue  (1244252, 0, ...
 03922   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03923   484   NtContinue  (1244252, 0, ...
 03924   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03925   484   NtContinue  (1244252, 0, ...
 03926   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03927   484   NtContinue  (1244252, 0, ...
 03928   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03929   484   NtContinue  (1244252, 0, ...
 03930   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03931   484   NtContinue  (1244252, 0, ...
 03932   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03933   484   NtContinue  (1244252, 0, ...
 03934   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03935   484   NtContinue  (1244252, 0, ...
 03936   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03937   484   NtContinue  (1244252, 0, ...
 03938   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03939   484   NtContinue  (1244252, 0, ...
 03940   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03941   484   NtContinue  (1244252, 0, ...
 03942   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03943   484   NtContinue  (1244252, 0, ...
 03944   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03945   484   NtContinue  (1244252, 0, ...
 03946   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03947   484   NtContinue  (1244252, 0, ...
 03948   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03949   484   NtContinue  (1244252, 0, ...
 03950   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03951   484   NtContinue  (1244252, 0, ...
 03952   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03953   484   NtContinue  (1244252, 0, ...
 03954   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03955   484   NtContinue  (1244252, 0, ...
 03956   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03957   484   NtContinue  (1244252, 0, ...
 03958   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03959   484   NtContinue  (1244252, 0, ...
 03960   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03961   484   NtContinue  (1244252, 0, ...
 03962   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03963   484   NtContinue  (1244252, 0, ...
 03964   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03965   484   NtContinue  (1244252, 0, ...
 03966   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03967   484   NtContinue  (1244252, 0, ...
 03968   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03969   484   NtContinue  (1244252, 0, ...
 03970   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03971   484   NtContinue  (1244252, 0, ...
 03972   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03973   484   NtContinue  (1244252, 0, ...
 03974   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03975   484   NtContinue  (1244252, 0, ...
 03976   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03977   484   NtContinue  (1244252, 0, ...
 03978   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03979   484   NtContinue  (1244252, 0, ...
 03980   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03981   484   NtContinue  (1244252, 0, ...
 03982   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03983   484   NtContinue  (1244252, 0, ...
 03984   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03985   484   NtContinue  (1244252, 0, ...
 03986   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03987   484   NtContinue  (1244252, 0, ...
 03988   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03989   484   NtContinue  (1244252, 0, ...
 03990   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03991   484   NtContinue  (1244252, 0, ...
 03992   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03993   484   NtContinue  (1244252, 0, ...
 03994   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03995   484   NtContinue  (1244252, 0, ...
 03996   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03997   484   NtContinue  (1244252, 0, ...
 03998   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03999   484   NtContinue  (1244252, 0, ...
 04000   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04001   484   NtContinue  (1244252, 0, ...
 04002   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04003   484   NtContinue  (1244252, 0, ...
 04004   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04005   484   NtContinue  (1244252, 0, ...
 04006   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04007   484   NtContinue  (1244252, 0, ...
 04008   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04009   484   NtContinue  (1244252, 0, ...
 04010   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04011   484   NtContinue  (1244252, 0, ...
 04012   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04013   484   NtContinue  (1244252, 0, ...
 04014   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04015   484   NtContinue  (1244252, 0, ...
 04016   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04017   484   NtContinue  (1244252, 0, ...
 04018   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04019   484   NtContinue  (1244252, 0, ...
 04020   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04021   484   NtContinue  (1244252, 0, ...
 04022   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04023   484   NtContinue  (1244252, 0, ...
 04024   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04025   484   NtContinue  (1244252, 0, ...
 04026   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04027   484   NtContinue  (1244252, 0, ...
 04028   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04029   484   NtContinue  (1244252, 0, ...
 04030   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04031   484   NtContinue  (1244252, 0, ...
 04032   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04033   484   NtContinue  (1244252, 0, ...
 04034   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04035   484   NtContinue  (1244252, 0, ...
 04036   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04037   484   NtContinue  (1244252, 0, ...
 04038   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04039   484   NtContinue  (1244252, 0, ...
 04040   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04041   484   NtContinue  (1244252, 0, ...
 04042   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04043   484   NtContinue  (1244252, 0, ...
 04044   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04045   484   NtContinue  (1244252, 0, ...
 04046   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04047   484   NtContinue  (1244252, 0, ...
 04048   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04049   484   NtContinue  (1244252, 0, ...
 04050   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04051   484   NtContinue  (1244252, 0, ...
 04052   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04053   484   NtContinue  (1244252, 0, ...
