Summary:


NtAccessCheck(>) 
 1 
NtUserGetDC(>) 
 1 
NtOpenProcess(>) 
 7 
NtCreateEvent(>) 
 26 

NtAddAtom(>) 
 1 
NtUserGetThreadDesktop(>) 
 1 
NtQuerySection(>) 
 7 
NtRequestWaitReplyPort(>) 
 27 

NtCreateFile(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtFlushInstructionCache(>) 
 9 
NtSetEvent(>) 
 27 

NtDelayExecution(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtOpenProcessTokenEx(>) 
 9 
NtSetInformationThread(>) 
 28 

NtEnumerateValueKey(>) 
 1 
NtOpenMutant(>) 
 2 
NtOpenThreadTokenEx(>) 
 9 
NtOpenSection(>) 
 29 

NtFsControlFile(>) 
 1 
NtQueryInformationProcess(>) 
 2 
NtSetEventBoostPriority(>) 
 10 
NtQueryValueKey(>) 
 29 

NtGdiCreateBitmap(>) 
 1 
NtRaiseException(>) 
 2 
NtUnmapViewOfSection(>) 
 10 
NtMapViewOfSection(>) 
 34 

NtGdiInit(>) 
 1 
NtCallbackReturn(>) 
 3 
NtUserSystemParametersInfo(>) 
 10 
NtUserGetClassInfo(>) 
 37 

NtGdiQueryFontAssocInfo(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtTerminateThread(>) 
 11 
NtQueryInformationThread(>) 
 40 

NtGdiSelectBitmap(>) 
 1 
NtQueryVirtualMemory(>) 
 3 
NtQueryInformationToken(>) 
 13 
NtWaitForSingleObject(>) 
 41 

NtOpenEvent(>) 
 1 
NtReleaseMutant(>) 
 3 
NtCreateSection(>) 
 14 
NtUserFindExistingCursorIcon(>) 
 48 

NtOpenKeyedEvent(>) 
 1 
NtSetInformationObject(>) 
 3 
NtQueryDebugFilterState(>) 
 15 
NtProtectVirtualMemory(>) 
 52 

NtOpenSymbolicLinkObject(>) 
 1 
NtUserBuildHwndList(>) 
 3 
NtQuerySystemInformation(>) 
 18 
NtOpenKey(>) 
 55 

NtQueryInformationFile(>) 
 1 
NtUserRegisterWindowMessage(>) 
 3 
NtQueryAttributesFile(>) 
 19 
NtUserRegisterClassExWOW(>) 
 63 

NtQueryObject(>) 
 1 
NtDuplicateObject(>) 
 4 
NtOpenFile(>) 
 20 
NtAllocateVirtualMemory(>) 
 71 

NtQuerySymbolicLinkObject(>) 
 1 
NtOpenProcessToken(>) 
 4 
NtRegisterThreadTerminatePort(>) 
 21 
NtClose(>) 
 149 

NtQueryVolumeInformationFile(>) 
 1 
NtQueryDefaultLocale(>) 
 4 
NtCreateThread(>) 
 22 
NtUserQueryWindow(>) 
 198 

NtSecureConnectPort(>) 
 1 
NtQueryInstallUILanguage(>) 
 4 
NtFreeVirtualMemory(>) 
 22 
NtContinue(>) 
 3649 

NtSetInformationProcess(>) 
 1 
NtUserFindWindowEx(>) 
 4 
NtReadVirtualMemory(>) 
 22 

NtUserCallNoParam(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtResumeThread(>) 
 22 