 04054   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04055   484   NtContinue  (1244252, 0, ...
 04056   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04057   484   NtContinue  (1244252, 0, ...
 04058   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04059   484   NtContinue  (1244252, 0, ...
 04060   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04061   484   NtContinue  (1244252, 0, ...
 04062   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04063   484   NtContinue  (1244252, 0, ...
 04064   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04065   484   NtContinue  (1244252, 0, ...
 04066   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04067   484   NtContinue  (1244252, 0, ...
 04068   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04069   484   NtContinue  (1244252, 0, ...
 04070   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04071   484   NtContinue  (1244252, 0, ...
 04072   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04073   484   NtContinue  (1244252, 0, ...
 04074   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04075   484   NtContinue  (1244252, 0, ...
 04076   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04077   484   NtContinue  (1244252, 0, ...
 04078   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04079   484   NtContinue  (1244252, 0, ...
 04080   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04081   484   NtContinue  (1244252, 0, ...
 04082   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04083   484   NtContinue  (1244252, 0, ...
 04084   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04085   484   NtContinue  (1244252, 0, ...
 04086   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04087   484   NtContinue  (1244252, 0, ...
 04088   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04089   484   NtContinue  (1244252, 0, ...
 04090   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04091   484   NtContinue  (1244252, 0, ...
 04092   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04093   484   NtContinue  (1244252, 0, ...
 04094   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04095   484   NtContinue  (1244252, 0, ...
 04096   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04097   484   NtContinue  (1244252, 0, ...
 04098   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04099   484   NtContinue  (1244252, 0, ...
 04100   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04101   484   NtContinue  (1244252, 0, ...
 04102   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04103   484   NtContinue  (1244252, 0, ...
 04104   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04105   484   NtContinue  (1244252, 0, ...
 04106   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04107   484   NtContinue  (1244252, 0, ...
 04108   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04109   484   NtContinue  (1244252, 0, ...
 04110   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04111   484   NtContinue  (1244252, 0, ...
 04112   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04113   484   NtContinue  (1244252, 0, ...
 04114   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04115   484   NtContinue  (1244252, 0, ...
 04116   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04117   484   NtContinue  (1244252, 0, ...
 04118   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04119   484   NtContinue  (1244252, 0, ...
 04120   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04121   484   NtContinue  (1244252, 0, ...
 04122   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04123   484   NtContinue  (1244252, 0, ...
 04124   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04125   484   NtContinue  (1244252, 0, ...
 04126   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04127   484   NtContinue  (1244252, 0, ...
 04128   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04129   484   NtContinue  (1244252, 0, ...
 04130   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04131   484   NtContinue  (1244252, 0, ...
 04132   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04133   484   NtContinue  (1244252, 0, ...
 04134   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04135   484   NtContinue  (1244252, 0, ...
 04136   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04137   484   NtContinue  (1244252, 0, ...
 04138   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04139   484   NtContinue  (1244252, 0, ...
 04140   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04141   484   NtContinue  (1244252, 0, ...
 04142   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04143   484   NtContinue  (1244252, 0, ...
 04144   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04145   484   NtContinue  (1244252, 0, ...
 04146   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04147   484   NtContinue  (1244252, 0, ...
 04148   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04149   484   NtContinue  (1244252, 0, ...
 04150   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04151   484   NtContinue  (1244252, 0, ...
 04152   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04153   484   NtContinue  (1244252, 0, ...
 04154   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04155   484   NtContinue  (1244252, 0, ...
 04156   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04157   484   NtContinue  (1244252, 0, ...
 04158   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04159   484   NtContinue  (1244252, 0, ...
 04160   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04161   484   NtContinue  (1244252, 0, ...
 04162   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04163   484   NtContinue  (1244252, 0, ...
 04164   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04165   484   NtContinue  (1244252, 0, ...
 04166   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04167   484   NtContinue  (1244252, 0, ...
 04168   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04169   484   NtContinue  (1244252, 0, ...
 04170   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04171   484   NtContinue  (1244252, 0, ...
 04172   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04173   484   NtContinue  (1244252, 0, ...
 04174   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04175   484   NtContinue  (1244252, 0, ...
 04176   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04177   484   NtContinue  (1244252, 0, ...
 04178   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04179   484   NtContinue  (1244252, 0, ...
 04180   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04181   484   NtContinue  (1244252, 0, ...
 04182   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04183   484   NtContinue  (1244252, 0, ...
 04184   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04185   484   NtContinue  (1244252, 0, ...
 04186   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04187   484   NtContinue  (1244252, 0, ...
 04188   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04189   484   NtContinue  (1244252, 0, ...
 04190   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04191   484   NtContinue  (1244252, 0, ...
 04192   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04193   484   NtContinue  (1244252, 0, ...
 04194   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04195   484   NtContinue  (1244252, 0, ...
 04196   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04197   484   NtContinue  (1244252, 0, ...
 04198   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04199   484   NtContinue  (1244252, 0, ...
 04200   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04201   484   NtContinue  (1244252, 0, ...
 04202   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04203   484   NtContinue  (1244252, 0, ...
 04204   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04205   484   NtContinue  (1244252, 0, ...
 04206   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04207   484   NtContinue  (1244252, 0, ...
 04208   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04209   484   NtContinue  (1244252, 0, ...
 04210   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04211   484   NtContinue  (1244252, 0, ...
 04212   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04213   484   NtContinue  (1244252, 0, ...
 04214   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04215   484   NtContinue  (1244252, 0, ...
 04216   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04217   484   NtContinue  (1244252, 0, ...
 04218   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04219   484   NtContinue  (1244252, 0, ...
 04220   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04221   484   NtContinue  (1244252, 0, ...
 04222   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04223   484   NtContinue  (1244252, 0, ...
 04224   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04225   484   NtContinue  (1244252, 0, ...
 04226   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04227   484   NtContinue  (1244252, 0, ...
 04228   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04229   484   NtContinue  (1244252, 0, ...
 04230   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04231   484   NtContinue  (1244252, 0, ...
 04232   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04233   484   NtContinue  (1244252, 0, ...
 04234   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04235   484   NtContinue  (1244252, 0, ...
 04236   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04237   484   NtContinue  (1244252, 0, ...
 04238   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04239   484   NtContinue  (1244252, 0, ...
 04240   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04241   484   NtContinue  (1244252, 0, ...
 04242   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04243   484   NtContinue  (1244252, 0, ...
 04244   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04245   484   NtContinue  (1244252, 0, ...
 04246   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04247   484   NtContinue  (1244252, 0, ...
 04248   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04249   484   NtContinue  (1244252, 0, ...
 04250   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04251   484   NtContinue  (1244252, 0, ...
 04252   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04253   484   NtContinue  (1244252, 0, ...
 04254   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04255   484   NtContinue  (1244252, 0, ...
 04256   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04257   484   NtContinue  (1244252, 0, ...
 04258   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04259   484   NtContinue  (1244252, 0, ...
 04260   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04261   484   NtContinue  (1244252, 0, ...
 04262   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04263   484   NtContinue  (1244252, 0, ...
 04264   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04265   484   NtContinue  (1244252, 0, ...
 04266   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04267   484   NtContinue  (1244252, 0, ...
 04268   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04269   484   NtContinue  (1244252, 0, ...
 04270   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04271   484   NtContinue  (1244252, 0, ...
 04272   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04273   484   NtContinue  (1244252, 0, ...
 04274   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04275   484   NtContinue  (1244252, 0, ...
 04276   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04277   484   NtContinue  (1244252, 0, ...
 04278   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04279   484   NtContinue  (1244252, 0, ...
 04280   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04281   484   NtContinue  (1244252, 0, ...
 04282   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04283   484   NtContinue  (1244252, 0, ...
 04284   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04285   484   NtContinue  (1244252, 0, ...
 04286   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04287   484   NtContinue  (1244252, 0, ...
 04288   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04289   484   NtContinue  (1244252, 0, ...
 04290   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04291   484   NtContinue  (1244252, 0, ...
 04292   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04293   484   NtContinue  (1244252, 0, ...
 04294   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04295   484   NtContinue  (1244252, 0, ...
 04296   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04297   484   NtContinue  (1244252, 0, ...
 04298   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04299   484   NtContinue  (1244252, 0, ...
 04300   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04301   484   NtContinue  (1244252, 0, ...
 04302   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04303   484   NtContinue  (1244252, 0, ...
 04304   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04305   484   NtContinue  (1244252, 0, ...
 04306   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04307   484   NtContinue  (1244252, 0, ...
 04308   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04309   484   NtContinue  (1244252, 0, ...
 04310   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04311   484   NtContinue  (1244252, 0, ...
 04312   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04313   484   NtContinue  (1244252, 0, ...
 04314   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04315   484   NtContinue  (1244252, 0, ...
 04316   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04317   484   NtContinue  (1244252, 0, ...
 04318   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04319   484   NtContinue  (1244252, 0, ...
 04320   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04321   484   NtContinue  (1244252, 0, ...