NtUserCallOneParam(>) 
 1 

Trace:
 00001   396   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   396   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   396   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   396   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   396   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   396   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   396   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   396   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   396   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   396   NtClose  (12, ... ) == 0x0
 00014   396   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   396   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   396   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   396   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   396   NtClose  (16, ... ) == 0x0
 00021   396   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   396   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   396   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   396   NtClose  (16, ... ) == 0x0
 00026   396   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   396   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   396   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   396   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 368, 396, 1479, 0} "\20>\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 368, 396, 1479, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 368, 396, 1479, 0} "\20>\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00032   396   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   396   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   396   NtClose  (16, ... ) == 0x0
 00036   396   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   396   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   396   NtClose  (28, ... ) == 0x0
 00041   396   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   396   NtClose  (28, ... ) == 0x0
 00045   396   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   396   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   396   NtClose  (28, ... ) == 0x0
 00049   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   396   NtClose  (28, ... ) == 0x0
 00052   396   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 368, 396, 1482, 0} "\10\20\31\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 368, 396, 1482, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 368, 396, 1482, 0} "\10\20\31\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00056   396   NtProtectVirtualMemory  (-1, (0x420000), 12288, 4, ... (0x420000), 12288, 8, ) == 0x0
 00057   396   NtProtectVirtualMemory  (-1, (0x420000), 12288, 8, ... (0x420000), 12288, 4, ) == 0x0
 00058   396   NtFlushInstructionCache  (-1, 4325376, 12288, ... ) == 0x0
 00059   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.DLL"}, ... 28, ) }, ... 28, ) == 0x0
 00060   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00061   396   NtClose  (28, ... ) == 0x0
 00062   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00064   396   NtClose  (28, ... ) == 0x0
 00065   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00066   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00067   396   NtClose  (28, ... ) == 0x0
 00068   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00070   396   NtClose  (28, ... ) == 0x0
 00071   396   NtProtectVirtualMemory  (-1, (0x420000), 12288, 4, ... (0x420000), 12288, 4, ) == 0x0
 00072   396   NtProtectVirtualMemory  (-1, (0x420000), 12288, 4, ... (0x420000), 12288, 4, ) == 0x0
 00073   396   NtFlushInstructionCache  (-1, 4325376, 12288, ... ) == 0x0
 00074   396   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00075   396   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00076   396   NtClose  (28, ... ) == 0x0
 00077   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00078   396   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00079   396   NtClose  (28, ... ) == 0x0
 00080   396   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00081   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00082   396   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00083   396   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00084   396   NtClose  (28, ... ) == 0x0
 00085   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00086   396   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00087   396   NtClose  (28, ... ) == 0x0
 00088   396   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00089   396   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00090   396   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00091   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00092   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\31\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 368, 396, 1487, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 368, 396, 1487, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\31\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 368, 396, 1487, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00093   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00094   396   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x430000), 0x0, 1060864, ) == 0x0
 00095   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 36, ) == 0x0
 00096   396   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00097   396   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482020, ) == 0x0
 00098   396   NtQueryInformationToken  (-2147482020, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00099   396   NtQueryInformationToken  (-2147482020, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00100   396   NtClose  (-2147482020, ... ) == 0x0
 00101   396   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0
 00102   396   NtFreeVirtualMemory  (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0
 00103   396   NtDuplicateObject  (-1, 40, -1, 0x0, 0, 2, ... 48, ) == 0x0
 00104   396   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00105   396   NtQueryValueKey  (-2147482020,  (-2147482020, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00106   396   NtClose  (-2147482020, ... ) == 0x0
 00107   396   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00108   396   NtQueryValueKey  (-2147482020,  (-2147482020, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00109   396   NtClose  (-2147482020, ... ) == 0x0
 00110   396   NtQueryDefaultLocale  (0, -128865780, ... ) == 0x0
 00111   396   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00112   396   NtUserCallNoParam  (24, ... ) == 0x0
 00113   396   NtGdiCreateCompatibleDC  (0, ...
 00114   396   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0
 00113   396   NtGdiCreateCompatibleDC  ... ) == 0x100103c9
 00115   396   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00116   396   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00117   396   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0x13050402
 00118   396   NtGdiCreateSolidBrush  (0, 0, ...
 00119   396   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8650752, 4096, ) == 0x0
 00118   396   NtGdiCreateSolidBrush  ... ) == 0xe100408
 00120   396   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00121   396   NtGdiCreateCompatibleDC  (0, ... ) == 0x39010416
 00122   396   NtGdiSelectBitmap  (956367894, 319095810, ... ) == 0x185000f
 00123   396   NtUserGetThreadDesktop  (396, 0, ... ) == 0x2c
 00124   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 52, ) }, ... 52, ) == 0x0
 00125   396   NtQueryValueKey  (52,  (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00126   396   NtClose  (52, ... ) == 0x0
 00127   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00128   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810dc017
 00129   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00130   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810dc01c
 00131   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00132   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810dc01e
 00133   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00134   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810d8002
 00135   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00136   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810dc018
 00137   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00138   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810dc01a
 00139   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00140   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810dc01d
 00141   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00142   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ...
 00143   396   NtAllocateVirtualMemory  (-1, 5599232, 0, 4096, 4096, 32, ... 5599232, 4096, ) == 0x0
 00142   396   NtUserRegisterClassExWOW  ... ) == 0x810dc026
 00144   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00145   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810dc019
 00146   396   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc020
 00147   396   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc022
 00148   396   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc023
 00149   396   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc024
 00150   396   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc025
 00151   396   NtCallbackReturn  (0, 0, 0, ...
 00152   396   NtGdiInit  (... ) == 0x1
 00153   396   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00154   396   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00155   396   NtQueryVirtualMemory  (-1, 0x423620, Basic, 28, ... {BaseAddress=0x423000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00156   396   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00157   396   NtProtectVirtualMemory  (-1, (0x4001f8), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00158   396   NtProtectVirtualMemory  (-1, (0x4001f8), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00159   396   NtProtectVirtualMemory  (-1, (0x400220), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00160   396   NtProtectVirtualMemory  (-1, (0x400220), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00161   396   NtProtectVirtualMemory  (-1, (0x400248), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00162   396   NtProtectVirtualMemory  (-1, (0x400248), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00163   396   NtProtectVirtualMemory  (-1, (0x400270), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00164   396   NtProtectVirtualMemory  (-1, (0x400270), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00165   396   NtProtectVirtualMemory  (-1, (0x400298), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00166   396   NtProtectVirtualMemory  (-1, (0x400298), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00167   396   NtProtectVirtualMemory  (-1, (0x4002c0), 40, 4, ... (0x400000), 4096, 2, ) == 0x0
 00168   396   NtProtectVirtualMemory  (-1, (0x4002c0), 40, 2, ... (0x400000), 4096, 4, ) == 0x0
 00169   396   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 00170   396   NtUserFindWindowEx  (0, 0,  (0, 0, "WispWindowClass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 00171   396   NtUserBuildHwndList  (0, 0, 0, 0, 64, ... (0x100aa, 0x100a8, 0x100a6, 0x20060, 0x100a4, 0x10080, 0x10074, 0x10068, 0x30042, 0x30046, 0x30044, 0x30034, 0x1009c, 0x1008c, 0x1007c, 0x10026, 0x100be, 0x100bc, 0x100ba, 0x100b8, 0x100b6, 0x100b4, 0x100b0, 0x100ae, 0x20064, 0x100ac, 0x2005e, 0x1006c, 0x50048, 0x4004c, 0x9002a, 0x1007e, 0x10076, 0x1, ), 34, ) == 0x0
 00172   396   NtUserQueryWindow  (65706, 0, ... ) == 0x7e0
 00173   396   NtUserQueryWindow  (65706, 1, ... ) == 0x7e4
 00174   396   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {2016, 0}, ... 52, ) == 0x0
 00175   396   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \1\0\0", 64, ) , 64, ) == 0x0
 00176   396   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...  (52, 0x4b1c86, 4, ... "\0\0\0\0", 4, ) , 4, ) == 0x0
 00177   396   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...  (52, 0x4c91a0, 256, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, ) , 256, ) == 0x0
 00178   396   NtClose  (52, ... ) == 0x0
 00179   396   NtUserQueryWindow  (65704, 0, ... ) == 0x7e0
 00180   396   NtUserQueryWindow  (65704, 1, ... ) == 0x7e4
 00181   396   NtUserQueryWindow  (65702, 0, ... ) == 0x7e0
 00182   396   NtUserQueryWindow  (65702, 1, ... ) == 0x7e4
 00183   396   NtUserQueryWindow  (131168, 0, ... ) == 0x7e0
 00184   396   NtUserQueryWindow  (131168, 1, ... ) == 0x7e4
 00185   396   NtUserQueryWindow  (65700, 0, ... ) == 0x778
 00186   396   NtUserQueryWindow  (65700, 1, ... ) == 0x788
 00187   396   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {1912, 0}, ... 52, ) == 0x0
 00188   396   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 64, ) , 64, ) == 0x0
 00189   396   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...
 00190   396   NtContinue  (-128869220, 0, ...
 00189   396   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00191   396   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...
 00192   396   NtContinue  (-128869220, 0, ...
 00191   396   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00193   396   NtClose  (52, ... ) == 0x0
 00194   396   NtUserQueryWindow  (65664, 0, ... ) == 0x778
 00195   396   NtUserQueryWindow  (65664, 1, ... ) == 0x788
 00196   396   NtUserQueryWindow  (65652, 0, ... ) == 0x778
 00197   396   NtUserQueryWindow  (65652, 1, ... ) == 0x788
 00198   396   NtUserQueryWindow  (65640, 0, ... ) == 0x778
 00199   396   NtUserQueryWindow  (65640, 1, ... ) == 0x788
 00200   396   NtUserQueryWindow  (196674, 0, ... ) == 0x778
 00201   396   NtUserQueryWindow  (196674, 1, ... ) == 0x788
 00202   396   NtUserQueryWindow  (196678, 0, ... ) == 0x778
 00203   396   NtUserQueryWindow  (196678, 1, ... ) == 0x788
 00204   396   NtUserQueryWindow  (196676, 0, ... ) == 0x778
 00205   396   NtUserQueryWindow  (196676, 1, ... ) == 0x788
 00206   396   NtUserQueryWindow  (196660, 0, ... ) == 0x778
 00207   396   NtUserQueryWindow  (196660, 1, ... ) == 0x788
 00208   396   NtUserQueryWindow  (65692, 0, ... ) == 0x778
 00209   396   NtUserQueryWindow  (65692, 1, ... ) == 0x788
 00210   396   NtUserQueryWindow  (65676, 0, ... ) == 0x778
 00211   396   NtUserQueryWindow  (65676, 1, ... ) == 0x788
 00212   396   NtUserQueryWindow  (65660, 0, ... ) == 0x778
 00213   396   NtUserQueryWindow  (65660, 1, ... ) == 0x77c
 00214   396   NtUserQueryWindow  (65574, 0, ... ) == 0x268
 00215   396   NtUserQueryWindow  (65574, 1, ... ) == 0x2c4
 00216   396   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {616, 0}, ... 52, ) == 0x0
 00217   396   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 64, ) , 64, ) == 0x0
 00218   396   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...  (52, 0x4b1c86, 4, ... "\0\0\0\0", 4, ) , 4, ) == 0x0
 00219   396   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...  (52, 0x4c91a0, 256, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, ) , 256, ) == 0x0
 00220   396   NtClose  (52, ... ) == 0x0
 00221   396   NtUserQueryWindow  (65726, 0, ... ) == 0x7e8
 00222   396   NtUserQueryWindow  (65726, 1, ... ) == 0x7ec
 00223   396   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {2024, 0}, ... 52, ) == 0x0
 00224   396   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0", 64, ) , 64, ) == 0x0
 00225   396   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...  (52, 0x4b1c86, 4, ... "\377\0\377\377", 4, ) , 4, ) == 0x0
 00226   396   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...  (52, 0x4c91a0, 256, ... "\210fvx\210x\206wfvGe$\306d\21\26\210ls\210\210\250g\207\210hhx\207xhvwdfF|d\21\27\210\206hx\250\252\206\210\207v\207\210x\207\207gfv4F\306G\21\21\210\206\207\210\212\250\250h\210\207x\210\210wvwgFD$d!\21\21x\250g\210\212\252\250\206\210\207w\210\207\207wvvgBGd\21\21\21\210\212\203\210\250\252\212\210x\210w\210\210xwgcd%F\1\21\21\21\27\212\250\210\212\252\252\210f\210\207x\210\207w7fR@`\21\21\21\21\21\210\2508\212\252\250\250\210gw\21088vvu$$!\21\21\21\21\21\30\210\210\210\212\252\210\206vgw\210\203wsb`\7\21\21\21\21\21\21\21\210\203\210\210\210\210\207vvwwwsf4\7\21\21\21\21\21\21\21\21\30\210\210\210\210\210wGwvwww5\2\21\21\21\21\21\21", 256, ) , 256, ) == 0x0
 00227   396   NtClose  (52, ... ) == 0x0
 00228   396   NtUserQueryWindow  (65724, 0, ... ) == 0x7e8
 00229   396   NtUserQueryWindow  (65724, 1, ... ) == 0x7ec
 00230   396   NtUserQueryWindow  (65722, 0, ... ) == 0x7e8
 00231   396   NtUserQueryWindow  (65722, 1, ... ) == 0x7ec
 00232   396   NtUserQueryWindow  (65720, 0, ... ) == 0x7e8
 00233   396   NtUserQueryWindow  (65720, 1, ... ) == 0x7ec
 00234   396   NtUserQueryWindow  (65718, 0, ... ) == 0x7e8
 00235   396   NtUserQueryWindow  (65718, 1, ... ) == 0x7ec
 00236   396   NtUserQueryWindow  (65716, 0, ... ) == 0x7e8
 00237   396   NtUserQueryWindow  (65716, 1, ... ) == 0x7ec
 00238   396   NtUserQueryWindow  (65712, 0, ... ) == 0x7e8
 00239   396   NtUserQueryWindow  (65712, 1, ... ) == 0x7ec
 00240   396   NtUserQueryWindow  (65710, 0, ... ) == 0x7e8
 00241   396   NtUserQueryWindow  (65710, 1, ... ) == 0x7ec
 00242   396   NtUserQueryWindow  (131172, 0, ... ) == 0x7f4
 00243   396   NtUserQueryWindow  (131172, 1, ... ) == 0x7f8
 00244   396   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {2036, 0}, ... 52, ) == 0x0
 00245   396   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "\301\0\0\0\0\1\0\0\377\356\377\356\11\0\0\0\11\0\0\0\0\376\0\0\0\0\20\0\0 \0\0\0\2\0\0\0 \0\0q\0\0\0\377\357\375\177\0\0\10\6\0\0\0\0\0\0\0\0\0\0\0\0", 64, ) , 64, ) == 0x0
 00246   396   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...  (52, 0x4b1c86, 4, ... "\0\0\0\0", 4, ) , 4, ) == 0x0
 00247   396   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...  (52, 0x4c91a0, 256, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, ) , 256, ) == 0x0
 00248   396   NtClose  (52, ... ) == 0x0
 00249   396   NtUserQueryWindow  (65708, 0, ... ) == 0x7e0
 00250   396   NtUserQueryWindow  (65708, 1, ... ) == 0x7e4
 00251   396   NtUserQueryWindow  (131166, 0, ... ) == 0x7d8
 00252   396   NtUserQueryWindow  (131166, 1, ... ) == 0x7dc
 00253   396   NtOpenProcess  (0x10, {24, 0, 0x0, 0, 0, 0x0}, {2008, 0}, ... 52, ) == 0x0
 00254   396   NtReadVirtualMemory  (52, 0x400000, 64, ...  (52, 0x400000, 64, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0", 64, ) , 64, ) == 0x0
 00255   396   NtReadVirtualMemory  (52, 0x4b1c86, 4, ...
 00256   396   NtContinue  (-128869220, 0, ...
 00255   396   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00257   396   NtReadVirtualMemory  (52, 0x4c91a0, 256, ...
 00258   396   NtContinue  (-128869220, 0, ...
 00257   396   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00259   396   NtClose  (52, ... ) == 0x0
 00260   396   NtUserQueryWindow  (65644, 0, ... ) == 0x778
 00261   396   NtUserQueryWindow  (65644, 1, ... ) == 0x7b4
 00262   396   NtUserQueryWindow  (327752, 0, ... ) == 0x778
 00263   396   NtUserQueryWindow  (327752, 1, ... ) == 0x77c
 00264   396   NtUserQueryWindow  (262220, 0, ... ) == 0x778
 00265   396   NtUserQueryWindow  (262220, 1, ... ) == 0x77c
 00266   396   NtUserQueryWindow  (589866, 0, ... ) == 0x778