 04322   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04323   484   NtContinue  (1244252, 0, ...
 04324   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04325   484   NtContinue  (1244252, 0, ...
 04326   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04327   484   NtContinue  (1244252, 0, ...
 04328   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04329   484   NtContinue  (1244252, 0, ...
 04330   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04331   484   NtContinue  (1244252, 0, ...
 04332   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04333   484   NtContinue  (1244252, 0, ...
 04334   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04335   484   NtContinue  (1244252, 0, ...
 04336   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04337   484   NtContinue  (1244252, 0, ...
 04338   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04339   484   NtContinue  (1244252, 0, ...
 04340   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04341   484   NtContinue  (1244252, 0, ...
 04342   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04343   484   NtContinue  (1244252, 0, ...
 04344   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04345   484   NtContinue  (1244252, 0, ...
 04346   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04347   484   NtContinue  (1244252, 0, ...
 04348   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04349   484   NtContinue  (1244252, 0, ...
 04350   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04351   484   NtContinue  (1244252, 0, ...
 04352   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04353   484   NtContinue  (1244252, 0, ...
 04354   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04355   484   NtContinue  (1244252, 0, ...
 04356   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04357   484   NtContinue  (1244252, 0, ...
 04358   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04359   484   NtContinue  (1244252, 0, ...
 04360   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04361   484   NtContinue  (1244252, 0, ...
 04362   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04363   484   NtContinue  (1244252, 0, ...
 04364   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04365   484   NtContinue  (1244252, 0, ...
 04366   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04367   484   NtContinue  (1244252, 0, ...
 04368   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04369   484   NtContinue  (1244252, 0, ...
 04370   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04371   484   NtContinue  (1244252, 0, ...
 04372   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04373   484   NtContinue  (1244252, 0, ...
 04374   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04375   484   NtContinue  (1244252, 0, ...
 04376   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04377   484   NtContinue  (1244252, 0, ...
 04378   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04379   484   NtContinue  (1244252, 0, ...
 04380   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04381   484   NtContinue  (1244252, 0, ...
 04382   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04383   484   NtContinue  (1244252, 0, ...
 04384   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04385   484   NtContinue  (1244252, 0, ...
 04386   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04387   484   NtContinue  (1244252, 0, ...
 04388   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04389   484   NtContinue  (1244252, 0, ...
 04390   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04391   484   NtContinue  (1244252, 0, ...
 04392   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04393   484   NtContinue  (1244252, 0, ...
 04394   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04395   484   NtContinue  (1244252, 0, ...
 04396   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04397   484   NtContinue  (1244252, 0, ...
 04398   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04399   484   NtContinue  (1244252, 0, ...
 04400   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04401   484   NtContinue  (1244252, 0, ...
 04402   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04403   484   NtContinue  (1244252, 0, ...
 04404   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04405   484   NtContinue  (1244252, 0, ...
 04406   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04407   484   NtContinue  (1244252, 0, ...
 04408   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04409   484   NtContinue  (1244252, 0, ...
 04410   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04411   484   NtContinue  (1244252, 0, ...
 04412   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04413   484   NtContinue  (1244252, 0, ...
 04414   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04415   484   NtContinue  (1244252, 0, ...
 04416   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04417   484   NtContinue  (1244252, 0, ...
 04418   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04419   484   NtContinue  (1244252, 0, ...
 04420   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04421   484   NtContinue  (1244252, 0, ...
 04422   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04423   484   NtContinue  (1244252, 0, ...
 04424   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04425   484   NtContinue  (1244252, 0, ...
 04426   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04427   484   NtContinue  (1244252, 0, ...
 04428   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04429   484   NtContinue  (1244252, 0, ...
 04430   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04431   484   NtContinue  (1244252, 0, ...
 04432   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04433   484   NtContinue  (1244252, 0, ...
 04434   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04435   484   NtContinue  (1244252, 0, ...
 04436   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04437   484   NtContinue  (1244252, 0, ...
 04438   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04439   484   NtContinue  (1244252, 0, ...
 04440   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04441   484   NtContinue  (1244252, 0, ...
 04442   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04443   484   NtContinue  (1244252, 0, ...
 04444   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04445   484   NtContinue  (1244252, 0, ...
 04446   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04447   484   NtContinue  (1244252, 0, ...
 04448   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04449   484   NtContinue  (1244252, 0, ...
 04450   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04451   484   NtContinue  (1244252, 0, ...
 04452   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04453   484   NtContinue  (1244252, 0, ...
 04454   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04455   484   NtContinue  (1244252, 0, ...