 00267   396   NtUserQueryWindow  (589866, 1, ... ) == 0x77c
 00268   396   NtUserQueryWindow  (65662, 0, ... ) == 0x778
 00269   396   NtUserQueryWindow  (65662, 1, ... ) == 0x77c
 00270   396   NtUserQueryWindow  (65654, 0, ... ) == 0x778
 00271   396   NtUserQueryWindow  (65654, 1, ... ) == 0x77c
 00272   396   NtRaiseException  (1242720, 1241980, 1, ...
 00273   396   NtContinue  (1240776, 0, ...
 00274   396   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 52, ) }, ... 52, ) == 0x0
 00275   396   NtOpenMutant  (0x120001, {24, 52, 0x2, 0, 0,  (0x120001, {24, 52, 0x2, 0, 0, "DBWinMutex"}, ... 56, ) }, ... 56, ) == 0x0
 00276   396   NtWaitForSingleObject  (56, 0, 0x0, ... ) == 0x0
 00277   396   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "DBWIN_BUFFER"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00278   396   NtReleaseMutant  (56, ... 0x0, ) == 0x0
 00279   396   NtDuplicateObject  (-1, 3074, -1, 0x0, 0, 2, ... ) == STATUS_INVALID_HANDLE
 00280   396   NtClose  (0, ... ) == STATUS_INVALID_HANDLE
 00281   396   NtClose  (0, ... ) == STATUS_INVALID_HANDLE
 00282   396   NtTestAlert  (... ) == 0x0
 00283   396   NtContinue  (1244464, 1, ...
 00284   396   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x427b4b,}, 4, ... ) == 0x0
 00285   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 60, ) == 0x0
 00286   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 8716288, 1048576, ) == 0x0
 00287   396   NtAllocateVirtualMemory  (-1, 9756672, 0, 8192, 4096, 4, ... 9756672, 8192, ) == 0x0
 00288   396   NtProtectVirtualMemory  (-1, (0x94e000), 4096, 260, ... (0x94e000), 4096, 4, ) == 0x0
 00289   396   NtCreateThread  (0x1f03ff, 0x0, -1, 1244272, 1244988, 1, ... 64, {368, 364}, ) == 0x0
 00290   396   NtQueryInformationThread  (64, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=368,Tid=364,}, 0x0, ) == 0x0
 00291   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 65973, 4128831}  (24, {28, 56, new_msg, 0, 0, 0, 65973, 4128831} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0l\1\0\0" ... {28, 56, reply, 0, 368, 396, 1497, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0l\1\0\0" )  ... {28, 56, reply, 0, 368, 396, 1497, 0}  (24, {28, 56, new_msg, 0, 0, 0, 65973, 4128831} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0l\1\0\0" ... {28, 56, reply, 0, 368, 396, 1497, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0l\1\0\0" )  ) == 0x0
 00292   396   NtResumeThread  (64, ... 1, ) == 0x0
 00293   364   NtTestAlert  (... ) == 0x0
 00294   364   NtContinue  (9764144, 1, ...
 00295   364   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00296   364   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00297   396   NtClose  (64, ... ) == 0x0
 00298   396   NtWaitForSingleObject  (60, 0, 0x0, ...
 00296   364   NtSetInformationThread  ... ) == 0x0
 00299   364   NtSetEvent  (60, ...
 00298   396   NtWaitForSingleObject  ... ) == 0x0
 00300   396   NtClose  (60, ... ) == 0x0
 00301   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 60, ) == 0x0
 00302   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9764864, 1048576, ) == 0x0
 00303   396   NtAllocateVirtualMemory  (-1, 10805248, 0, 8192, 4096, 4, ... 10805248, 8192, ) == 0x0
 00304   396   NtProtectVirtualMemory  (-1, (0xa4e000), 4096, 260, ... (0xa4e000), 4096, 4, ) == 0x0
 00305   396   NtCreateThread  (0x1f03ff, 0x0, -1, 1244272, 1244988, 1, ... 64, {368, 564}, ) == 0x0
 00306   396   NtQueryInformationThread  (64, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=368,Tid=564,}, 0x0, ) == 0x0
 00307   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 396, 1497, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1497, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\04\2\0\0" ... {28, 56, reply, 0, 368, 396, 1498, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\04\2\0\0" )  ... {28, 56, reply, 0, 368, 396, 1498, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1497, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\04\2\0\0" ... {28, 56, reply, 0, 368, 396, 1498, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\04\2\0\0" )  ) == 0x0
 00308   396   NtResumeThread  (64, ... 1, ) == 0x0
 00309   396   NtClose  (64, ... ) == 0x0
 00310   396   NtWaitForSingleObject  (60, 0, 0x0, ...
 00311   564   NtTestAlert  (... ) == 0x0
 00312   564   NtContinue  (10812720, 1, ...
 00313   564   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00314   564   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00299   364   NtSetEvent  ... 0x0, ) == 0x0
 00315   364   NtQueryInformationThread  (-2, AmILastThread, 4, ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 00316   364   NtTerminateThread  (0, 0, ...
 00314   564   NtSetInformationThread  ... ) == 0x0
 00317   564   NtSetEvent  (60, ...
 00310   396   NtWaitForSingleObject  ... ) == 0x0
 00318   396   NtClose  (60, ... ) == 0x0
 00319   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 60, ) == 0x0
 00320   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10813440, 1048576, ) == 0x0
 00321   396   NtAllocateVirtualMemory  (-1, 11853824, 0, 8192, 4096, 4, ... 11853824, 8192, ) == 0x0
 00322   396   NtProtectVirtualMemory  (-1, (0xb4e000), 4096, 260, ... (0xb4e000), 4096, 4, ) == 0x0
 00323   396   NtCreateThread  (0x1f03ff, 0x0, -1, 1244272, 1244988, 1, ... 64, {368, 384}, ) == 0x0
 00324   396   NtQueryInformationThread  (64, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=368,Tid=384,}, 0x0, ) == 0x0
 00325   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 396, 1498, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1498, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0\200\1\0\0" ... {28, 56, reply, 0, 368, 396, 1499, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0\200\1\0\0" )  ... {28, 56, reply, 0, 368, 396, 1499, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1498, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0\200\1\0\0" ... {28, 56, reply, 0, 368, 396, 1499, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0\200\1\0\0" )  ) == 0x0
 00326   396   NtResumeThread  (64, ... 1, ) == 0x0
 00327   396   NtClose  (64, ... ) == 0x0
 00328   396   NtWaitForSingleObject  (60, 0, 0x0, ...
 00329   384   NtTestAlert  (... ) == 0x0
 00330   384   NtContinue  (11861296, 1, ...
 00331   384   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00332   384   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00317   564   NtSetEvent  ... 0x0, ) == 0x0
 00333   564   NtQueryInformationThread  (-2, AmILastThread, 4, ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 00334   564   NtTerminateThread  (0, 0, ...
 00335   564   NtFreeVirtualMemory  (-1, (0x950000), 0, 32768, ... (0x950000), 1048576, ) == 0x0
 00336   364   NtFreeVirtualMemory  (-1, (0x850000), 0, 32768, ... (0x850000), 1048576, ) == 0x0
 00332   384   NtSetInformationThread  ... ) == 0x0
 00337   384   NtSetEvent  (60, ...
 00328   396   NtWaitForSingleObject  ... ) == 0x0
 00338   396   NtClose  (60, ... ) == 0x0
 00339   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 60, ) == 0x0
 00340   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 8716288, 1048576, ) == 0x0
 00341   396   NtAllocateVirtualMemory  (-1, 9756672, 0, 8192, 4096, 4, ... 9756672, 8192, ) == 0x0
 00342   396   NtProtectVirtualMemory  (-1, (0x94e000), 4096, 260, ... (0x94e000), 4096, 4, ) == 0x0
 00343   396   NtCreateThread  (0x1f03ff, 0x0, -1, 1244272, 1244988, 1, ... 64, {368, 380}, ) == 0x0
 00344   396   NtQueryInformationThread  (64, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=368,Tid=380,}, 0x0, ) == 0x0
 00345   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 396, 1499, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1499, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0|\1\0\0" ... {28, 56, reply, 0, 368, 396, 1502, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0|\1\0\0" )  ... {28, 56, reply, 0, 368, 396, 1502, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1499, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0|\1\0\0" ... {28, 56, reply, 0, 368, 396, 1502, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0|\1\0\0" )  ) == 0x0
 00346   396   NtResumeThread  (64, ... 1, ) == 0x0
 00347   396   NtClose  (64, ... ) == 0x0
 00348   396   NtWaitForSingleObject  (60, 0, 0x0, ...
 00349   380   NtTestAlert  (... ) == 0x0
 00350   380   NtContinue  (9764144, 1, ...
 00351   380   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00352   380   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00337   384   NtSetEvent  ... 0x0, ) == 0x0
 00353   384   NtContinue  (11861204, 0, ...
 00354   384   NtContinue  (11861204, 0, ...
 00355   384   NtContinue  (11861204, 0, ...
 00352   380   NtSetInformationThread  ... ) == 0x0
 00356   380   NtSetEvent  (60, ...
 00348   396   NtWaitForSingleObject  ... ) == 0x0
 00357   396   NtClose  (60, ... ) == 0x0
 00358   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 60, ) == 0x0
 00359   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9764864, 1048576, ) == 0x0
 00360   396   NtAllocateVirtualMemory  (-1, 10805248, 0, 8192, 4096, 4, ... 10805248, 8192, ) == 0x0
 00361   396   NtProtectVirtualMemory  (-1, (0xa4e000), 4096, 260, ... (0xa4e000), 4096, 4, ) == 0x0
 00362   396   NtCreateThread  (0x1f03ff, 0x0, -1, 1244272, 1244988, 1, ... 64, {368, 568}, ) == 0x0
 00363   396   NtQueryInformationThread  (64, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=368,Tid=568,}, 0x0, ) == 0x0
 00364   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 396, 1502, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1502, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\08\2\0\0" ... {28, 56, reply, 0, 368, 396, 1503, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\08\2\0\0" )  ... {28, 56, reply, 0, 368, 396, 1503, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1502, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\08\2\0\0" ... {28, 56, reply, 0, 368, 396, 1503, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\08\2\0\0" )  ) == 0x0
 00365   396   NtResumeThread  (64, ... 1, ) == 0x0
 00366   396   NtClose  (64, ... ) == 0x0
 00367   396   NtWaitForSingleObject  (60, 0, 0x0, ...
 00368   568   NtTestAlert  (... ) == 0x0
 00369   568   NtContinue  (10812720, 1, ...
 00370   568   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00371   568   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00356   380   NtSetEvent  ... 0x0, ) == 0x0
 00372   380   NtQueryInformationThread  (-2, AmILastThread, 4, ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 00373   380   NtTerminateThread  (0, 0, ...
 00374   380   NtFreeVirtualMemory  (-1, (0x850000), 0, 32768, ... (0x850000), 1048576, ) == 0x0
 00375   384   NtContinue  (11861204, 0, ...
 00376   384   NtContinue  (11861204, 0, ...
 00377   384   NtContinue  (11861204, 0, ...
 00378   384   NtContinue  (11861204, 0, ...
 00379   384   NtContinue  (11861204, 0, ...
 00380   384   NtContinue  (11861204, 0, ...
 00371   568   NtSetInformationThread  ... ) == 0x0
 00381   568   NtSetEvent  (60, ...
 00367   396   NtWaitForSingleObject  ... ) == 0x0
 00382   396   NtClose  (60, ... ) == 0x0
 00383   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 60, ) == 0x0
 00384   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 8716288, 1048576, ) == 0x0
 00385   396   NtAllocateVirtualMemory  (-1, 9756672, 0, 8192, 4096, 4, ... 9756672, 8192, ) == 0x0
 00386   396   NtProtectVirtualMemory  (-1, (0x94e000), 4096, 260, ... (0x94e000), 4096, 4, ) == 0x0
 00387   396   NtCreateThread  (0x1f03ff, 0x0, -1, 1244272, 1244988, 1, ... 64, {368, 572}, ) == 0x0
 00388   396   NtQueryInformationThread  (64, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=368,Tid=572,}, 0x0, ) == 0x0
 00389   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 396, 1503, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1503, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0<\2\0\0" ... {28, 56, reply, 0, 368, 396, 1505, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0<\2\0\0" )  ... {28, 56, reply, 0, 368, 396, 1505, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1503, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0<\2\0\0" ... {28, 56, reply, 0, 368, 396, 1505, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\0\0\0p\1\0\0<\2\0\0" )  ) == 0x0
 00390   396   NtResumeThread  (64, ... 1, ) == 0x0
 00391   396   NtClose  (64, ... ) == 0x0
 00392   396   NtWaitForSingleObject  (60, 0, 0x0, ...
 00393   572   NtTestAlert  (... ) == 0x0
 00394   572   NtContinue  (9764144, 1, ...
 00395   572   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00396   572   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00381   568   NtSetEvent  ... 0x0, ) == 0x0
 00397   568   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 64, ) == 0x0
 00398   568   NtCallbackReturn  (0, 0, 0, ...
 00399   568   NtUserFindWindowEx  (0, 0,  (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 00400   568   NtUserFindWindowEx  (0, 0,  (0, 0, "WispWindowClass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0
 00401   568   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 68, ) == 0x0
 00402   384   NtContinue  (11861204, 0, ...
 00396   572   NtSetInformationThread  ... ) == 0x0
 00403   384   NtContinue  (11861204, 0, ...
 00404   572   NtSetEvent  (60, ...
 00405   384   NtContinue  (11861204, 0, ...
 00392   396   NtWaitForSingleObject  ... ) == 0x0
 00404   572   NtSetEvent  ... 0x0, ) == 0x0
 00406   396   NtClose  (60, ...
 00407   384   NtContinue  (11861204, 0, ...
 00406   396   NtClose  ... ) == 0x0
 00408   572   NtQueryInformationThread  (-2, AmILastThread, 4, ...
 00409   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00410   384   NtContinue  (11861204, 0, ...
 00409   396   NtCreateEvent  ... 60, ) == 0x0
 00408   572   NtQueryInformationThread  ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 00411   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00412   384   NtContinue  (11861204, 0, ...
 00411   396   NtAllocateVirtualMemory  ... 11862016, 1048576, ) == 0x0
 00413   572   NtTerminateThread  (0, 0, ...
 00414   568   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00415   396   NtAllocateVirtualMemory  (-1, 12902400, 0, 8192, 4096, 4, ...
 00416   384   NtContinue  (11861204, 0, ...
 00415   396   NtAllocateVirtualMemory  ... 12902400, 8192, ) == 0x0
 00414   568   NtAllocateVirtualMemory  ... 12910592, 1048576, ) == 0x0
 00417   396   NtProtectVirtualMemory  (-1, (0xc4e000), 4096, 260, ...
 00418   384   NtContinue  (11861204, 0, ...
 00417   396   NtProtectVirtualMemory  ... (0xc4e000), 4096, 4, ) == 0x0
 00419   568   NtAllocateVirtualMemory  (-1, 13950976, 0, 8192, 4096, 4, ...
 00420   396   NtCreateThread  (0x1f03ff, 0x0, -1, 1244272, 1244988, 1, ...
 00421   384   NtContinue  (11861204, 0, ...
 00420   396   NtCreateThread  ... 72, {368, 584}, ) == 0x0
 00419   568   NtAllocateVirtualMemory  ... 13950976, 8192, ) == 0x0
 00422   396   NtQueryInformationThread  (72, Basic, 28, ...
 00423   384   NtContinue  (11861204, 0, ...
 00422   396   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=368,Tid=584,}, 0x0, ) == 0x0
 00424   568   NtProtectVirtualMemory  (-1, (0xd4e000), 4096, 260, ...
 00425   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 396, 1505, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1505, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\0\0\0p\1\0\0H\2\0\0" ...  ...
 00426   384   NtContinue  (11861204, 0, ...
 00425   396   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 368, 396, 1506, 0}  ... {28, 56, reply, 0, 368, 396, 1506, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\0\0\0p\1\0\0H\2\0\0" )  ) == 0x0
 00424   568   NtProtectVirtualMemory  ... (0xd4e000), 4096, 4, ) == 0x0
 00427   396   NtResumeThread  (72, ...
 00428   384   NtContinue  (11861204, 0, ...
 00429   572   NtFreeVirtualMemory  (-1, (0x850000), 0, 32768, ...
 00427   396   NtResumeThread  ... 1, ) == 0x0
 00430   584   NtTestAlert  (...
 00431   568   NtCreateThread  (0x1f03ff, 0x0, -1, 10812468, 10813184, 1, ...
 00429   572   NtFreeVirtualMemory  ... (0x850000), 1048576, ) == 0x0
 00432   396   NtClose  (72, ...
 00430   584   NtTestAlert  ... ) == 0x0
 00432   396   NtClose  ... ) == 0x0
 00433   584   NtContinue  (12909872, 1, ...
 00434   396   NtWaitForSingleObject  (60, 0, 0x0, ...
 00435   584   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00436   584   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00431   568   NtCreateThread  ... 72, {368, 580}, ) == 0x0
 00437   568   NtQueryInformationThread  (72, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=368,Tid=580,}, 0x0, ) == 0x0
 00438   568   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 1329336, 0}  (24, {28, 56, new_msg, 0, 0, 0, 1329336, 0} "\0\0\0\0\1\0\1\0\20\0\0\0\351\0\0\0H\0\0\0p\1\0\0D\2\0\0" ... {28, 56, reply, 0, 368, 568, 1508, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\351\0\0\0H\0\0\0p\1\0\0D\2\0\0" )  ... {28, 56, reply, 0, 368, 568, 1508, 0}  (24, {28, 56, new_msg, 0, 0, 0, 1329336, 0} "\0\0\0\0\1\0\1\0\20\0\0\0\351\0\0\0H\0\0\0p\1\0\0D\2\0\0" ... {28, 56, reply, 0, 368, 568, 1508, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\351\0\0\0H\0\0\0p\1\0\0D\2\0\0" )  ) == 0x0
 00439   568   NtResumeThread  (72, ...
 00440   580   NtTestAlert  (... ) == 0x0
 00441   580   NtContinue  (13958448, 1, ...
 00442   580   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00443   580   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ... ) == 0x0
 00444   580   NtSetEvent  (68, ... 0x0, ) == 0x0
 00445   580   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 76, ) == 0x0
 00446   580   NtCallbackReturn  (0, 0, 0, ...
 00439   568   NtResumeThread  ... 1, ) == 0x0
 00447   384   NtContinue  (11861204, 0, ...
 00436   584   NtSetInformationThread  ... ) == 0x0
 00448   568   NtClose  (72, ...
 00449   384   NtContinue  (11861204, 0, ...
 00450   584   NtSetEvent  (60, ...
 00448   568   NtClose  ... ) == 0x0
 00451   384   NtContinue  (11861204, 0, ...
 00434   396   NtWaitForSingleObject  ... ) == 0x0
 00450   584   NtSetEvent  ... 0x0, ) == 0x0
 00452   568   NtWaitForSingleObject  (68, 0, 0x0, ...
 00453   396   NtClose  (60, ...
 00454   384   NtContinue  (11861204, 0, ...
 00455   584   NtContinue  (12907708, 0, ...
 00456   580   NtUserBuildHwndList  (0, 0, 0, 0, 64, ...
 00453   396   NtClose  ... ) == 0x0
 00457   384   NtContinue  (11861204, 0, ...
 00458   584   NtContinue  (12907708, 0, ...
 00459   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00456   580   NtUserBuildHwndList  ... (0x100aa, 0x100a8, 0x100a6, 0x20060, 0x100a4, 0x10080, 0x10074, 0x10068, 0x30042, 0x30046, 0x30044, 0x30034, 0x1009c, 0x1008c, 0x1007c, 0x10026, 0x100be, 0x100bc, 0x100ba, 0x100b8, 0x100b6, 0x100b4, 0x100b0, 0x100ae, 0x20064, 0x100ac, 0x2005e, 0x1006c, 0x50048, 0x4004c, 0x9002a, 0x1007e, 0x10076, 0x1, ), 34, ) == 0x0
 00460   384   NtContinue  (11861204, 0, ...
 00459   396   NtCreateEvent  ... 60, ) == 0x0
 00461   584   NtContinue  (12907708, 0, ...
 00462   580   NtUserQueryWindow  (65706, 0, ...
 00452   568   NtWaitForSingleObject  ... ) == 0x0
 00463   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00464   384   NtContinue  (11861204, 0, ...
 00462   580   NtUserQueryWindow  ... ) == 0x7e0
 00463   396   NtAllocateVirtualMemory  ... 8716288, 1048576, ) == 0x0