 04456   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04457   484   NtContinue  (1244252, 0, ...
 04458   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04459   484   NtContinue  (1244252, 0, ...
 04460   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04461   484   NtContinue  (1244252, 0, ...
 04462   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04463   484   NtContinue  (1244252, 0, ...
 04464   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04465   484   NtContinue  (1244252, 0, ...
 04466   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04467   484   NtContinue  (1244252, 0, ...
 04468   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04469   484   NtContinue  (1244252, 0, ...
 04470   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04471   484   NtContinue  (1244252, 0, ...
 04472   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04473   484   NtContinue  (1244252, 0, ...
 04474   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04475   484   NtContinue  (1244252, 0, ...
 04476   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04477   484   NtContinue  (1244252, 0, ...
 04478   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04479   484   NtContinue  (1244252, 0, ...
 04480   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04481   484   NtContinue  (1244252, 0, ...
 04482   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04483   484   NtContinue  (1244252, 0, ...
 04484   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04485   484   NtContinue  (1244252, 0, ...
 04486   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04487   484   NtContinue  (1244252, 0, ...
 04488   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04489   484   NtContinue  (1244252, 0, ...
 04490   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04491   484   NtContinue  (1244252, 0, ...
 04492   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04493   484   NtContinue  (1244252, 0, ...
 04494   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04495   484   NtContinue  (1244252, 0, ...
 04496   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04497   484   NtContinue  (1244252, 0, ...
 04498   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04499   484   NtContinue  (1244252, 0, ...
 04500   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04501   484   NtContinue  (1244252, 0, ...
 04502   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04503   484   NtContinue  (1244252, 0, ...
 04504   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04505   484   NtContinue  (1244252, 0, ...
 04506   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04507   484   NtContinue  (1244252, 0, ...
 04508   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04509   484   NtContinue  (1244252, 0, ...
 04510   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04511   484   NtContinue  (1244252, 0, ...
 04512   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04513   484   NtContinue  (1244252, 0, ...
 04514   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04515   484   NtContinue  (1244252, 0, ...
 04516   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04517   484   NtContinue  (1244252, 0, ...
 04518   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04519   484   NtContinue  (1244252, 0, ...
 04520   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04521   484   NtContinue  (1244252, 0, ...
 04522   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04523   484   NtContinue  (1244252, 0, ...
 04524   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04525   484   NtContinue  (1244252, 0, ...
 04526   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04527   484   NtContinue  (1244252, 0, ...
 04528   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04529   484   NtContinue  (1244252, 0, ...
 04530   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04531   484   NtContinue  (1244252, 0, ...
 04532   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04533   484   NtContinue  (1244252, 0, ...
 04534   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04535   484   NtContinue  (1244252, 0, ...
 04536   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04537   484   NtContinue  (1244252, 0, ...
 04538   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04539   484   NtContinue  (1244252, 0, ...
 04540   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04541   484   NtContinue  (1244252, 0, ...
 04542   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04543   484   NtContinue  (1244252, 0, ...
 04544   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04545   484   NtContinue  (1244252, 0, ...
 04546   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04547   484   NtContinue  (1244252, 0, ...
 04548   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04549   484   NtContinue  (1244252, 0, ...
 04550   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04551   484   NtContinue  (1244252, 0, ...
 04552   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04553   484   NtContinue  (1244252, 0, ...
 04554   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04555   484   NtContinue  (1244252, 0, ...
 04556   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04557   484   NtContinue  (1244252, 0, ...
 04558   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04559   484   NtContinue  (1244252, 0, ...
 04560   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04561   484   NtContinue  (1244252, 0, ...
 04562   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04563   484   NtContinue  (1244252, 0, ...
 04564   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04565   484   NtContinue  (1244252, 0, ...
 04566   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04567   484   NtContinue  (1244252, 0, ...
 04568   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04569   484   NtContinue  (1244252, 0, ...
 04570   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04571   484   NtContinue  (1244252, 0, ...
 04572   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04573   484   NtContinue  (1244252, 0, ...
 04574   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04575   484   NtContinue  (1244252, 0, ...
 04576   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04577   484   NtContinue  (1244252, 0, ...
 04578   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04579   484   NtContinue  (1244252, 0, ...
 04580   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04581   484   NtContinue  (1244252, 0, ...
 04582   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04583   484   NtContinue  (1244252, 0, ...
 04584   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04585   484   NtContinue  (1244252, 0, ...
 04586   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04587   484   NtContinue  (1244252, 0, ...
 04588   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04589   484   NtContinue  (1244252, 0, ...
 04590   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04591   484   NtContinue  (1244252, 0, ...
 04592   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04593   484   NtContinue  (1244252, 0, ...
 04594   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04595   484   NtContinue  (1244252, 0, ...
 04596   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04597   484   NtContinue  (1244252, 0, ...
 04598   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04599   484   NtContinue  (1244252, 0, ...
 04600   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04601   484   NtContinue  (1244252, 0, ...
 04602   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04603   484   NtContinue  (1244252, 0, ...
 04604   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04605   484   NtContinue  (1244252, 0, ...
 04606   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04607   484   NtContinue  (1244252, 0, ...
 04608   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04609   484   NtContinue  (1244252, 0, ...
 04610   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04611   484   NtContinue  (1244252, 0, ...
 04612   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04613   484   NtContinue  (1244252, 0, ...
 04614   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04615   484   NtContinue  (1244252, 0, ...
 04616   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04617   484   NtContinue  (1244252, 0, ...
 04618   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04619   484   NtContinue  (1244252, 0, ...
 04620   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04621   484   NtContinue  (1244252, 0, ...
 04622   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04623   484   NtContinue  (1244252, 0, ...
 04624   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04625   484   NtContinue  (1244252, 0, ...
 04626   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04627   484   NtContinue  (1244252, 0, ...
 04628   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04629   484   NtContinue  (1244252, 0, ...
 04630   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04631   484   NtContinue  (1244252, 0, ...
 04632   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04633   484   NtContinue  (1244252, 0, ...
 04634   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04635   484   NtContinue  (1244252, 0, ...
 04636   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04637   484   NtContinue  (1244252, 0, ...
 04638   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04639   484   NtContinue  (1244252, 0, ...
 04640   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04641   484   NtContinue  (1244252, 0, ...
 04642   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04643   484   NtContinue  (1244252, 0, ...
 04644   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04645   484   NtContinue  (1244252, 0, ...
 04646   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04647   484   NtContinue  (1244252, 0, ...
 04648   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04649   484   NtContinue  (1244252, 0, ...
 04650   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04651   484   NtContinue  (1244252, 0, ...
 04652   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04653   484   NtContinue  (1244252, 0, ...
 04654   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04655   484   NtContinue  (1244252, 0, ...
 04656   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04657   484   NtContinue  (1244252, 0, ...
 04658   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04659   484   NtContinue  (1244252, 0, ...
 04660   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04661   484   NtContinue  (1244252, 0, ...
 04662   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04663   484   NtContinue  (1244252, 0, ...
 04664   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04665   484   NtContinue  (1244252, 0, ...
 04666   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04667   484   NtContinue  (1244252, 0, ...
 04668   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04669   484   NtContinue  (1244252, 0, ...
 04670   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04671   484   NtContinue  (1244252, 0, ...
 04672   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04673   484   NtContinue  (1244252, 0, ...
 04674   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04675   484   NtContinue  (1244252, 0, ...
 04676   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04677   484   NtContinue  (1244252, 0, ...
 04678   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04679   484   NtContinue  (1244252, 0, ...
 04680   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04681   484   NtContinue  (1244252, 0, ...
 04682   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04683   484   NtContinue  (1244252, 0, ...
 04684   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04685   484   NtContinue  (1244252, 0, ...
 04686   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04687   484   NtContinue  (1244252, 0, ...
 04688   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04689   484   NtContinue  (1244252, 0, ...
 04690   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04691   484   NtContinue  (1244252, 0, ...
 04692   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04693   484   NtContinue  (1244252, 0, ...
 04694   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04695   484   NtContinue  (1244252, 0, ...
 04696   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04697   484   NtContinue  (1244252, 0, ...
 04698   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04699   484   NtContinue  (1244252, 0, ...
 04700   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04701   484   NtContinue  (1244252, 0, ...
 04702   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04703   484   NtContinue  (1244252, 0, ...
 04704   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04705   484   NtContinue  (1244252, 0, ...
 04706   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04707   484   NtContinue  (1244252, 0, ...
 04708   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04709   484   NtContinue  (1244252, 0, ...
 04710   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04711   484   NtContinue  (1244252, 0, ...
 04712   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04713   484   NtContinue  (1244252, 0, ...
 04714   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04715   484   NtContinue  (1244252, 0, ...
 04716   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04717   484   NtContinue  (1244252, 0, ...
 04718   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04719   484   NtContinue  (1244252, 0, ...
 04720   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04721   484   NtContinue  (1244252, 0, ...
 04722   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04723   484   NtContinue  (1244252, 0, ...