 00465   568   NtClose  (68, ...
 00466   384   NtContinue  (11861204, 0, ...
 00467   396   NtAllocateVirtualMemory  (-1, 9756672, 0, 8192, 4096, 4, ...
 00468   580   NtUserQueryWindow  (65706, 1, ...
 00465   568   NtClose  ... ) == 0x0
 00467   396   NtAllocateVirtualMemory  ... 9756672, 8192, ) == 0x0
 00469   384   NtContinue  (11861204, 0, ...
 00468   580   NtUserQueryWindow  ... ) == 0x7e4
 00470   396   NtProtectVirtualMemory  (-1, (0x94e000), 4096, 260, ...
 00471   568   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00472   384   NtContinue  (11861204, 0, ...
 00473   584   NtContinue  (12907708, 0, ...
 00470   396   NtProtectVirtualMemory  ... (0x94e000), 4096, 4, ) == 0x0
 00471   568   NtCreateEvent  ... 68, ) == 0x0
 00474   384   NtContinue  (11861204, 0, ...
 00475   396   NtCreateThread  (0x1f03ff, 0x0, -1, 1244272, 1244988, 1, ...
 00476   584   NtContinue  (12907708, 0, ...
 00477   580   NtUserQueryWindow  (65704, 0, ...
 00475   396   NtCreateThread  ... 72, {368, 588}, ) == 0x0
 00478   384   NtContinue  (11861204, 0, ...
 00479   584   NtContinue  (12907708, 0, ...
 00480   396   NtQueryInformationThread  (72, Basic, 28, ...
 00477   580   NtUserQueryWindow  ... ) == 0x7e0
 00481   568   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00480   396   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=368,Tid=588,}, 0x0, ) == 0x0
 00482   584   NtContinue  (12907708, 0, ...
 00483   580   NtUserQueryWindow  (65704, 1, ...
 00484   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 396, 1506, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1506, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\0\0\0p\1\0\0L\2\0\0" ...  ...
 00481   568   NtAllocateVirtualMemory  ... 13959168, 1048576, ) == 0x0
 00485   584   NtContinue  (12907708, 0, ...
 00484   396   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 368, 396, 1509, 0}  ... {28, 56, reply, 0, 368, 396, 1509, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\0\0\0p\1\0\0L\2\0\0" )  ) == 0x0
 00483   580   NtUserQueryWindow  ... ) == 0x7e4
 00486   568   NtAllocateVirtualMemory  (-1, 14999552, 0, 8192, 4096, 4, ...
 00487   396   NtResumeThread  (72, ...
 00488   584   NtContinue  (12907708, 0, ...
 00489   580   NtUserQueryWindow  (65702, 0, ...
 00487   396   NtResumeThread  ... 1, ) == 0x0
 00490   588   NtTestAlert  (...
 00486   568   NtAllocateVirtualMemory  ... 14999552, 8192, ) == 0x0
 00491   384   NtContinue  (11861204, 0, ...
 00492   396   NtClose  (72, ...
 00490   588   NtTestAlert  ... ) == 0x0
 00489   580   NtUserQueryWindow  ... ) == 0x7e0
 00493   568   NtProtectVirtualMemory  (-1, (0xe4e000), 4096, 260, ...
 00492   396   NtClose  ... ) == 0x0
 00494   588   NtContinue  (9764144, 1, ...
 00495   384   NtContinue  (11861204, 0, ...
 00496   584   NtContinue  (12907708, 0, ...
 00497   396   NtWaitForSingleObject  (60, 0, 0x0, ...
 00498   588   NtRegisterThreadTerminatePort  (24, ...
 00493   568   NtProtectVirtualMemory  ... (0xe4e000), 4096, 4, ) == 0x0
 00499   384   NtContinue  (11861204, 0, ...
 00498   588   NtRegisterThreadTerminatePort  ... ) == 0x0
 00500   584   NtContinue  (12907708, 0, ...
 00501   580   NtUserQueryWindow  (65702, 1, ...
 00502   588   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00503   384   NtContinue  (11861204, 0, ...
 00504   584   NtContinue  (12907708, 0, ...
 00501   580   NtUserQueryWindow  ... ) == 0x7e4
 00505   384   NtContinue  (11861204, 0, ...
 00506   584   NtContinue  (12907708, 0, ...
 00507   580   NtUserQueryWindow  (131168, 0, ...
 00508   384   NtContinue  (11861204, 0, ...
 00509   584   NtContinue  (12907708, 0, ...
 00507   580   NtUserQueryWindow  ... ) == 0x7e0
 00510   568   NtCreateThread  (0x1f03ff, 0x0, -1, 10812468, 10813184, 1, ...
 00502   588   NtSetInformationThread  ... ) == 0x0
 00511   584   NtContinue  (12907708, 0, ...
 00512   580   NtUserQueryWindow  (131168, 1, ...
 00510   568   NtCreateThread  ... 72, {368, 576}, ) == 0x0
 00513   588   NtSetEvent  (60, ...
 00514   384   NtContinue  (11861204, 0, ...
 00512   580   NtUserQueryWindow  ... ) == 0x7e4
 00515   568   NtQueryInformationThread  (72, Basic, 28, ...
 00497   396   NtWaitForSingleObject  ... ) == 0x0
 00513   588   NtSetEvent  ... 0x0, ) == 0x0
 00516   384   NtContinue  (11861204, 0, ...
 00517   584   NtContinue  (12907708, 0, ...
 00518   396   NtClose  (60, ...
 00515   568   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=368,Tid=576,}, 0x0, ) == 0x0
 00519   588   NtContinue  (9764056, 0, ...
 00520   384   NtContinue  (11861204, 0, ...
 00518   396   NtClose  ... ) == 0x0
 00521   584   NtContinue  (12907708, 0, ...
 00522   568   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 568, 1508, 0}  (24, {28, 56, new_msg, 0, 368, 568, 1508, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\351\0\0\0H\0\0\0p\1\0\0@\2\0\0" ...  ...
 00523   588   NtContinue  (9764056, 0, ...
 00524   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00525   384   NtContinue  (11861204, 0, ...
 00526   584   NtContinue  (12907708, 0, ...
 00524   396   NtCreateEvent  ... 60, ) == 0x0
 00527   588   NtContinue  (9764056, 0, ...
 00528   384   NtContinue  (11861204, 0, ...
 00529   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00530   584   NtContinue  (12907708, 0, ...
 00531   580   NtUserQueryWindow  (65700, 0, ...
 00522   568   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 368, 568, 1510, 0}  ... {28, 56, reply, 0, 368, 568, 1510, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\351\0\0\0H\0\0\0p\1\0\0@\2\0\0" )  ) == 0x0
 00529   396   NtAllocateVirtualMemory  ... 15007744, 1048576, ) == 0x0
 00532   384   NtContinue  (11861204, 0, ...
 00533   584   NtContinue  (12907708, 0, ...
 00531   580   NtUserQueryWindow  ... ) == 0x778
 00534   396   NtAllocateVirtualMemory  (-1, 16048128, 0, 8192, 4096, 4, ...
 00535   568   NtResumeThread  (72, ...
 00536   588   NtContinue  (9764056, 0, ...
 00537   584   NtContinue  (12907708, 0, ...
 00534   396   NtAllocateVirtualMemory  ... 16048128, 8192, ) == 0x0
 00538   580   NtUserQueryWindow  (65700, 1, ...
 00539   576   NtTestAlert  (...
 00535   568   NtResumeThread  ... 1, ) == 0x0
 00540   588   NtContinue  (9764056, 0, ...
 00541   384   NtContinue  (11861204, 0, ...
 00542   396   NtProtectVirtualMemory  (-1, (0xf4e000), 4096, 260, ...
 00539   576   NtTestAlert  ... ) == 0x0
 00538   580   NtUserQueryWindow  ... ) == 0x788
 00543   568   NtClose  (72, ...
 00544   588   NtContinue  (9764056, 0, ...
 00542   396   NtProtectVirtualMemory  ... (0xf4e000), 4096, 4, ) == 0x0
 00545   576   NtContinue  (15007024, 1, ...
 00546   384   NtContinue  (11861204, 0, ...
 00547   580   NtUserQueryWindow  (65664, 0, ...
 00543   568   NtClose  ... ) == 0x0
 00548   576   NtRegisterThreadTerminatePort  (24, ...
 00549   396   NtCreateThread  (0x1f03ff, 0x0, -1, 1244272, 1244988, 1, ...
 00550   588   NtContinue  (9764056, 0, ...
 00551   384   NtContinue  (11861204, 0, ...
 00547   580   NtUserQueryWindow  ... ) == 0x778
 00548   576   NtRegisterThreadTerminatePort  ... ) == 0x0
 00549   396   NtCreateThread  ... 72, {368, 596}, ) == 0x0
 00552   568   NtWaitForSingleObject  (68, 0, 0x0, ...
 00553   588   NtContinue  (9764056, 0, ...
 00554   384   NtContinue  (11861204, 0, ...
 00555   584   NtContinue  (12907708, 0, ...
 00556   396   NtQueryInformationThread  (72, Basic, 28, ...
 00557   576   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00558   580   NtUserQueryWindow  (65664, 1, ...
 00559   588   NtContinue  (9764056, 0, ...
 00560   384   NtContinue  (11861204, 0, ...
 00556   396   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=368,Tid=596,}, 0x0, ) == 0x0
 00561   584   NtContinue  (12907708, 0, ...
 00558   580   NtUserQueryWindow  ... ) == 0x788
 00557   576   NtSetInformationThread  ... ) == 0x0
 00562   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 396, 1509, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1509, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\0\0\0p\1\0\0T\2\0\0" ...  ...
 00563   384   NtContinue  (11861204, 0, ...
 00564   584   NtContinue  (12907708, 0, ...
 00565   580   NtUserQueryWindow  (65652, 0, ...
 00562   396   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 368, 396, 1511, 0}  ... {28, 56, reply, 0, 368, 396, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\0\0\0p\1\0\0T\2\0\0" )  ) == 0x0
 00566   576   NtSetEvent  (68, ...
 00567   588   NtContinue  (9764056, 0, ...
 00568   584   NtContinue  (12907708, 0, ...
 00569   396   NtResumeThread  (72, ...
 00565   580   NtUserQueryWindow  ... ) == 0x778
 00566   576   NtSetEvent  ... 0x0, ) == 0x0
 00570   588   NtContinue  (9764056, 0, ...
 00552   568   NtWaitForSingleObject  ... ) == 0x0
 00569   396   NtResumeThread  ... 1, ) == 0x0
 00571   596   NtTestAlert  (...
 00572   584   NtContinue  (12907708, 0, ...
 00573   580   NtUserQueryWindow  (65652, 1, ...
 00574   576   NtRaiseException  (15006840, 15006100, 1, ...
 00575   588   NtContinue  (9764056, 0, ...
 00576   396   NtClose  (72, ...
 00571   596   NtTestAlert  ... ) == 0x0
 00577   568   NtClose  (68, ...
 00578   584   NtContinue  (12907708, 0, ...
 00573   580   NtUserQueryWindow  ... ) == 0x788
 00579   576   NtContinue  (15004896, 0, ...
 00576   396   NtClose  ... ) == 0x0
 00580   596   NtContinue  (16055600, 1, ...
 00581   588   NtContinue  (9764056, 0, ...
 00577   568   NtClose  ... ) == 0x0
 00582   384   NtContinue  (11861204, 0, ...
 00583   584   NtContinue  (12907708, 0, ...
 00584   396   NtWaitForSingleObject  (60, 0, 0x0, ...
 00585   596   NtRegisterThreadTerminatePort  (24, ...
 00586   576   NtWaitForSingleObject  (56, 0, 0x0, ...
 00587   588   NtContinue  (9764056, 0, ...
 00588   568   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00589   384   NtContinue  (11861204, 0, ...
 00585   596   NtRegisterThreadTerminatePort  ... ) == 0x0
 00590   584   NtContinue  (12907708, 0, ...
 00591   580   NtUserQueryWindow  (65640, 0, ...
 00592   588   NtContinue  (9764056, 0, ...
 00588   568   NtCreateEvent  ... 68, ) == 0x0
 00593   596   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00594   384   NtContinue  (11861204, 0, ...
 00595   584   NtContinue  (12907708, 0, ...
 00591   580   NtUserQueryWindow  ... ) == 0x778
 00586   576   NtWaitForSingleObject  ... ) == 0x0
 00596   588   NtContinue  (9764056, 0, ...
 00597   384   NtContinue  (11861204, 0, ...
 00598   584   NtContinue  (12907708, 0, ...
 00599   580   NtUserQueryWindow  (65640, 1, ...
 00600   576   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "DBWIN_BUFFER"}, ... }, ...
 00601   588   NtContinue  (9764056, 0, ...
 00602   384   NtContinue  (11861204, 0, ...
 00603   584   NtContinue  (12907708, 0, ...
 00599   580   NtUserQueryWindow  ... ) == 0x788
 00600   576   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00604   588   NtContinue  (9764056, 0, ...
 00605   384   NtContinue  (11861204, 0, ...
 00606   584   NtContinue  (12907708, 0, ...
 00607   580   NtUserQueryWindow  (196674, 0, ...
 00608   576   NtReleaseMutant  (56, ...
 00609   588   NtContinue  (9764056, 0, ...
 00610   568   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00593   596   NtSetInformationThread  ... ) == 0x0
 00611   384   NtContinue  (11861204, 0, ...
 00607   580   NtUserQueryWindow  ... ) == 0x778
 00608   576   NtReleaseMutant  ... 0x0, ) == 0x0
 00612   588   NtContinue  (9764056, 0, ...
 00610   568   NtAllocateVirtualMemory  ... 16056320, 1048576, ) == 0x0
 00613   596   NtSetEvent  (60, ...
 00614   384   NtContinue  (11861204, 0, ...
 00615   584   NtContinue  (12907708, 0, ...
 00616   580   NtUserQueryWindow  (196674, 1, ...
 00617   588   NtContinue  (9764056, 0, ...
 00618   568   NtAllocateVirtualMemory  (-1, 17096704, 0, 8192, 4096, 4, ...
 00584   396   NtWaitForSingleObject  ... ) == 0x0
 00613   596   NtSetEvent  ... 0x0, ) == 0x0
 00619   384   NtContinue  (11861204, 0, ...
 00620   584   NtContinue  (12907708, 0, ...
 00616   580   NtUserQueryWindow  ... ) == 0x788
 00621   576   NtQueryInformationThread  (-2, AmILastThread, 4, ...
 00622   396   NtClose  (60, ...
 00618   568   NtAllocateVirtualMemory  ... 17096704, 8192, ) == 0x0
 00623   596   NtQueryInformationThread  (-2, AmILastThread, 4, ...
 00624   384   NtContinue  (11861204, 0, ...
 00625   584   NtContinue  (12907708, 0, ...
 00626   580   NtUserQueryWindow  (196678, 0, ...
 00622   396   NtClose  ... ) == 0x0
 00621   576   NtQueryInformationThread  ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 00627   568   NtProtectVirtualMemory  (-1, (0x104e000), 4096, 260, ...
 00623   596   NtQueryInformationThread  ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 00628   384   NtContinue  (11861204, 0, ...
 00629   584   NtContinue  (12907708, 0, ...
 00630   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00626   580   NtUserQueryWindow  ... ) == 0x778
 00631   576   NtTerminateThread  (0, 0, ...
 00627   568   NtProtectVirtualMemory  ... (0x104e000), 4096, 4, ) == 0x0
 00632   596   NtTerminateThread  (0, 0, ...
 00633   384   NtContinue  (11861204, 0, ...
 00630   396   NtCreateEvent  ... 60, ) == 0x0
 00634   584   NtContinue  (12907708, 0, ...
 00635   580   NtUserQueryWindow  (196678, 1, ...
 00636   576   NtFreeVirtualMemory  (-1, (0xd50000), 0, 32768, ...
 00637   588   NtContinue  (9764056, 0, ...
 00638   568   NtCreateThread  (0x1f03ff, 0x0, -1, 10812468, 10813184, 1, ...
 00639   596   NtFreeVirtualMemory  (-1, (0xe50000), 0, 32768, ...
 00640   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00641   584   NtContinue  (12907708, 0, ...
 00636   576   NtFreeVirtualMemory  ... (0xd50000), 1048576, ) == 0x0
 00635   580   NtUserQueryWindow  ... ) == 0x788
 00642   588   NtContinue  (9764056, 0, ...
 00639   596   NtFreeVirtualMemory  ... (0xe50000), 1048576, ) == 0x0
 00640   396   NtAllocateVirtualMemory  ... 13959168, 1048576, ) == 0x0
 00638   568   NtCreateThread  ... 72, {368, 636}, ) == 0x0
 00643   384   NtContinue  (11861204, 0, ...
 00644   584   NtContinue  (12907708, 0, ...
 00645   396   NtAllocateVirtualMemory  (-1, 14999552, 0, 8192, 4096, 4, ...
 00646   588   NtContinue  (9764056, 0, ...
 00647   568   NtQueryInformationThread  (72, Basic, 28, ...
 00648   384   NtContinue  (11861204, 0, ...
 00645   396   NtAllocateVirtualMemory  ... 14999552, 8192, ) == 0x0
 00649   584   NtContinue  (12907708, 0, ...
 00650   588   NtContinue  (9764056, 0, ...
 00647   568   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=368,Tid=636,}, 0x0, ) == 0x0
 00651   396   NtProtectVirtualMemory  (-1, (0xe4e000), 4096, 260, ...
 00652   384   NtContinue  (11861204, 0, ...
 00653   584   NtContinue  (12907708, 0, ...
 00654   588   NtContinue  (9764056, 0, ...
 00651   396   NtProtectVirtualMemory  ... (0xe4e000), 4096, 4, ) == 0x0
 00655   568   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 568, 1510, 0}  (24, {28, 56, new_msg, 0, 368, 568, 1510, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\351\0\0\0H\0\0\0p\1\0\0|\2\0\0" ...  ...
 00656   384   NtContinue  (11861204, 0, ...
 00657   584   NtContinue  (12907708, 0, ...
 00658   396   NtCreateThread  (0x1f03ff, 0x0, -1, 1244272, 1244988, 1, ...
 00659   588   NtContinue  (9764056, 0, ...
 00660   384   NtContinue  (11861204, 0, ...
 00658   396   NtCreateThread  ... 80, {368, 740}, ) == 0x0
 00661   584   NtContinue  (12907708, 0, ...
 00662   580   NtUserQueryWindow  (196676, 0, ...
 00655   568   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 368, 568, 1514, 0}  ... {28, 56, reply, 0, 368, 568, 1514, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\351\0\0\0H\0\0\0p\1\0\0|\2\0\0" )  ) == 0x0
 00663   396   NtQueryInformationThread  (80, Basic, 28, ...
 00664   384   NtContinue  (11861204, 0, ...
 00665   584   NtContinue  (12907708, 0, ...
 00662   580   NtUserQueryWindow  ... ) == 0x778
 00663   396   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=368,Tid=740,}, 0x0, ) == 0x0
 00666   568   NtResumeThread  (72, ...
 00667   588   NtContinue  (9764056, 0, ...
 00668   384   NtContinue  (11861204, 0, ...
 00669   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 396, 1511, 0}  (24, {28, 56, new_msg, 0, 368, 396, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\0\0\0p\1\0\0\344\2\0\0" ...  ...
 00670   580   NtUserQueryWindow  (196676, 1, ...
 00671   636   NtTestAlert  (...
 00666   568   NtResumeThread  ... 1, ) == 0x0
 00672   588   NtContinue  (9764056, 0, ...
 00669   396   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 368, 396, 1515, 0}  ... {28, 56, reply, 0, 368, 396, 1515, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\0\0\0p\1\0\0\344\2\0\0" )  ) == 0x0
 00673   384   NtContinue  (11861204, 0, ...
 00671   636   NtTestAlert  ... ) == 0x0
 00670   580   NtUserQueryWindow  ... ) == 0x788
 00674   568   NtClose  (72, ...
 00675   396   NtResumeThread  (80, ...
 00676   588   NtContinue  (9764056, 0, ...
 00677   636   NtContinue  (17104176, 1, ...
 00678   384   NtContinue  (11861204, 0, ...
 00679   580   NtUserQueryWindow  (196660, 0, ...
 00675   396   NtResumeThread  ... 1, ) == 0x0
 00680   740   NtTestAlert  (...
 00674   568   NtClose  ... ) == 0x0
 00681   584   NtContinue  (12907708, 0, ...
 00682   636   NtRegisterThreadTerminatePort  (24, ...
 00683   384   NtContinue  (11861204, 0, ...
 00684   396   NtClose  (80, ...
 00680   740   NtTestAlert  ... ) == 0x0
 00679   580   NtUserQueryWindow  ... ) == 0x778
 00685   568   NtWaitForSingleObject  (68, 0, 0x0, ...
 00682   636   NtRegisterThreadTerminatePort  ... ) == 0x0
 00686   584   NtContinue  (12907708, 0, ...
 00684   396   NtClose  ... ) == 0x0
 00687   740   NtContinue  (15007024, 1, ...
 00688   384   NtContinue  (11861204, 0, ...
 00689   588   NtContinue  (9764056, 0, ...
 00690   580   NtUserQueryWindow  (196660, 1, ...
 00691   636   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00692   396   NtWaitForSingleObject  (60, 0, 0x0, ...
 00693   740   NtRegisterThreadTerminatePort  (24, ...
 00694   584   NtContinue  (12907708, 0, ...
 00695   384   NtContinue  (11861204, 0, ...
 00696   588   NtContinue  (9764056, 0, ...
 00693   740   NtRegisterThreadTerminatePort  ... ) == 0x0
 00690   580   NtUserQueryWindow  ... ) == 0x788
 00697   584   NtContinue  (12907708, 0, ...
 00691   636   NtSetInformationThread  ... ) == 0x0
 00698   740   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00699   588   NtContinue  (9764056, 0, ...
 00700   580   NtUserQueryWindow  (65692, 0, ...
 00701   584   NtContinue  (12907708, 0, ...
 00702   636   NtSetEvent  (68, ...
 00703   588   NtContinue  (9764056, 0, ...
 00700   580   NtUserQueryWindow  ... ) == 0x778
 00704   584   NtContinue  (12907708, 0, ...
 00702   636   NtSetEvent  ... 0x0, ) == 0x0
 00705   588   NtContinue  (9764056, 0, ...
 00685   568   NtWaitForSingleObject  ... ) == 0x0
 00706   580   NtUserQueryWindow  (65692, 1, ...
 00707   384   NtContinue  (11861204, 0, ...
 00698   740   NtSetInformationThread  ... ) == 0x0
 00708   636   NtQueryInformationThread  (-2, AmILastThread, 4, ...
 00709   588   NtContinue  (9764056, 0, ...
 00710   568   NtClose  (68, ...
 00706   580   NtUserQueryWindow  ... ) == 0x788
 00711   384   NtContinue  (11861204, 0, ...
 00712   740   NtSetEvent  (60, ...
 00708   636   NtQueryInformationThread  ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 00713   584   NtContinue  (12907708, 0, ...
 00710   568   NtClose  ... ) == 0x0
 00714   588   NtContinue  (9764056, 0, ...
 00715   384   NtContinue  (11861204, 0, ...
 00692   396   NtWaitForSingleObject  ... ) == 0x0
 00712   740   NtSetEvent  ... 0x0, ) == 0x0
 00716   636   NtTerminateThread  (0, 0, ...
 00717   584   NtContinue  (12907708, 0, ...
 00718   568   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00719   588   NtContinue  (9764056, 0, ...
 00720   396   NtClose  (60, ...
 00721   384   NtContinue  (11861204, 0, ...
 00722   740   NtQueryInformationThread  (-2, AmILastThread, 4, ...
 00723   580   NtUserQueryWindow  (65676, 0, ...
 00724   584   NtContinue  (12907708, 0, ...
 00718   568   NtCreateEvent  ... 68, ) == 0x0
 00720   396   NtClose  ... ) == 0x0
 00725   588   NtContinue  (9764056, 0, ...
 00726   384   NtContinue  (11861204, 0, ...
 00722   740   NtQueryInformationThread  ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 00723   580   NtUserQueryWindow  ... ) == 0x778
 00727   584   NtContinue  (12907708, 0, ...
 00728   636   NtFreeVirtualMemory  (-1, (0xf50000), 0, 32768, ...
 00729   588   NtContinue  (9764056, 0, ...
 00730   396   NtAllocateVirtualMemory  (-1, 0, 0, 90087, 4096, 4, ...
 00731   384   NtContinue  (11861204, 0, ...
 00732   740   NtTerminateThread  (0, 0, ...
 00733   580   NtUserQueryWindow  (65676, 1, ...
 00728   636   NtFreeVirtualMemory  ... (0xf50000), 1048576, ) == 0x0
 00734   584   NtContinue  (12907708, 0, ...
 00730   396   NtAllocateVirtualMemory  ... 15007744, 90112, ) == 0x0
 00735   588   NtContinue  (9764056, 0, ...
 00736   568   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00737   384   NtContinue  (11861204, 0, ...
 00733   580   NtUserQueryWindow  ... ) == 0x788
 00738   396   NtFreeVirtualMemory  (-1, (0xe50000), 90087, 4, ...
 00739   584   NtContinue  (12907708, 0, ...
 00740   588   NtContinue  (9764056, 0, ...
 00736   568   NtAllocateVirtualMemory  ... 15138816, 1048576, ) == 0x0
 00741   384   NtContinue  (11861204, 0, ...
 00738   396   NtFreeVirtualMemory  ... ) == STATUS_INVALID_PARAMETER_4
 00742   580   NtUserQueryWindow  (65660, 0, ...
 00743   740   NtFreeVirtualMemory  (-1, (0xd50000), 0, 32768, ...
 00744   584   NtContinue  (12907708, 0, ...
 00745   568   NtAllocateVirtualMemory  (-1, 16179200, 0, 8192, 4096, 4, ...
 00746   396   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... }, ...
 00747   384   NtContinue  (11861204, 0, ...
 00743   740   NtFreeVirtualMemory  ... (0xd50000), 1048576, ) == 0x0
 00742   580   NtUserQueryWindow  ... ) == 0x778
 00748   584   NtContinue  (12907708, 0, ...
 00746   396   NtOpenKey  ... 60, ) == 0x0
 00745   568   NtAllocateVirtualMemory  ... 16179200, 8192, ) == 0x0
 00749   384   NtContinue  (11861204, 0, ...
 00750   588   NtContinue  (9764056, 0, ...
 00751   396   NtQueryValueKey  (60,  (60, "SafeDllSearchMode", Partial, 16, ... , Partial, 16, ...
 00752   584   NtContinue  (12907708, 0, ...
 00753   568   NtProtectVirtualMemory  (-1, (0xf6e000), 4096, 260, ...
 00754   384   NtContinue  (11861204, 0, ...
 00751   396   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00755   588   NtContinue  (9764056, 0, ...
 00756   584   NtContinue  (12907708, 0, ...
 00753   568   NtProtectVirtualMemory  ... (0xf6e000), 4096, 4, ) == 0x0
 00757   396   NtClose  (60, ...
 00758   384   NtContinue  (11861204, 0, ...
 00759   588   NtContinue  (9764056, 0, ...
 00760   584   NtContinue  (12907708, 0, ...
 00761   580   NtUserQueryWindow  (65660, 1, ...
 00757   396   NtClose  ... ) == 0x0
 00762   568   NtCreateThread  (0x1f03ff, 0x0, -1, 10812468, 10813184, 1, ...
 00763   588   NtContinue  (9764056, 0, ...
 00764   584   NtContinue  (12907708, 0, ...
 00765   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSVCRT.dll"}, ... }, ...
 00761   580   NtUserQueryWindow  ... ) == 0x77c
 00762   568   NtCreateThread  ... 60, {368, 744}, ) == 0x0
 00766   588   NtContinue  (9764056, 0, ...
 00767   384   NtContinue  (11861204, 0, ...
 00765   396   NtOpenSection  ... 80, ) == 0x0
 00768   580   NtUserQueryWindow  (65574, 0, ...
 00769   568   NtQueryInformationThread  (60, Basic, 28, ...
 00770   588   NtContinue  (9764056, 0, ...
 00771   396   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 00772   384   NtContinue  (11861204, 0, ...
 00768   580   NtUserQueryWindow  ... ) == 0x268
 00769   568   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=368,Tid=744,}, 0x0, ) == 0x0
 00773   584   NtContinue  (12907708, 0, ...
 00771   396   NtMapViewOfSection  ... (0x77c10000), 0x0, 339968, ) == 0x0
 00774   384   NtContinue  (11861204, 0, ...
 00775   580   NtUserQueryWindow  (65574, 1, ...
 00776   568   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 368, 568, 1514, 0}  (24, {28, 56, new_msg, 0, 368, 568, 1514, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\351\0\0\0<\0\0\0p\1\0\0\350\2\0\0" ...  ...
 00777   396   NtClose  (80, ...
 00778   584   NtContinue  (12907708, 0, ...
 00779   384   NtContinue  (11861204, 0, ...
 00775   580   NtUserQueryWindow  ... ) == 0x2c4
 00777   396   NtClose  ... ) == 0x0
 00780   584   NtContinue  (12907708, 0, ...
 00781   384   NtContinue  (11861204, 0, ...
 00782   588   NtContinue  (9764056, 0, ...
 00776   568   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 368, 568, 1518, 0}  ... {28, 56, reply, 0, 368, 568, 1518, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\351\0\0\0<\0\0\0p\1\0\0\350\2\0\0" )  ) == 0x0
 00783   396   NtQuerySystemInformation  (Basic, 44, ...
 00784   584   NtContinue  (12907708, 0, ...
 00785   384   NtContinue  (11861204, 0, ...
 00786   588   NtContinue  (9764056, 0, ...
 00783   396   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00787   568   NtResumeThread  (60, ...
 00788   584   NtContinue  (12907708, 0, ...
 00789   580   NtUserQueryWindow  (65726, 0, ...
 00790   396   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ...
 00791   588   NtContinue  (9764056, 0, ...
 00792   744   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00787   568   NtResumeThread  ... 1, ) == 0x0
 00793   584   NtContinue  (12907708, 0, ...
 00790   396   NtAllocateVirtualMemory  ... 13959168, 65536, ) == 0x0
 00789   580   NtUserQueryWindow  ... ) == 0x7e8
 00792   744   NtCreateEvent  ... 80, ) == 0x0
 00794   588   NtContinue  (9764056, 0, ...
 00795   568   NtClose  (60, ...
 00796   384   NtContinue  (11861204, 0, ...
 00797   396   NtAllocateVirtualMemory  (-1, 13959168, 0, 4096, 4096, 4, ...
 00798   744   NtWaitForSingleObject  (80, 0, 0x0, ...
 00799   580   NtUserQueryWindow  (65726, 1, ...
 00800   588   NtContinue  (9764056, 0, ...
 00795   568   NtClose  ... ) == 0x0
 00797   396   NtAllocateVirtualMemory  ... 13959168, 4096, ) == 0x0
 00801   384   NtContinue  (11861204, 0, ...
 00799   580   NtUserQueryWindow  ... ) == 0x7ec
 00802   588   NtContinue  (9764056, 0, ...
 00803   396   NtAllocateVirtualMemory  (-1, 13963264, 0, 8192, 4096, 4, ...
 00804   568   NtWaitForSingleObject  (68, 0, 0x0, ...
 00805   384   NtContinue  (11861204, 0, ...
 00806   580   NtUserQueryWindow  (65724, 0, ...
 00807   584   NtContinue  (12907708, 0, ...
 00803   396   NtAllocateVirtualMemory  ... 13963264, 8192, ) == 0x0
 00808   588   NtContinue  (9764056, 0, ...
 00809   384   NtContinue  (11861204, 0, ...
 00806   580   NtUserQueryWindow  ... ) == 0x7e8
 00810   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... }, ...
 00811   584   NtContinue  (12907708, 0, ...
 00812   588   NtContinue  (9764056, 0, ...
 00813   384   NtContinue  (11861204, 0, ...
 00810   396   NtOpenSection  ... 60, ) == 0x0
 00814   584   NtContinue  (12907708, 0, ...
 00815   588   NtContinue  (9764056, 0, ...
 00816   396   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ...
 00817   384   NtContinue  (11861204, 0, ...
 00818   584   NtContinue  (12907708, 0, ...
 00816   396   NtMapViewOfSection  ... (0xd60000), 0x0, 12288, ) == 0x0
 00819   588   NtContinue  (9764056, 0, ...
 00820   580   NtUserQueryWindow  (65724, 1, ...
 00821   396   NtClose  (60, ...
 00822   584   NtContinue  (12907708, 0, ...
 00823   588   NtContinue  (9764056, 0, ...
 00821   396   NtClose  ... ) == 0x0
 00820   580   NtUserQueryWindow  ... ) == 0x7ec
 00824   584   NtContinue  (12907708, 0, ...
 00825   396   NtAllocateVirtualMemory  (-1, 13971456, 0, 4096, 4096, 4, ...
 00826   588   NtContinue  (9764056, 0, ...
 00827   580   NtUserQueryWindow  (65722, 0, ...
 00828   384   NtContinue  (11861204, 0, ...
 00825   396   NtAllocateVirtualMemory  ... 13971456, 4096, ) == 0x0
 00829   584   NtContinue  (12907708, 0, ...
 00827   580   NtUserQueryWindow  ... ) == 0x7e8
 00830   396   NtSetEventBoostPriority  (80, ...
 00831   384   NtContinue  (11861204, 0, ...
 00832   584   NtContinue  (12907708, 0, ...
 00798   744   NtWaitForSingleObject  ... ) == 0x0
 00830   396   NtSetEventBoostPriority  ... ) == 0x0
 00833   580   NtUserQueryWindow  (65722, 1, ...
 00834   384   NtContinue  (11861204, 0, ...
 00835   744   NtTestAlert  (...
 00836   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... }, ...
 00837   584   NtContinue  (12907708, 0, ...
 00833   580   NtUserQueryWindow  ... ) == 0x7ec
 00835   744   NtTestAlert  ... ) == 0x0
 00836   396   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00838   384   NtContinue  (11861204, 0, ...
 00839   584   NtContinue  (12907708, 0, ...
 00840   588   NtContinue  (9764056, 0, ...
 00841   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1243056, ... }, 1243056, ...
 00842   744   NtContinue  (16186672, 1, ...
 00843   384   NtContinue  (11861204, 0, ...
 00844   584   NtContinue  (12907708, 0, ...
 00845   744   NtRegisterThreadTerminatePort  (24, ...
 00846   588   NtContinue  (9764056, 0, ...
 00847   384   NtContinue  (11861204, 0, ...
 00845   744   NtRegisterThreadTerminatePort  ... ) == 0x0
 00848   584   NtContinue  (12907708, 0, ...
 00849   588   NtContinue  (9764056, 0, ...
 00850   580   NtUserQueryWindow  (65720, 0, ...
 00851   744   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 00852   384   NtContinue  (11861204, 0, ...
 00853   588   NtContinue  (9764056, 0, ...
 00850   580   NtUserQueryWindow  ... ) == 0x7e8
 00854   384   NtContinue  (11861204, 0, ...
 00855   588   NtContinue  (9764056, 0, ...
 00856   580   NtUserQueryWindow  (65720, 1, ...
 00857   384   NtContinue  (11861204, 0, ...
 00858   588   NtContinue  (9764056, 0, ...
 00856   580   NtUserQueryWindow  ... ) == 0x7ec
 00859   384   NtContinue  (11861204, 0, ...
 00841   396   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00860   584   NtContinue  (12907708, 0, ...
 00851   744   NtSetInformationThread  ... ) == 0x0
 00861   580   NtUserQueryWindow  (65718, 0, ...
 00862   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2_32.dll"}, 1243056, ... }, 1243056, ...
 00863   384   NtContinue  (11861204, 0, ...
 00864   584   NtContinue  (12907708, 0, ...
 00865   744   NtSetEvent  (68, ...
 00861   580   NtUserQueryWindow  ... ) == 0x7e8
 00866   384   NtContinue  (11861204, 0, ...
 00867   584   NtContinue  (12907708, 0, ...
 00865   744   NtSetEvent  ... 0x0, ) == 0x0
 00804   568   NtWaitForSingleObject  ... ) == 0x0
 00868   588   NtContinue  (9764056, 0, ...
 00869   580   NtUserQueryWindow  (65718, 1, ...
 00870   584   NtContinue  (12907708, 0, ...
 00871   744   NtDuplicateObject  (-1, 3406, -1, 0x0, 0, 2, ...
 00872   568   NtClose  (68, ...
 00873   588   NtContinue  (9764056, 0, ...
 00869   580   NtUserQueryWindow  ... ) == 0x7ec
 00874   584   NtContinue  (12907708, 0, ...
 00871   744   NtDuplicateObject  ... ) == STATUS_INVALID_HANDLE
 00872   568   NtClose  ... ) == 0x0
 00875   588   NtContinue  (9764056, 0, ...
 00876   580   NtUserQueryWindow  (65716, 0, ...
 00877   584   NtContinue  (12907708, 0, ...
 00878   744   NtClose  (0, ...
 00879   568   NtQueryInformationThread  (-2, AmILastThread, 4, ...
 00880   588   NtContinue  (9764056, 0, ...
 00876   580   NtUserQueryWindow  ... ) == 0x7e8
 00881   384   NtContinue  (11861204, 0, ...
 00882   584   NtContinue  (12907708, 0, ...
 00879   568   NtQueryInformationThread  ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 00883   588   NtContinue  (9764056, 0, ...
 00884   580   NtUserQueryWindow  (65716, 1, ...
 00885   384   NtContinue  (11861204, 0, ...
 00886   584   NtContinue  (12907708, 0, ...
 00878   744   NtClose  ... ) == STATUS_INVALID_HANDLE
 00884   580   NtUserQueryWindow  ... ) == 0x7ec
 00887   384   NtContinue  (11861204, 0, ...
 00888   584   NtContinue  (12907708, 0, ...
 00889   744   NtClose  (0, ...
 00890   588   NtContinue  (9764056, 0, ...
 00891   568   NtWaitForSingleObject  (80, 0, 0x0, ...
 00892   384   NtContinue  (11861204, 0, ...
 00893   584   NtContinue  (12907708, 0, ...
 00889   744   NtClose  ... ) == STATUS_INVALID_HANDLE
 00894   588   NtContinue  (9764056, 0, ...
 00895   384   NtContinue  (11861204, 0, ...
 00896   584   NtContinue  (12907708, 0, ...
 00897   744   NtQueryInformationThread  (-2, AmILastThread, 4, ...
 00898   588   NtContinue  (9764056, 0, ...
 00899   384   NtContinue  (11861204, 0, ...
 00900   584   NtContinue  (12907708, 0, ...
 00897   744   NtQueryInformationThread  ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 00901   588   NtContinue  (9764056, 0, ...
 00902   580   NtUserQueryWindow  (65712, 0, ...
 00903   384   NtContinue  (11861204, 0, ...
 00904   744   NtWaitForSingleObject  (80, 0, 0x0, ...
 00905   588   NtContinue  (9764056, 0, ...
 00902   580   NtUserQueryWindow  ... ) == 0x7e8
 00906   384   NtContinue  (11861204, 0, ...
 00907   584   NtContinue  (12907708, 0, ...
 00908   588   NtContinue  (9764056, 0, ...
 00909   580   NtUserQueryWindow  (65712, 1, ...
 00910   384   NtContinue  (11861204, 0, ...
 00911   584   NtContinue  (12907708, 0, ...
 00909   580   NtUserQueryWindow  ... ) == 0x7ec
 00912   384   NtContinue  (11861204, 0, ...
 00913   584   NtContinue  (12907708, 0, ...
 00914   580   NtUserQueryWindow  (65710, 0, ...
 00915   384   NtContinue  (11861204, 0, ...
 00916   584   NtContinue  (12907708, 0, ...
 00914   580   NtUserQueryWindow  ... ) == 0x7e8
 00917   384   NtContinue  (11861204, 0, ...
 00918   584   NtContinue  (12907708, 0, ...
 00919   588   NtContinue  (9764056, 0, ...
 00920   580   NtUserQueryWindow  (65710, 1, ...
 00921   584   NtContinue  (12907708, 0, ...
 00922   588   NtContinue  (9764056, 0, ...
 00920   580   NtUserQueryWindow  ... ) == 0x7ec
 00923   384   NtContinue  (11861204, 0, ...
 00924   588   NtContinue  (9764056, 0, ...
 00925   580   NtUserQueryWindow  (131172, 0, ...
 00926   384   NtContinue  (11861204, 0, ...
 00927   588   NtContinue  (9764056, 0, ...
 00925   580   NtUserQueryWindow  ... ) == 0x7f4
 00862   396   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00928   384   NtContinue  (11861204, 0, ...
 00929   588   NtContinue  (9764056, 0, ...
 00930   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 1243056, ... }, 1243056, ...
 00931   580   NtUserQueryWindow  (131172, 1, ...
 00932   384   NtContinue  (11861204, 0, ...
 00930   396   NtQueryAttributesFile  ... ) == 0x0
 00933   588   NtContinue  (9764056, 0, ...
 00931   580   NtUserQueryWindow  ... ) == 0x7f8
 00934   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 5, 96, ... }, 5, 96, ...
 00935   384   NtContinue  (11861204, 0, ...
 00936   584   NtContinue  (12907708, 0, ...
 00937   588   NtContinue  (9764056, 0, ...
 00934   396   NtOpenFile  ... 68, {status=0x0, info=1}, ) == 0x0
 00938   384   NtContinue  (11861204, 0, ...
 00939   584   NtContinue  (12907708, 0, ...
 00940   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 68, ...
 00941   588   NtContinue  (9764056, 0, ...
 00942   580   NtUserQueryWindow  (65708, 0, ...
 00940   396   NtCreateSection  ... 60, ) == 0x0
 00943   584   NtContinue  (12907708, 0, ...
 00944   588   NtContinue  (9764056, 0, ...
 00945   396   NtQuerySection  (60, Image, 48, ...
 00942   580   NtUserQueryWindow  ... ) == 0x7e0
 00946   584   NtContinue  (12907708, 0, ...
 00945   396   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00947   588   NtContinue  (9764056, 0, ...
 00948   580   NtUserQueryWindow  (65708, 1, ...
 00949   396   NtOpenProcessToken  (-1, 0x8, ...
 00950   584   NtContinue  (12907708, 0, ...
 00951   588   NtContinue  (9764056, 0, ...
 00949   396   NtOpenProcessToken  ... 72, ) == 0x0
 00948   580   NtUserQueryWindow  ... ) == 0x7e4
 00952   584   NtContinue  (12907708, 0, ...
 00953   396   NtQueryInformationToken  (72, User, 136, ...
 00954   588   NtContinue  (9764056, 0, ...
 00955   580   NtUserQueryWindow  (131166, 0, ...
 00956   384   NtContinue  (11861204, 0, ...
 00953   396   NtQueryInformationToken  ... {token info, class 1, size 36}, 36, ) == 0x0
 00957   584   NtContinue  (12907708, 0, ...
 00955   580   NtUserQueryWindow  ... ) == 0x7d8
 00958   396   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... }, ...
 00959   384   NtContinue  (11861204, 0, ...
 00960   584   NtContinue  (12907708, 0, ...
 00961   588   NtContinue  (9764056, 0, ...
 00958   396   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00962   384   NtContinue  (11861204, 0, ...
 00963   584   NtContinue  (12907708, 0, ...
 00964   396   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... }, ...
 00965   588   NtContinue  (9764056, 0, ...
 00966   384   NtContinue  (11861204, 0, ...
 00964   396   NtOpenKey  ... 84, ) == 0x0
 00967   584   NtContinue  (12907708, 0, ...
 00968   588   NtContinue  (9764056, 0, ...
 00969   396   NtQueryValueKey  (84,  (84, "TransparentEnabled", Partial, 80, ... , Partial, 80, ...
 00970   384   NtContinue  (11861204, 0, ...
 00971   584   NtContinue  (12907708, 0, ...
 00969   396   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00972   588   NtContinue  (9764056, 0, ...
 00973   384   NtContinue  (11861204, 0, ...
 00974   396   NtClose  (84, ...
 00975   584   NtContinue  (12907708, 0, ...
 00976   588   NtContinue  (9764056, 0, ...
 00977   580   NtUserQueryWindow  (131166, 1, ...
 00974   396   NtClose  ... ) == 0x0
 00978   384   NtContinue  (11861204, 0, ...
 00979   588   NtContinue  (9764056, 0, ...
 00980   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ...
 00977   580   NtUserQueryWindow  ... ) == 0x7dc
 00981   384   NtContinue  (11861204, 0, ...
 00982   584   NtContinue  (12907708, 0, ...
 00980   396   NtOpenThreadTokenEx  ... ) == STATUS_NO_TOKEN
 00983   580   NtUserQueryWindow  (65644, 0, ...
 00984   384   NtContinue  (11861204, 0, ...
 00985   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ...
 00986   584   NtContinue  (12907708, 0, ...
 00983   580   NtUserQueryWindow  ... ) == 0x778
 00985   396   NtOpenProcessTokenEx  ... 84, ) == 0x0
 00987   384   NtContinue  (11861204, 0, ...
 00988   584   NtContinue  (12907708, 0, ...
 00989   396   NtQueryInformationToken  (84, User, 80, ...
 00990   580   NtUserQueryWindow  (65644, 1, ...
 00991   384   NtContinue  (11861204, 0, ...
 00989   396   NtQueryInformationToken  ... {token info, class 1, size 36}, 36, ) == 0x0
 00992   584   NtContinue  (12907708, 0, ...
 00990   580   NtUserQueryWindow  ... ) == 0x7b4
 00993   396   NtClose  (84, ...
 00994   384   NtContinue  (11861204, 0, ...
 00995   584   NtContinue  (12907708, 0, ...
 00996   588   NtContinue  (9764056, 0, ...
 00993   396   NtClose  ... ) == 0x0
 00997   580   NtUserQueryWindow  (327752, 0, ...
 00998   584   NtContinue  (12907708, 0, ...
 00999   396   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... }, ...