 04724   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04725   484   NtContinue  (1244252, 0, ...
 04726   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04727   484   NtContinue  (1244252, 0, ...
 04728   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04729   484   NtContinue  (1244252, 0, ...
 04730   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04731   484   NtContinue  (1244252, 0, ...
 04732   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04733   484   NtContinue  (1244252, 0, ...
 04734   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04735   484   NtContinue  (1244252, 0, ...
 04736   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04737   484   NtContinue  (1244252, 0, ...
 04738   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04739   484   NtContinue  (1244252, 0, ...
 04740   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04741   484   NtContinue  (1244252, 0, ...
 04742   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04743   484   NtContinue  (1244252, 0, ...
 04744   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04745   484   NtContinue  (1244252, 0, ...
 04746   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04747   484   NtContinue  (1244252, 0, ...
 04748   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04749   484   NtContinue  (1244252, 0, ...
 04750   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04751   484   NtContinue  (1244252, 0, ...
 04752   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04753   484   NtContinue  (1244252, 0, ...
 04754   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04755   484   NtContinue  (1244252, 0, ...
 04756   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04757   484   NtContinue  (1244252, 0, ...
 04758   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04759   484   NtContinue  (1244252, 0, ...
 04760   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04761   484   NtContinue  (1244252, 0, ...
 04762   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04763   484   NtContinue  (1244252, 0, ...
 04764   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04765   484   NtContinue  (1244252, 0, ...
 04766   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04767   484   NtContinue  (1244252, 0, ...
 04768   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04769   484   NtContinue  (1244252, 0, ...
 04770   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04771   484   NtContinue  (1244252, 0, ...
 04772   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04773   484   NtContinue  (1244252, 0, ...
 04774   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04775   484   NtContinue  (1244252, 0, ...
 04776   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04777   484   NtContinue  (1244252, 0, ...
 04778   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04779   484   NtContinue  (1244252, 0, ...
 04780   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04781   484   NtContinue  (1244252, 0, ...
 04782   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04783   484   NtContinue  (1244252, 0, ...
 04784   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04785   484   NtContinue  (1244252, 0, ...
 04786   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04787   484   NtContinue  (1244252, 0, ...
 04788   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04789   484   NtContinue  (1244252, 0, ...
 04790   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04791   484   NtContinue  (1244252, 0, ...
 04792   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04793   484   NtContinue  (1244252, 0, ...
 04794   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04795   484   NtContinue  (1244252, 0, ...
 04796   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04797   484   NtContinue  (1244252, 0, ...
 04798   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04799   484   NtContinue  (1244252, 0, ...
 04800   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04801   484   NtContinue  (1244252, 0, ...
 04802   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04803   484   NtContinue  (1244252, 0, ...
 04804   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04805   484   NtContinue  (1244252, 0, ...
 04806   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04807   484   NtContinue  (1244252, 0, ...
 04808   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04809   484   NtContinue  (1244252, 0, ...
 04810   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04811   484   NtContinue  (1244252, 0, ...
 04812   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04813   484   NtContinue  (1244252, 0, ...
 04814   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04815   484   NtContinue  (1244252, 0, ...
 04816   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04817   484   NtContinue  (1244252, 0, ...
 04818   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04819   484   NtContinue  (1244252, 0, ...
 04820   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04821   484   NtContinue  (1244252, 0, ...
 04822   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04823   484   NtContinue  (1244252, 0, ...
 04824   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04825   484   NtContinue  (1244252, 0, ...
 04826   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04827   484   NtContinue  (1244252, 0, ...
 04828   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04829   484   NtContinue  (1244252, 0, ...
 04830   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04831   484   NtContinue  (1244252, 0, ...
 04832   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04833   484   NtContinue  (1244252, 0, ...
 04834   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04835   484   NtContinue  (1244252, 0, ...
 04836   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04837   484   NtContinue  (1244252, 0, ...
 04838   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04839   484   NtContinue  (1244252, 0, ...
 04840   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04841   484   NtContinue  (1244252, 0, ...
 04842   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04843   484   NtContinue  (1244252, 0, ...
 04844   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04845   484   NtContinue  (1244252, 0, ...
 04846   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04847   484   NtContinue  (1244252, 0, ...
 04848   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04849   484   NtContinue  (1244252, 0, ...
 04850   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04851   484   NtContinue  (1244252, 0, ...
 04852   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04853   484   NtContinue  (1244252, 0, ...
 04854   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04855   484   NtContinue  (1244252, 0, ...
 04856   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04857   484   NtContinue  (1244252, 0, ...