 01000   588   NtContinue  (9764056, 0, ...
 00997   580   NtUserQueryWindow  ... ) == 0x778
 01001   384   NtContinue  (11861204, 0, ...
 00999   396   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01002   588   NtContinue  (9764056, 0, ...
 01003   580   NtUserQueryWindow  (327752, 1, ...
 01004   396   NtClose  (72, ...
 01005   384   NtContinue  (11861204, 0, ...
 01006   588   NtContinue  (9764056, 0, ...
 01004   396   NtClose  ... ) == 0x0
 01003   580   NtUserQueryWindow  ... ) == 0x77c
 01007   384   NtContinue  (11861204, 0, ...
 01008   396   NtClose  (68, ...
 01009   588   NtContinue  (9764056, 0, ...
 01010   580   NtUserQueryWindow  (262220, 0, ...
 01008   396   NtClose  ... ) == 0x0
 01011   384   NtContinue  (11861204, 0, ...
 01012   588   NtContinue  (9764056, 0, ...
 01013   396   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01010   580   NtUserQueryWindow  ... ) == 0x778
 01014   384   NtContinue  (11861204, 0, ...
 01015   584   NtContinue  (12907708, 0, ...
 01013   396   NtMapViewOfSection  ... (0x71ab0000), 0x0, 86016, ) == 0x0
 01016   588   NtContinue  (9764056, 0, ...
 01017   384   NtContinue  (11861204, 0, ...
 01018   396   NtClose  (60, ...
 01019   584   NtContinue  (12907708, 0, ...
 01020   588   NtContinue  (9764056, 0, ...
 01021   580   NtUserQueryWindow  (262220, 1, ...
 01018   396   NtClose  ... ) == 0x0
 01022   584   NtContinue  (12907708, 0, ...
 01023   588   NtContinue  (9764056, 0, ...
 01024   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... }, ...
 01021   580   NtUserQueryWindow  ... ) == 0x77c
 01025   584   NtContinue  (12907708, 0, ...
 01024   396   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01026   588   NtContinue  (9764056, 0, ...
 01027   580   NtUserQueryWindow  (589866, 0, ...
 01028   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242252, ... }, 1242252, ...
 01029   584   NtContinue  (12907708, 0, ...
 01030   588   NtContinue  (9764056, 0, ...
 01027   580   NtUserQueryWindow  ... ) == 0x778
 01031   584   NtContinue  (12907708, 0, ...
 01032   588   NtContinue  (9764056, 0, ...
 01033   580   NtUserQueryWindow  (589866, 1, ...
 01034   384   NtContinue  (11861204, 0, ...
 01035   584   NtContinue  (12907708, 0, ...
 01033   580   NtUserQueryWindow  ... ) == 0x77c
 01036   384   NtContinue  (11861204, 0, ...
 01037   584   NtContinue  (12907708, 0, ...
 01038   588   NtContinue  (9764056, 0, ...
 01039   384   NtContinue  (11861204, 0, ...
 01040   584   NtContinue  (12907708, 0, ...
 01041   588   NtContinue  (9764056, 0, ...
 01042   384   NtContinue  (11861204, 0, ...
 01043   584   NtContinue  (12907708, 0, ...
 01044   588   NtContinue  (9764056, 0, ...
 01045   384   NtContinue  (11861204, 0, ...
 01046   584   NtContinue  (12907708, 0, ...
 01047   588   NtContinue  (9764056, 0, ...
 01048   384   NtContinue  (11861204, 0, ...
 01049   584   NtContinue  (12907708, 0, ...
 01050   588   NtContinue  (9764056, 0, ...
 01051   580   NtUserQueryWindow  (65662, 0, ...
 01052   384   NtContinue  (11861204, 0, ...
 01053   588   NtContinue  (9764056, 0, ...
 01051   580   NtUserQueryWindow  ... ) == 0x778
 01054   384   NtContinue  (11861204, 0, ...
 01055   584   NtContinue  (12907708, 0, ...
 01056   580   NtUserQueryWindow  (65662, 1, ...
 01057   384   NtContinue  (11861204, 0, ...
 01058   584   NtContinue  (12907708, 0, ...
 01056   580   NtUserQueryWindow  ... ) == 0x77c
 01059   384   NtContinue  (11861204, 0, ...
 01060   584   NtContinue  (12907708, 0, ...
 01061   580   NtUserQueryWindow  (65654, 0, ...
 01062   384   NtContinue  (11861204, 0, ...
 01063   584   NtContinue  (12907708, 0, ...
 01061   580   NtUserQueryWindow  ... ) == 0x778
 01064   384   NtContinue  (11861204, 0, ...
 01065   584   NtContinue  (12907708, 0, ...
 01066   588   NtContinue  (9764056, 0, ...
 01067   580   NtUserQueryWindow  (65654, 1, ...
 01068   584   NtContinue  (12907708, 0, ...
 01069   588   NtContinue  (9764056, 0, ...
 01067   580   NtUserQueryWindow  ... ) == 0x77c
 01070   384   NtContinue  (11861204, 0, ...
 01071   588   NtContinue  (9764056, 0, ...
 01072   580   NtQueryInformationThread  (-2, AmILastThread, 4, ...
 01073   384   NtContinue  (11861204, 0, ...
 01074   588   NtContinue  (9764056, 0, ...
 01072   580   NtQueryInformationThread  ... {thread info, class 12, size 4}, 0x0, ) == 0x0
 01075   384   NtContinue  (11861204, 0, ...
 01076   588   NtContinue  (9764056, 0, ...
 01077   580   NtWaitForSingleObject  (80, 0, 0x0, ...
 01028   396   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01078   384   NtContinue  (11861204, 0, ...
 01079   588   NtContinue  (9764056, 0, ...
 01080   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2HELP.dll"}, 1242252, ... }, 1242252, ...
 01081   384   NtContinue  (11861204, 0, ...
 01082   584   NtContinue  (12907708, 0, ...
 01083   384   NtContinue  (11861204, 0, ...
 01084   584   NtContinue  (12907708, 0, ...
 01085   588   NtContinue  (9764056, 0, ...
 01086   584   NtContinue  (12907708, 0, ...
 01087   588   NtContinue  (9764056, 0, ...
 01088   584   NtContinue  (12907708, 0, ...
 01089   588   NtContinue  (9764056, 0, ...
 01090   584   NtContinue  (12907708, 0, ...
 01091   588   NtContinue  (9764056, 0, ...
 01092   584   NtContinue  (12907708, 0, ...
 01093   588   NtContinue  (9764056, 0, ...
 01094   384   NtContinue  (11861204, 0, ...
 01095   588   NtContinue  (9764056, 0, ...
 01096   384   NtContinue  (11861204, 0, ...
 01097   584   NtContinue  (12907708, 0, ...
 01098   384   NtContinue  (11861204, 0, ...
 01099   584   NtContinue  (12907708, 0, ...
 01100   384   NtContinue  (11861204, 0, ...
 01101   584   NtContinue  (12907708, 0, ...
 01102   384   NtContinue  (11861204, 0, ...
 01103   584   NtContinue  (12907708, 0, ...
 01104   384   NtContinue  (11861204, 0, ...
 01105   584   NtContinue  (12907708, 0, ...
 01106   588   NtContinue  (9764056, 0, ...
 01107   584   NtContinue  (12907708, 0, ...
 01108   588   NtContinue  (9764056, 0, ...
 01109   384   NtContinue  (11861204, 0, ...
 01110   588   NtContinue  (9764056, 0, ...
 01111   384   NtContinue  (11861204, 0, ...
 01112   588   NtContinue  (9764056, 0, ...
 01113   384   NtContinue  (11861204, 0, ...
 01114   588   NtContinue  (9764056, 0, ...
 01115   384   NtContinue  (11861204, 0, ...
 01116   588   NtContinue  (9764056, 0, ...
 01117   384   NtContinue  (11861204, 0, ...
 01118   584   NtContinue  (12907708, 0, ...
 01119   384   NtContinue  (11861204, 0, ...
 01120   584   NtContinue  (12907708, 0, ...
 01121   588   NtContinue  (9764056, 0, ...
 01122   584   NtContinue  (12907708, 0, ...
 01123   588   NtContinue  (9764056, 0, ...
 01124   584   NtContinue  (12907708, 0, ...
 01125   588   NtContinue  (9764056, 0, ...
 01126   584   NtContinue  (12907708, 0, ...
 01127   588   NtContinue  (9764056, 0, ...
 01128   584   NtContinue  (12907708, 0, ...
 01129   588   NtContinue  (9764056, 0, ...
 01130   384   NtContinue  (11861204, 0, ...
 01131   588   NtContinue  (9764056, 0, ...
 01132   384   NtContinue  (11861204, 0, ...
 01133   584   NtContinue  (12907708, 0, ...
 01134   384   NtContinue  (11861204, 0, ...
 01135   584   NtContinue  (12907708, 0, ...
 01136   384   NtContinue  (11861204, 0, ...
 01137   584   NtContinue  (12907708, 0, ...
 01138   384   NtContinue  (11861204, 0, ...
 01139   584   NtContinue  (12907708, 0, ...
 01140   384   NtContinue  (11861204, 0, ...
 01141   584   NtContinue  (12907708, 0, ...
 01142   588   NtContinue  (9764056, 0, ...
 01143   584   NtContinue  (12907708, 0, ...
 01144   588   NtContinue  (9764056, 0, ...
 01145   384   NtContinue  (11861204, 0, ...
 01146   588   NtContinue  (9764056, 0, ...
 01147   384   NtContinue  (11861204, 0, ...
 01148   588   NtContinue  (9764056, 0, ...
 01149   384   NtContinue  (11861204, 0, ...
 01150   588   NtContinue  (9764056, 0, ...
 01151   384   NtContinue  (11861204, 0, ...
 01152   588   NtContinue  (9764056, 0, ...
 01153   384   NtContinue  (11861204, 0, ...
 01154   584   NtContinue  (12907708, 0, ...
 01155   384   NtContinue  (11861204, 0, ...
 01156   584   NtContinue  (12907708, 0, ...
 01157   588   NtContinue  (9764056, 0, ...
 01158   584   NtContinue  (12907708, 0, ...
 01159   588   NtContinue  (9764056, 0, ...
 01160   584   NtContinue  (12907708, 0, ...
 01161   588   NtContinue  (9764056, 0, ...
 01162   584   NtContinue  (12907708, 0, ...
 01163   588   NtContinue  (9764056, 0, ...
 01164   584   NtContinue  (12907708, 0, ...
 01165   588   NtContinue  (9764056, 0, ...
 01166   384   NtContinue  (11861204, 0, ...
 01167   588   NtContinue  (9764056, 0, ...
 01168   384   NtContinue  (11861204, 0, ...
 01169   584   NtContinue  (12907708, 0, ...
 01080   396   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01170   384   NtContinue  (11861204, 0, ...
 01171   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 1242252, ... }, 1242252, ...
 01172   584   NtContinue  (12907708, 0, ...
 01171   396   NtQueryAttributesFile  ... ) == 0x0
 01173   384   NtContinue  (11861204, 0, ...
 01174   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 5, 96, ... }, 5, 96, ...
 01175   584   NtContinue  (12907708, 0, ...
 01174   396   NtOpenFile  ... 60, {status=0x0, info=1}, ) == 0x0
 01176   384   NtContinue  (11861204, 0, ...
 01177   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 60, ...
 01178   584   NtContinue  (12907708, 0, ...
 01177   396   NtCreateSection  ... 68, ) == 0x0
 01179   384   NtContinue  (11861204, 0, ...
 01180   396   NtQuerySection  (68, Image, 48, ...
 01181   584   NtContinue  (12907708, 0, ...
 01182   588   NtContinue  (9764056, 0, ...
 01180   396   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01183   584   NtContinue  (12907708, 0, ...
 01184   396   NtClose  (60, ...
 01185   588   NtContinue  (9764056, 0, ...
 01186   384   NtContinue  (11861204, 0, ...
 01184   396   NtClose  ... ) == 0x0
 01187   588   NtContinue  (9764056, 0, ...
 01188   396   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01189   384   NtContinue  (11861204, 0, ...
 01188   396   NtMapViewOfSection  ... (0x71aa0000), 0x0, 32768, ) == 0x0
 01190   588   NtContinue  (9764056, 0, ...
 01191   396   NtClose  (68, ...
 01192   384   NtContinue  (11861204, 0, ...
 01191   396   NtClose  ... ) == 0x0
 01193   588   NtContinue  (9764056, 0, ...
 01194   396   NtQuerySystemInformation  (Basic, 44, ...
 01195   384   NtContinue  (11861204, 0, ...
 01194   396   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01196   588   NtContinue  (9764056, 0, ...
 01197   396   NtQuerySystemInformation  (Processor, 12, ...
 01198   384   NtContinue  (11861204, 0, ...
 01199   584   NtContinue  (12907708, 0, ...
 01197   396   NtQuerySystemInformation  ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01200   384   NtContinue  (11861204, 0, ...
 01201   396   NtSetEventBoostPriority  (80, ...
 01202   584   NtContinue  (12907708, 0, ...
 01203   588   NtContinue  (9764056, 0, ...
 00891   568   NtWaitForSingleObject  ... ) == 0x0
 01201   396   NtSetEventBoostPriority  ... ) == 0x0
 01204   584   NtContinue  (12907708, 0, ...
 01205   568   NtSetEventBoostPriority  (80, ...
 01206   396   NtWaitForSingleObject  (80, 0, 0x0, ...
 01207   588   NtContinue  (9764056, 0, ...
 00904   744   NtWaitForSingleObject  ... ) == 0x0
 01205   568   NtSetEventBoostPriority  ... ) == 0x0
 01208   584   NtContinue  (12907708, 0, ...
 01209   744   NtSetEventBoostPriority  (80, ...
 01210   588   NtContinue  (9764056, 0, ...
 01211   568   NtTerminateThread  (0, 0, ...
 01077   580   NtWaitForSingleObject  ... ) == 0x0
 01212   584   NtContinue  (12907708, 0, ...
 01213   588   NtContinue  (9764056, 0, ...
 01209   744   NtSetEventBoostPriority  ... ) == 0x0
 01214   384   NtContinue  (11861204, 0, ...
 01215   580   NtSetEventBoostPriority  (80, ...
 01216   584   NtContinue  (12907708, 0, ...
 01217   588   NtContinue  (9764056, 0, ...
 01218   744   NtTerminateThread  (0, 0, ...
 01219   384   NtContinue  (11861204, 0, ...
 01206   396   NtWaitForSingleObject  ... ) == 0x0
 01215   580   NtSetEventBoostPriority  ... ) == 0x0
 01220   568   NtFreeVirtualMemory  (-1, (0x950000), 0, 32768, ...
 01221   588   NtContinue  (9764056, 0, ...
 01222   744   NtFreeVirtualMemory  (-1, (0xe70000), 0, 32768, ...
 01223   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHELL32.dll"}, ... }, ...
 01224   384   NtContinue  (11861204, 0, ...
 01225   584   NtContinue  (12907708, 0, ...
 01220   568   NtFreeVirtualMemory  ... (0x950000), 1048576, ) == 0x0
 01226   580   NtTerminateThread  (0, 0, ...
 01222   744   NtFreeVirtualMemory  ... (0xe70000), 1048576, ) == 0x0
 01223   396   NtOpenSection  ... 64, ) == 0x0
 01227   384   NtContinue  (11861204, 0, ...
 01228   584   NtContinue  (12907708, 0, ...
 01229   396   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01230   580   NtFreeVirtualMemory  (-1, (0xc50000), 0, 32768, ...
 01231   384   NtContinue  (11861204, 0, ...
 01230   580   NtFreeVirtualMemory  ... (0xc50000), 1048576, ) == 0x0
 01229   396   NtMapViewOfSection  ... (0x773d0000), 0x0, 8339456, ) == 0x0
 01232   584   NtContinue  (12907708, 0, ...
 01233   396   NtClose  (64, ...
 01234   384   NtContinue  (11861204, 0, ...
 01233   396   NtClose  ... ) == 0x0
 01235   584   NtContinue  (12907708, 0, ...
 01236   588   NtContinue  (9764056, 0, ...
 01237   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... }, ...
 01238   584   NtContinue  (12907708, 0, ...
 01237   396   NtOpenSection  ... 64, ) == 0x0
 01239   588   NtContinue  (9764056, 0, ...
 01240   396   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01241   584   NtContinue  (12907708, 0, ...
 01240   396   NtMapViewOfSection  ... (0x772d0000), 0x0, 405504, ) == 0x0
 01242   588   NtContinue  (9764056, 0, ...
 01243   384   NtContinue  (11861204, 0, ...
 01244   396   NtClose  (64, ...
 01245   588   NtContinue  (9764056, 0, ...
 01244   396   NtClose  ... ) == 0x0
 01246   384   NtContinue  (11861204, 0, ...
 01247   396   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... }, ...
 01248   588   NtContinue  (9764056, 0, ...
 01247   396   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01249   384   NtContinue  (11861204, 0, ...
 01250   396   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... }, ...
 01251   588   NtContinue  (9764056, 0, ...
 01250   396   NtOpenKey  ... 64, ) == 0x0
 01252   384   NtContinue  (11861204, 0, ...
 01253   584   NtContinue  (12907708, 0, ...
 01254   396   NtQueryValueKey  (64,  (64, "SystemSetupInProgress", Partial, 144, ... , Partial, 144, ...
 01255   384   NtContinue  (11861204, 0, ...
 01254   396   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01256   584   NtContinue  (12907708, 0, ...
 01257   396   NtClose  (64, ...
 01258   384   NtContinue  (11861204, 0, ...
 01257   396   NtClose  ... ) == 0x0
 01259   584   NtContinue  (12907708, 0, ...
 01260   588   NtContinue  (9764056, 0, ...
 01261   396   NtQueryDefaultUILanguage  (1241412, ...
 01262   584   NtContinue  (12907708, 0, ...
 01263   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ...
 01264   588   NtContinue  (9764056, 0, ...
 01263   396   NtOpenThreadTokenEx  ... ) == STATUS_NO_TOKEN
 01265   584   NtContinue  (12907708, 0, ...
 01266   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ...
 01267   588   NtContinue  (9764056, 0, ...
 01266   396   NtOpenProcessTokenEx  ... -2147482020, ) == 0x0
 01268   584   NtContinue  (12907708, 0, ...
 01269   396   NtQueryInformationToken  (-2147482020, User, 80, ...
 01270   588   NtContinue  (9764056, 0, ...
 01271   384   NtContinue  (11861204, 0, ...
 01269   396   NtQueryInformationToken  ... {token info, class 1, size 36}, 36, ) == 0x0
 01272   588   NtContinue  (9764056, 0, ...
 01273   396   NtClose  (-2147482020, ...
 01274   384   NtContinue  (11861204, 0, ...
 01273   396   NtClose  ... ) == 0x0
 01275   588   NtContinue  (9764056, 0, ...
 01276   396   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... }, ...
 01277   384   NtContinue  (11861204, 0, ...
 01278   584   NtContinue  (12907708, 0, ...
 01276   396   NtOpenKey  ... -2147482020, ) == 0x0
 01279   384   NtContinue  (11861204, 0, ...
 01280   396   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... }, ...
 01281   584   NtContinue  (12907708, 0, ...
 01280   396   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01282   384   NtContinue  (11861204, 0, ...
 01283   396   NtOpenKey  (0x80000000, {24, -2147482020, 0x640, 0, 0,  (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... }, ...
 01284   584   NtContinue  (12907708, 0, ...
 01283   396   NtOpenKey  ... -2147482032, ) == 0x0
 01285   384   NtContinue  (11861204, 0, ...
 01286   396   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... , Partial, 256, ...
 01287   584   NtContinue  (12907708, 0, ...
 01288   588   NtContinue  (9764056, 0, ...
 01286   396   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01289   584   NtContinue  (12907708, 0, ...
 01290   396   NtClose  (-2147482032, ...
 01291   588   NtContinue  (9764056, 0, ...
 01290   396   NtClose  ... ) == 0x0
 01292   584   NtContinue  (12907708, 0, ...
 01293   396   NtClose  (-2147482020, ...
 01294   588   NtContinue  (9764056, 0, ...
 01295   384   NtContinue  (11861204, 0, ...
 01293   396   NtClose  ... ) == 0x0
 01296   588   NtContinue  (9764056, 0, ...
 01261   396   NtQueryDefaultUILanguage  ... ) == 0x0
 01297   384   NtContinue  (11861204, 0, ...
 01298   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... }, ...
 01299   588   NtContinue  (9764056, 0, ...
 01298   396   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01300   384   NtContinue  (11861204, 0, ...
 01301   396   NtQueryInstallUILanguage  (2012047340, ...
 01302   588   NtContinue  (9764056, 0, ...
 01301   396   NtQueryInstallUILanguage  ... ) == 0x0
 01303   384   NtContinue  (11861204, 0, ...
 01304   584   NtContinue  (12907708, 0, ...
 01305   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll"}, 1, 96, ... }, 1, 96, ...
 01306   384   NtContinue  (11861204, 0, ...
 01305   396   NtOpenFile  ... 64, {status=0x0, info=1}, ) == 0x0
 01307   584   NtContinue  (12907708, 0, ...
 01308   396   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 64, ...
 01309   384   NtContinue  (11861204, 0, ...
 01308   396   NtCreateSection  ... 76, ) == 0x0
 01310   584   NtContinue  (12907708, 0, ...
 01311   588   NtContinue  (9764056, 0, ...
 01312   396   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ...
 01313   584   NtContinue  (12907708, 0, ...
 01312   396   NtMapViewOfSection  ... (0xe70000), 0x0, 8323072, ) == 0x0
 01314   588   NtContinue  (9764056, 0, ...
 01315   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Manifest"}, 1, 96, ... }, 1, 96, ...
 01316   584   NtContinue  (12907708, 0, ...
 01315   396   NtOpenFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01317   588   NtContinue  (9764056, 0, ...
 01318   396   NtQueryDefaultUILanguage  (2013024600, ...
 01319   584   NtContinue  (12907708, 0, ...
 01320   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ...
 01321   588   NtContinue  (9764056, 0, ...
 01322   384   NtContinue  (11861204, 0, ...
 01320   396   NtOpenThreadTokenEx  ... ) == STATUS_NO_TOKEN
 01323   588   NtContinue  (9764056, 0, ...
 01324   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ...
 01325   384   NtContinue  (11861204, 0, ...
 01324   396   NtOpenProcessTokenEx  ... -2147482020, ) == 0x0
 01326   588   NtContinue  (9764056, 0, ...
 01327   396   NtQueryInformationToken  (-2147482020, User, 80, ...
 01328   384   NtContinue  (11861204, 0, ...
 01329   584   NtContinue  (12907708, 0, ...
 01327   396   NtQueryInformationToken  ... {token info, class 1, size 36}, 36, ) == 0x0
 01330   384   NtContinue  (11861204, 0, ...
 01331   396   NtClose  (-2147482020, ...
 01332   584   NtContinue  (12907708, 0, ...
 01331   396   NtClose  ... ) == 0x0
 01333   384   NtContinue  (11861204, 0, ...
 01334   396   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... }, ...
 01335   584   NtContinue  (12907708, 0, ...
 01334   396   NtOpenKey  ... -2147482020, ) == 0x0
 01336   384   NtContinue  (11861204, 0, ...
 01337   396   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... }, ...
 01338   584   NtContinue  (12907708, 0, ...
 01339   588   NtContinue  (9764056, 0, ...
 01337   396   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01340   584   NtContinue  (12907708, 0, ...
 01341   396   NtOpenKey  (0x80000000, {24, -2147482020, 0x640, 0, 0,  (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... }, ...
 01342   588   NtContinue  (9764056, 0, ...
 01341   396   NtOpenKey  ... -2147482032, ) == 0x0
 01343   584   NtContinue  (12907708, 0, ...
 01344   396   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... , Partial, 256, ...
 01345   588   NtContinue  (9764056, 0, ...
 01346   384   NtContinue  (11861204, 0, ...
 01344   396   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01347   588   NtContinue  (9764056, 0, ...
 01348   396   NtClose  (-2147482032, ...
 01349   384   NtContinue  (11861204, 0, ...
 01348   396   NtClose  ... ) == 0x0
 01350   588   NtContinue  (9764056, 0, ...
 01351   396   NtClose  (-2147482020, ...
 01352   384   NtContinue  (11861204, 0, ...
 01351   396   NtClose  ... ) == 0x0
 01353   588   NtContinue  (9764056, 0, ...
 01318   396   NtQueryDefaultUILanguage  ... ) == 0x0
 01354   384   NtContinue  (11861204, 0, ...
 01355   584   NtContinue  (12907708, 0, ...
 01356   396   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ...
 01357   384   NtContinue  (11861204, 0, ...
 01356   396   NtAllocateVirtualMemory  ... 1228800, 4096, ) == 0x0
 01358   584   NtContinue  (12907708, 0, ...
 01359   396   NtQueryInstallUILanguage  (2013024602, ...
 01360   384   NtContinue  (11861204, 0, ...
 01359   396   NtQueryInstallUILanguage  ... ) == 0x0
 01361   584   NtContinue  (12907708, 0, ...
 01362   588   NtContinue  (9764056, 0, ...
 01363   396   NtQueryDefaultLocale  (1, 1239448, ...
 01364   584   NtContinue  (12907708, 0, ...
 01363   396   NtQueryDefaultLocale  ... ) == 0x0
 01365   588   NtContinue  (9764056, 0, ...
 01366   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Config"}, 1, 96, ... }, 1, 96, ...
 01367   584   NtContinue  (12907708, 0, ...
 01366   396   NtOpenFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01368   588   NtContinue  (9764056, 0, ...
 01369   396   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1240304, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1240304, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\360\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1@\0\0\0\377\377\377\377\0\0\0\0\20\311\36\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\360\363\22\0\0\0\0\0" ...  ...
 01370   584   NtContinue  (12907708, 0, ...
 01369   396   NtRequestWaitReplyPort  ... {128, 156, reply, 0, 368, 396, 1522, 0}  ... {128, 156, reply, 0, 368, 396, 1522, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\360\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1@\0\0\0\377\377\377\377\0\0\0\0\20\311\36\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\360\363\22\0\0\0\0\0" )  ) == 0x0
 01371   588   NtContinue  (9764056, 0, ...
 01372   384   NtContinue  (11861204, 0, ...
 01373   396   NtClose  (64, ...
 01374   588   NtContinue  (9764056, 0, ...
 01373   396   NtClose  ... ) == 0x0
 01375   384   NtContinue  (11861204, 0, ...
 01376   396   NtClose  (76, ...
 01377   588   NtContinue  (9764056, 0, ...
 01376   396   NtClose  ... ) == 0x0
 01378   384   NtContinue  (11861204, 0, ...
 01379   584   NtContinue  (12907708, 0, ...
 01380   396   NtUnmapViewOfSection  (-1, 0xe70000, ...
 01381   384   NtContinue  (11861204, 0, ...
 01380   396   NtUnmapViewOfSection  ... ) == 0x0
 01382   584   NtContinue  (12907708, 0, ...
 01383   396   NtUnmapViewOfSection  (-1, 0x12f3f0, ...
 01384   384   NtContinue  (11861204, 0, ...
 01383   396   NtUnmapViewOfSection  ... ) == STATUS_NOT_MAPPED_VIEW
 01385   584   NtContinue  (12907708, 0, ...
 01386   396   NtQueryDebugFilterState  (53, 2, ...
 01387   384   NtContinue  (11861204, 0, ...
 01386   396   NtQueryDebugFilterState  ... ) == 0x0
 01388   584   NtContinue  (12907708, 0, ...
 01389   588   NtContinue  (9764056, 0, ...
 01390   396   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... }, ...
 01391   584   NtContinue  (12907708, 0, ...
 01390   396   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01392   588   NtContinue  (9764056, 0, ...
 01393   396   NtQueryDebugFilterState  (53, 2, ...
 01394   584   NtContinue  (12907708, 0, ...
 01393   396   NtQueryDebugFilterState  ... ) == 0x0
 01395   588   NtContinue  (9764056, 0, ...
 01396   384   NtContinue  (11861204, 0, ...
 01397   396   NtQueryDebugFilterState  (53, 2, ...
 01398   588   NtContinue  (9764056, 0, ...
 01397   396   NtQueryDebugFilterState  ... ) == 0x0
 01399   384   NtContinue  (11861204, 0, ...
 01400   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1238532, ... }, 1238532, ...
 01401   588   NtContinue  (9764056, 0, ...
 01402   384   NtContinue  (11861204, 0, ...
 01403   588   NtContinue  (9764056, 0, ...
 01404   384   NtContinue  (11861204, 0, ...
 01400   396   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01405   584   NtContinue  (12907708, 0, ...
 01406   396   NtQueryDebugFilterState  (53, 2, ...
 01407   384   NtContinue  (11861204, 0, ...
 01406   396   NtQueryDebugFilterState  ... ) == 0x0
 01408   584   NtContinue  (12907708, 0, ...
 01409   396   NtQueryDebugFilterState  (53, 2, ...
 01410   384   NtContinue  (11861204, 0, ...
 01409   396   NtQueryDebugFilterState  ... ) == 0x0
 01411   584   NtContinue  (12907708, 0, ...
 01412   588   NtContinue  (9764056, 0, ...
 01413   396   NtQueryDebugFilterState  (53, 2, ...
 01414   584   NtContinue  (12907708, 0, ...
 01413   396   NtQueryDebugFilterState  ... ) == 0x0
 01415   588   NtContinue  (9764056, 0, ...
 01416   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1239124, ... }, 1239124, ...
 01417   584   NtContinue  (12907708, 0, ...
 01416   396   NtQueryAttributesFile  ... ) == 0x0
 01418   588   NtContinue  (9764056, 0, ...
 01419   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... }, 3, 33, ...
 01420   584   NtContinue  (12907708, 0, ...
 01419   396   NtOpenFile  ... 76, {status=0x0, info=1}, ) == 0x0
 01421   588   NtContinue  (9764056, 0, ...
 01422   384   NtContinue  (11861204, 0, ...
 01423   396   NtQueryDebugFilterState  (53, 2, ...
 01424   588   NtContinue  (9764056, 0, ...
 01423   396   NtQueryDebugFilterState  ... ) == 0x0
 01425   384   NtContinue  (11861204, 0, ...
 01426   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... }, 5, 96, ...
 01427   588   NtContinue  (9764056, 0, ...
 01426   396   NtOpenFile  ... 64, {status=0x0, info=1}, ) == 0x0
 01428   384   NtContinue  (11861204, 0, ...
 01429   584   NtContinue  (12907708, 0, ...
 01430   396   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 64, ...
 01431   384   NtContinue  (11861204, 0, ...
 01430   396   NtCreateSection  ... 68, ) == 0x0
 01432   584   NtContinue  (12907708, 0, ...
 01433   396   NtClose  (64, ...
 01434   384   NtContinue  (11861204, 0, ...
 01433   396   NtClose  ... ) == 0x0
 01435   584   NtContinue  (12907708, 0, ...
 01436   396   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 01437   384   NtContinue  (11861204, 0, ...
 01436   396   NtMapViewOfSection  ... (0x960000), 0x0, 921600, ) == 0x0
 01438   584   NtContinue  (12907708, 0, ...
 01439   588   NtContinue  (9764056, 0, ...
 01440   396   NtClose  (68, ...
 01441   584   NtContinue  (12907708, 0, ...
 01440   396   NtClose  ... ) == 0x0
 01442   588   NtContinue  (9764056, 0, ...
 01443   396   NtUnmapViewOfSection  (-1, 0x960000, ...
 01444   584   NtContinue  (12907708, 0, ...
 01443   396   NtUnmapViewOfSection  ... ) == 0x0
 01445   588   NtContinue  (9764056, 0, ...
 01446   384   NtContinue  (11861204, 0, ...
 01447   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... }, 5, 96, ...
 01448   588   NtContinue  (9764056, 0, ...
 01447   396   NtOpenFile  ... 68, {status=0x0, info=1}, ) == 0x0
 01449   384   NtContinue  (11861204, 0, ...
 01450   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 68, ...
 01451   588   NtContinue  (9764056, 0, ...
 01450   396   NtCreateSection  ... 64, ) == 0x0
 01452   384   NtContinue  (11861204, 0, ...
 01453   396   NtQuerySection  (64, Image, 48, ...
 01454   588   NtContinue  (9764056, 0, ...
 01453   396   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01455   384   NtContinue  (11861204, 0, ...
 01456   584   NtContinue  (12907708, 0, ...
 01457   396   NtClose  (68, ...
 01458   384   NtContinue  (11861204, 0, ...
 01457   396   NtClose  ... ) == 0x0
 01459   584   NtContinue  (12907708, 0, ...
 01460   396   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01461   384   NtContinue  (11861204, 0, ...
 01460   396   NtMapViewOfSection  ... (0x71950000), 0x0, 933888, ) == 0x0
 01462   584   NtContinue  (12907708, 0, ...
 01463   588   NtContinue  (9764056, 0, ...
 01464   396   NtClose  (64, ... ) == 0x0
 01465   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 01466   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 01467   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 01468   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 01469   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 01470   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 01471   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 01472   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 01473   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 01474   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 01475   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 01476   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 01477   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 01478   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 01479   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 01480   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 01481   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 01482   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 01483   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 01484   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 01485   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 01486   396   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1240308, ... ) , 42, 1240308, ... ) == 0x0
 01487   396   NtQueryDefaultUILanguage  (1239024, ...
 01488   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01489   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482020, ) == 0x0
 01490   396   NtQueryInformationToken  (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01491   396   NtClose  (-2147482020, ... ) == 0x0
 01492   396   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 01493   396   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01494   396   NtOpenKey  (0x80000000, {24, -2147482020, 0x640, 0, 0,  (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 01495   396   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01496   396   NtClose  (-2147482032, ... ) == 0x0
 01497   396   NtClose  (-2147482020, ... ) == 0x0
 01487   396   NtQueryDefaultUILanguage  ... ) == 0x0
 01498   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01499   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237876, ... ) }, 1237876, ... ) == 0x0
 01500   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 01501   396   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 64, ... 68, ) == 0x0
 01502   396   NtClose  (64, ... ) == 0x0
 01503   396   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x960000), 0x0, 4096, ) == 0x0
 01504   396   NtClose  (68, ... ) == 0x0
 01505   396   NtUnmapViewOfSection  (-1, 0x960000, ... ) == 0x0
 01506   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237516, ... ) }, 1237516, ... ) == 0x0
 01507   396   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1238216,  (0x80100080, {24, 0, 0x40, 0, 1238216, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 68, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 68, {status=0x0, info=1}, ) == 0x0
 01508   396   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 68, ... 64, ) == 0x0
 01509   396   NtClose  (68, ... ) == 0x0
 01510   396   NtMapViewOfSection  (64, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x960000), {0, 0}, 4096, ) == 0x0
 01511   396   NtClose  (64, ... ) == 0x0
 01512   396   NtUnmapViewOfSection  (-1, 0x960000, ... ) == 0x0
 01513   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 64, {status=0x0, info=1}, ) }, 1, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 01514   396   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 64, ... 68, ) == 0x0
 01515   396   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x960000), 0x0, 4096, ) == 0x0
 01516   396   NtQueryInformationFile  (64, 1237836, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0
 01517   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01518   396   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237916, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237916, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1@\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\234\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 368, 396, 1523, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1@\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\234\352\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 368, 396, 1523, 0}  (24, {128, 156, new_msg, 0, 1237916, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1@\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\234\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 368, 396, 1523, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1@\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\234\352\22\0\0\0\0\0" )  ) == 0x0
 01519   396   NtClose  (64, ... ) == 0x0
 01520   396   NtClose  (68, ... ) == 0x0
 01521   396   NtUnmapViewOfSection  (-1, 0x960000, ... ) == 0x0
 01522   396   NtUnmapViewOfSection  (-1, 0x12ea9c, ... ) == STATUS_NOT_MAPPED_VIEW
 01523   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01524   396   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 01525   396   NtUserSystemParametersInfo  (104, 0, 1906151468, 0, ... ) == 0x1
 01526   396   NtUserGetDC  (0, ... ) == 0x1010051
 01527   396   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 01528   396   NtUserSystemParametersInfo  (38, 4, 1906153440, 0, ... ) == 0x1
 01529   396   NtUserSystemParametersInfo  (66, 12, 1240328, 0, ... ) == 0x1
 01530   396   NtOpenProcessToken  (-1, 0x8, ... 68, ) == 0x0
 01531   396   NtAccessCheck  (1327696, 68, 0x1, 1239732, 1239676, 56, 1239760, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 01532   396   NtClose  (68, ... ) == 0x0
 01533   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01534   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 68, ) == 0x0
 01535   396   NtQueryInformationToken  (68, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01536   396   NtClose  (68, ... ) == 0x0
 01537   396   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 68, ) }, ... 68, ) == 0x0
 01538   396   NtSetInformationObject  (68, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 01539   396   NtOpenKey  (0x20019, {24, 68, 0x40, 0, 0,  (0x20019, {24, 68, 0x40, 0, 0, "Control Panel\Desktop"}, ... 64, ) }, ... 64, ) == 0x0
 01540   396   NtQueryValueKey  (64,  (64, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01541   396   NtClose  (64, ... ) == 0x0
 01542   396   NtUserSystemParametersInfo  (41, 500, 1239828, 0, ... ) == 0x1
 01543   396   NtOpenKey  (0x1, {24, 68, 0x40, 0, 0,  (0x1, {24, 68, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 64, ) }, ... 64, ) == 0x0
 01544   396   NtQueryValueKey  (64,  (64, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01545   396   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 60, ) }, ... 60, ) == 0x0
 01546   396   NtQueryValueKey  (60,  (60, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01547   396   NtClose  (60, ... ) == 0x0
 01548   396   NtClose  (64, ... ) == 0x0
 01549   396   NtUserSystemParametersInfo  (102, 0, 1906153328, 0, ... ) == 0x1
 01550   396   NtUserSystemParametersInfo  (4130, 0, 1240352, 0, ... ) == 0x1
 01551   396   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 64, ) }, ... 64, ) == 0x0
 01552   396   NtEnumerateValueKey  (64, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 01553   396   NtClose  (64, ... ) == 0x0
 01554   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01555   396   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 01556   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc03b
 01557   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc03d
 01558   396   NtUserFindExistingCursorIcon  (1239632, 1239648, 1240216, ... ) == 0x10011
 01559   396   NtUserRegisterClassExWOW  (1240084, 1240164, 1240148, 1240180, 0, 384, 0, ... ) == 0x810dc03f
 01560   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01561   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc041
 01562   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01563   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc043
 01564   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc045
 01565   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01566   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc047
 01567   396   NtUserFindExistingCursorIcon  (1239632, 1239648, 1240216, ... ) == 0x10011
 01568   396   NtUserRegisterClassExWOW  (1240084, 1240164, 1240148, 1240180, 0, 384, 0, ... ) == 0x810dc049
 01569   396   NtUserGetClassInfo  (1905590272, 1240248, 1240200, 1240276, 0, ... ) == 0xc049
 01570   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01571   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc04b
 01572   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01573   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc04d
 01574   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01575   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc04f
 01576   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc051
 01577   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01578   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc053
 01579   396   NtUserFindExistingCursorIcon  (1239632, 1239648, 1240216, ... ) == 0x10011
 01580   396   NtUserRegisterClassExWOW  (1240084, 1240164, 1240148, 1240180, 0, 384, 0, ... ) == 0x810dc055
 01581   396   NtUserRegisterClassExWOW  (1240084, 1240164, 1240148, 1240180, 0, 384, 0, ... ) == 0x810dc057