 04858   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04859   484   NtContinue  (1244252, 0, ...
 04860   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04861   484   NtContinue  (1244252, 0, ...
 04862   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04863   484   NtContinue  (1244252, 0, ...
 04864   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04865   484   NtContinue  (1244252, 0, ...
 04866   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04867   484   NtContinue  (1244252, 0, ...
 04868   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04869   484   NtContinue  (1244252, 0, ...
 04870   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04871   484   NtContinue  (1244252, 0, ...
 04872   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04873   484   NtContinue  (1244252, 0, ...
 04874   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04875   484   NtContinue  (1244252, 0, ...
 04876   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04877   484   NtContinue  (1244252, 0, ...
 04878   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04879   484   NtContinue  (1244252, 0, ...
 04880   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04881   484   NtContinue  (1244252, 0, ...
 04882   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04883   484   NtContinue  (1244252, 0, ...
 04884   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04885   484   NtContinue  (1244252, 0, ...
 04886   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04887   484   NtContinue  (1244252, 0, ...
 04888   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04889   484   NtContinue  (1244252, 0, ...
 04890   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04891   484   NtContinue  (1244252, 0, ...
 04892   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04893   484   NtContinue  (1244252, 0, ...
 04894   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04895   484   NtContinue  (1244252, 0, ...
 04896   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04897   484   NtContinue  (1244252, 0, ...
 04898   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04899   484   NtContinue  (1244252, 0, ...
 04900   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04901   484   NtContinue  (1244252, 0, ...
 04902   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04903   484   NtContinue  (1244252, 0, ...
 04904   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04905   484   NtContinue  (1244252, 0, ...
 04906   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04907   484   NtContinue  (1244252, 0, ...
 04908   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04909   484   NtContinue  (1244252, 0, ...
 04910   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04911   484   NtContinue  (1244252, 0, ...
 04912   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04913   484   NtContinue  (1244252, 0, ...
 04914   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04915   484   NtContinue  (1244252, 0, ...
 04916   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04917   484   NtContinue  (1244252, 0, ...
 04918   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04919   484   NtContinue  (1244252, 0, ...
 04920   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04921   484   NtContinue  (1244252, 0, ...
 04922   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04923   484   NtContinue  (1244252, 0, ...
 04924   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04925   484   NtContinue  (1244252, 0, ...
 04926   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04927   484   NtContinue  (1244252, 0, ...
 04928   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04929   484   NtContinue  (1244252, 0, ...
 04930   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04931   484   NtContinue  (1244252, 0, ...
 04932   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04933   484   NtContinue  (1244252, 0, ...
 04934   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04935   484   NtContinue  (1244252, 0, ...
 04936   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04937   484   NtContinue  (1244252, 0, ...
 04938   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04939   484   NtContinue  (1244252, 0, ...
 04940   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04941   484   NtContinue  (1244252, 0, ...
 04942   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04943   484   NtContinue  (1244252, 0, ...
 04944   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04945   484   NtContinue  (1244252, 0, ...
 04946   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04947   484   NtContinue  (1244252, 0, ...
 04948   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04949   484   NtContinue  (1244252, 0, ...
 04950   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04951   484   NtContinue  (1244252, 0, ...
 04952   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04953   484   NtContinue  (1244252, 0, ...
 04954   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04955   484   NtContinue  (1244252, 0, ...
 04956   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04957   484   NtContinue  (1244252, 0, ...
 04958   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04959   484   NtContinue  (1244252, 0, ...
 04960   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04961   484   NtContinue  (1244252, 0, ...
 04962   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04963   484   NtContinue  (1244252, 0, ...
 04964   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04965   484   NtContinue  (1244252, 0, ...
 04966   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04967   484   NtContinue  (1244252, 0, ...
 04968   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04969   484   NtContinue  (1244252, 0, ...
 04970   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04971   484   NtContinue  (1244252, 0, ...
 04972   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04973   484   NtContinue  (1244252, 0, ...
 04974   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04975   484   NtContinue  (1244252, 0, ...
 04976   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04977   484   NtContinue  (1244252, 0, ...
 04978   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04979   484   NtContinue  (1244252, 0, ...
 04980   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04981   484   NtContinue  (1244252, 0, ...
 04982   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04983   484   NtContinue  (1244252, 0, ...
 04984   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04985   484   NtContinue  (1244252, 0, ...
 04986   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 04987   484   NtContinue  (1244252, 0, ...
 04988   484   NtQueryVirtualMemory  (-1, 0x47e46b, Basic, 28, ... {BaseAddress=0x47e000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x3000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0