 01582   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01583   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc059
 01584   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10013
 01585   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc05b
 01586   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01587   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc05d
 01588   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01589   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc05f
 01590   396   NtUserFindExistingCursorIcon  (1239632, 1239648, 1240216, ... ) == 0x10011
 01591   396   NtUserRegisterClassExWOW  (1240084, 1240164, 1240148, 1240180, 0, 384, 0, ... ) == 0x810dc017
 01592   396   NtUserFindExistingCursorIcon  (1239632, 1239648, 1240216, ... ) == 0x10011
 01593   396   NtUserRegisterClassExWOW  (1240084, 1240164, 1240148, 1240180, 0, 384, 0, ... ) == 0x810dc019
 01594   396   NtUserFindExistingCursorIcon  (1239632, 1239648, 1240216, ... ) == 0x10013
 01595   396   NtUserRegisterClassExWOW  (1240084, 1240164, 1240148, 1240180, 0, 384, 0, ... ) == 0x810dc018
 01596   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01597   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc01a
 01598   396   NtUserFindExistingCursorIcon  (1239632, 1239648, 1240216, ... ) == 0x10011
 01599   396   NtUserRegisterClassExWOW  (1240084, 1240164, 1240148, 1240180, 0, 384, 0, ... ) == 0x810dc01c
 01600   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01601   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ...
 01602   396   NtAllocateVirtualMemory  (-1, 5603328, 0, 4096, 4096, 32, ... 5603328, 4096, ) == 0x0
 01601   396   NtUserRegisterClassExWOW  ... ) == 0x810dc01e
 01603   396   NtUserFindExistingCursorIcon  (1239632, 1239648, 1240216, ... ) == 0x10011
 01604   396   NtUserRegisterClassExWOW  (1240144, 1240224, 1240208, 1240240, 0, 384, 0, ... ) == 0x810dc01b
 01605   396   NtUserFindExistingCursorIcon  (1239628, 1239644, 1240212, ... ) == 0x10011
 01606   396   NtUserRegisterClassExWOW  (1240140, 1240220, 1240204, 1240236, 0, 384, 0, ... ) == 0x810dc068
 01607   396   NtUserFindExistingCursorIcon  (1239636, 1239652, 1240220, ... ) == 0x10011
 01608   396   NtUserRegisterClassExWOW  (1240088, 1240168, 1240152, 1240184, 0, 384, 0, ... ) == 0x810dc06a
 01609   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 64, ) }, ... 64, ) == 0x0
 01610   396   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0
 01611   396   NtClose  (64, ... ) == 0x0
 01612   396   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {368, 0}, ... 64, ) == 0x0
 01613   396   NtQueryInformationProcess  (64, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 01614   396   NtClose  (64, ... ) == 0x0
 01615   396   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 01616   396   NtUserSystemParametersInfo  (104, 0, 2000318720, 0, ... ) == 0x1
 01617   396   NtUserSystemParametersInfo  (38, 4, 2000318708, 0, ... ) == 0x1
 01618   396   NtOpenKey  (0x20019, {24, 68, 0x40, 0, 0,  (0x20019, {24, 68, 0x40, 0, 0, "Control Panel\Desktop"}, ... 64, ) }, ... 64, ) == 0x0
 01619   396   NtQueryValueKey  (64,  (64, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01620   396   NtClose  (64, ... ) == 0x0
 01621   396   NtUserSystemParametersInfo  (41, 500, 1240988, 0, ... ) == 0x1
 01622   396   NtUserSystemParametersInfo  (102, 0, 2000318732, 0, ... ) == 0x1
 01623   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01624   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01625   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc03b
 01626   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01627   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc03d
 01628   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01629   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01630   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc03f
 01631   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01632   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01633   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc041
 01634   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01635   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01636   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc043
 01637   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01638   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc045
 01639   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01640   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01641   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc047
 01642   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01643   396   NtUserFindExistingCursorIcon  (1240776, 1240792, 1241360, ... ) == 0x10011
 01644   396   NtUserRegisterClassExWOW  (1241228, 1241308, 1241292, 1241324, 0, 384, 0, ... ) == 0x810dc049
 01645   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01646   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01647   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc04b
 01648   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01649   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01650   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc04d
 01651   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01652   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01653   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc04f
 01654   396   NtUserGetClassInfo  (1999896576, 1241400, 1241352, 1241428, 0, ... ) == 0x0
 01655   396   NtUserRegisterClassExWOW  (1241236, 1241316, 1241300, 1241332, 0, 384, 0, ... ) == 0x810dc051
 01656   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01657   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01658   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc053
 01659   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01660   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01661   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc055
 01662   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc057
 01663   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01664   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01665   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc059
 01666   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01667   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10013
 01668   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc05b
 01669   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01670   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01671   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc05d
 01672   396   NtUserGetClassInfo  (1999896576, 1241396, 1241348, 1241424, 0, ... ) == 0x0
 01673   396   NtUserFindExistingCursorIcon  (1240780, 1240796, 1241364, ... ) == 0x10011
 01674   396   NtUserRegisterClassExWOW  (1241232, 1241312, 1241296, 1241328, 0, 384, 0, ... ) == 0x810dc05f
 01675   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc03b
 01676   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc03d
 01677   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc03f
 01678   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc041
 01679   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc043
 01680   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc045
 01681   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc047
 01682   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc049
 01683   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc04b
 01684   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc04d
 01685   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc04f
 01686   396   NtUserGetClassInfo  (1999896576, 1243152, 1243104, 1243180, 0, ... ) == 0xc051
 01687   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc053
 01688   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc055
 01689   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc059
 01690   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc05b
 01691   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc05d
 01692   396   NtUserGetClassInfo  (1999896576, 1243148, 1243100, 1243176, 0, ... ) == 0xc05f
 01693   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.dll"}, ... 64, ) }, ... 64, ) == 0x0
 01694   396   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 01695   396   NtClose  (64, ... ) == 0x0
 01696   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 64, ) }, ... 64, ) == 0x0
 01697   396   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x771b0000), 0x0, 1155072, ) == 0x0
 01698   396   NtClose  (64, ... ) == 0x0
 01699   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01700   396   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01701   396   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 64, ) }, ... 64, ) == 0x0
 01702   396   NtQueryValueKey  (64,  (64, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (64, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 01703   396   NtClose  (64, ... ) == 0x0
 01704   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01705   396   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01706   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01707   396   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01708   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 64, ) }, ... 64, ) == 0x0
 01709   396   NtQueryValueKey  (64,  (64, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01710   396   NtQueryValueKey  (64,  (64, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01711   396   NtQueryValueKey  (64,  (64, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01712   396   NtClose  (64, ... ) == 0x0
 01713   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 64, ) }, ... 64, ) == 0x0
 01714   396   NtQueryValueKey  (64,  (64, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01715   396   NtQueryValueKey  (64,  (64, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01716   396   NtClose  (64, ... ) == 0x0
 01717   396   NtOpenEvent  (0x1f0003, {24, 52, 0x0, 0, 0,  (0x1f0003, {24, 52, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01718   396   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc07b
 01719   396   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01720   396   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01721   396   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01722   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01723   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01724   396   NtDelayExecution  (0, {-10000000, -1}, ...
 01725   588   NtContinue  (9764056, 0, ...
 01726   588   NtContinue  (9764056, 0, ...
 01727   588   NtContinue  (9764056, 0, ...
 01728   588   NtContinue  (9764056, 0, ...
 01729   588   NtContinue  (9764056, 0, ...
 01730   588   NtContinue  (9764056, 0, ...
 01731   588   NtContinue  (9764056, 0, ...
 01732   588   NtContinue  (9764056, 0, ...
 01733   588   NtContinue  (9764056, 0, ...
 01734   588   NtContinue  (9764056, 0, ...
 01735   588   NtContinue  (9764056, 0, ...
 01736   384   NtContinue  (11861204, 0, ...
 01737   584   NtContinue  (12907708, 0, ...
 01738   384   NtContinue  (11861204, 0, ...
 01739   584   NtContinue  (12907708, 0, ...
 01740   384   NtContinue  (11861204, 0, ...
 01741   584   NtContinue  (12907708, 0, ...
 01742   384   NtContinue  (11861204, 0, ...
 01743   584   NtContinue  (12907708, 0, ...
 01744   384   NtContinue  (11861204, 0, ...
 01745   584   NtContinue  (12907708, 0, ...
 01746   384   NtContinue  (11861204, 0, ...
 01747   584   NtContinue  (12907708, 0, ...
 01748   588   NtContinue  (9764056, 0, ...
 01749   384   NtContinue  (11861204, 0, ...
 01750   588   NtContinue  (9764056, 0, ...
 01751   384   NtContinue  (11861204, 0, ...
 01752   588   NtContinue  (9764056, 0, ...
 01753   384   NtContinue  (11861204, 0, ...
 01754   588   NtContinue  (9764056, 0, ...
 01755   384   NtContinue  (11861204, 0, ...
 01756   588   NtContinue  (9764056, 0, ...
 01757   384   NtContinue  (11861204, 0, ...
 01758   588   NtContinue  (9764056, 0, ...
 01759   384   NtContinue  (11861204, 0, ...
 01760   584   NtContinue  (12907708, 0, ...
 01761   588   NtContinue  (9764056, 0, ...
 01762   584   NtContinue  (12907708, 0, ...
 01763   588   NtContinue  (9764056, 0, ...
 01764   584   NtContinue  (12907708, 0, ...
 01765   588   NtContinue  (9764056, 0, ...
 01766   584   NtContinue  (12907708, 0, ...
 01767   588   NtContinue  (9764056, 0, ...
 01768   584   NtContinue  (12907708, 0, ...
 01769   588   NtContinue  (9764056, 0, ...
 01770   584   NtContinue  (12907708, 0, ...
 01771   588   NtContinue  (9764056, 0, ...
 01772   384   NtContinue  (11861204, 0, ...
 01773   584   NtContinue  (12907708, 0, ...
 01774   384   NtContinue  (11861204, 0, ...
 01775   584   NtContinue  (12907708, 0, ...
 01776   384   NtContinue  (11861204, 0, ...
 01777   584   NtContinue  (12907708, 0, ...
 01778   384   NtContinue  (11861204, 0, ...
 01779   584   NtContinue  (12907708, 0, ...
 01780   384   NtContinue  (11861204, 0, ...
 01781   584   NtContinue  (12907708, 0, ...
 01782   384   NtContinue  (11861204, 0, ...
 01783   584   NtContinue  (12907708, 0, ...
 01784   588   NtContinue  (9764056, 0, ...
 01785   384   NtContinue  (11861204, 0, ...
 01786   588   NtContinue  (9764056, 0, ...
 01787   384   NtContinue  (11861204, 0, ...
 01788   588   NtContinue  (9764056, 0, ...
 01789   384   NtContinue  (11861204, 0, ...
 01790   588   NtContinue  (9764056, 0, ...
 01791   384   NtContinue  (11861204, 0, ...
 01792   588   NtContinue  (9764056, 0, ...
 01793   384   NtContinue  (11861204, 0, ...
 01794   588   NtContinue  (9764056, 0, ...
 01795   384   NtContinue  (11861204, 0, ...
 01796   584   NtContinue  (12907708, 0, ...
 01797   588   NtContinue  (9764056, 0, ...
 01798   584   NtContinue  (12907708, 0, ...
 01799   588   NtContinue  (9764056, 0, ...
 01800   584   NtContinue  (12907708, 0, ...
 01801   588   NtContinue  (9764056, 0, ...
 01802   584   NtContinue  (12907708, 0, ...
 01803   588   NtContinue  (9764056, 0, ...
 01804   584   NtContinue  (12907708, 0, ...
 01805   588   NtContinue  (9764056, 0, ...
 01806   584   NtContinue  (12907708, 0, ...
 01807   588   NtContinue  (9764056, 0, ...
 01808   384   NtContinue  (11861204, 0, ...
 01809   584   NtContinue  (12907708, 0, ...
 01810   384   NtContinue  (11861204, 0, ...
 01811   584   NtContinue  (12907708, 0, ...
 01812   384   NtContinue  (11861204, 0, ...
 01813   584   NtContinue  (12907708, 0, ...
 01814   384   NtContinue  (11861204, 0, ...
 01815   584   NtContinue  (12907708, 0, ...
 01816   384   NtContinue  (11861204, 0, ...
 01817   584   NtContinue  (12907708, 0, ...
 01818   384   NtContinue  (11861204, 0, ...
 01819   584   NtContinue  (12907708, 0, ...
 01820   588   NtContinue  (9764056, 0, ...
 01821   384   NtContinue  (11861204, 0, ...
 01822   588   NtContinue  (9764056, 0, ...
 01823   384   NtContinue  (11861204, 0, ...
 01824   588   NtContinue  (9764056, 0, ...
 01825   384   NtContinue  (11861204, 0, ...
 01826   588   NtContinue  (9764056, 0, ...
 01827   384   NtContinue  (11861204, 0, ...
 01828   588   NtContinue  (9764056, 0, ...
 01829   384   NtContinue  (11861204, 0, ...
 01830   588   NtContinue  (9764056, 0, ...
 01831   384   NtContinue  (11861204, 0, ...
 01832   584   NtContinue  (12907708, 0, ...
 01833   588   NtContinue  (9764056, 0, ...
 01834   584   NtContinue  (12907708, 0, ...
 01835   588   NtContinue  (9764056, 0, ...
 01836   584   NtContinue  (12907708, 0, ...
 01837   588   NtContinue  (9764056, 0, ...
 01838   584   NtContinue  (12907708, 0, ...
 01839   588   NtContinue  (9764056, 0, ...
 01840   584   NtContinue  (12907708, 0, ...
 01841   588   NtContinue  (9764056, 0, ...
 01842   584   NtContinue  (12907708, 0, ...
 01843   588   NtContinue  (9764056, 0, ...
 01844   384   NtContinue  (11861204, 0, ...
 01845   584   NtContinue  (12907708, 0, ...
 01846   384   NtContinue  (11861204, 0, ...
 01847   584   NtContinue  (12907708, 0, ...
 01848   384   NtContinue  (11861204, 0, ...
 01849   584   NtContinue  (12907708, 0, ...
 01850   384   NtContinue  (11861204, 0, ...
 01851   584   NtContinue  (12907708, 0, ...
 01852   384   NtContinue  (11861204, 0, ...
 01853   384   NtContinue  (11861204, 0, ...
 01854   384   NtContinue  (11861204, 0, ...
 01855   384   NtContinue  (11861204, 0, ...
 01856   384   NtContinue  (11861204, 0, ...
 01857   384   NtContinue  (11861204, 0, ...
 01858   384   NtContinue  (11861204, 0, ...
 01859   384   NtContinue  (11861204, 0, ...
 01860   584   NtContinue  (12907708, 0, ...
 01861   588   NtContinue  (9764056, 0, ...
 01862   584   NtContinue  (12907708, 0, ...
 01863   588   NtContinue  (9764056, 0, ...
 01864   584   NtContinue  (12907708, 0, ...
 01865   588   NtContinue  (9764056, 0, ...
 01866   584   NtContinue  (12907708, 0, ...
 01867   588   NtContinue  (9764056, 0, ...
 01868   584   NtContinue  (12907708, 0, ...
 01869   588   NtContinue  (9764056, 0, ...
 01870   584   NtContinue  (12907708, 0, ...
 01871   588   NtContinue  (9764056, 0, ...
 01872   384   NtContinue  (11861204, 0, ...
 01873   584   NtContinue  (12907708, 0, ...
 01874   384   NtContinue  (11861204, 0, ...
 01875   584   NtContinue  (12907708, 0, ...
 01876   384   NtContinue  (11861204, 0, ...
 01877   584   NtContinue  (12907708, 0, ...
 01878   384   NtContinue  (11861204, 0, ...
 01879   584   NtContinue  (12907708, 0, ...
 01880   384   NtContinue  (11861204, 0, ...
 01881   584   NtContinue  (12907708, 0, ...
 01882   384   NtContinue  (11861204, 0, ...
 01883   584   NtContinue  (12907708, 0, ...
 01884   588   NtContinue  (9764056, 0, ...
 01885   384   NtContinue  (11861204, 0, ...
 01886   588   NtContinue  (9764056, 0, ...
 01887   384   NtContinue  (11861204, 0, ...
 01888   588   NtContinue  (9764056, 0, ...
 01889   384   NtContinue  (11861204, 0, ...
 01890   588   NtContinue  (9764056, 0, ...
 01891   384   NtContinue  (11861204, 0, ...
 01892   588   NtContinue  (9764056, 0, ...
 01893   384   NtContinue  (11861204, 0, ...
 01894   588   NtContinue  (9764056, 0, ...
 01895   384   NtContinue  (11861204, 0, ...
 01896   584   NtContinue  (12907708, 0, ...
 01897   588   NtContinue  (9764056, 0, ...
 01898   584   NtContinue  (12907708, 0, ...
 01899   588   NtContinue  (9764056, 0, ...
 01900   584   NtContinue  (12907708, 0, ...
 01901   588   NtContinue  (9764056, 0, ...
 01902   584   NtContinue  (12907708, 0, ...
 01903   588   NtContinue  (9764056, 0, ...
 01904   584   NtContinue  (12907708, 0, ...
 01905   588   NtContinue  (9764056, 0, ...
 01906   584   NtContinue  (12907708, 0, ...
 01907   588   NtContinue  (9764056, 0, ...
 01908   384   NtContinue  (11861204, 0, ...
 01909   584   NtContinue  (12907708, 0, ...
 01910   384   NtContinue  (11861204, 0, ...
 01911   584   NtContinue  (12907708, 0, ...
 01912   384   NtContinue  (11861204, 0, ...
 01913   584   NtContinue  (12907708, 0, ...
 01914   384   NtContinue  (11861204, 0, ...
 01915   584   NtContinue  (12907708, 0, ...
 01916   384   NtContinue  (11861204, 0, ...
 01917   584   NtContinue  (12907708, 0, ...
 01918   384   NtContinue  (11861204, 0, ...
 01919   584   NtContinue  (12907708, 0, ...
 01920   588   NtContinue  (9764056, 0, ...
 01921   384   NtContinue  (11861204, 0, ...
 01922   588   NtContinue  (9764056, 0, ...
 01923   384   NtContinue  (11861204, 0, ...
 01924   588   NtContinue  (9764056, 0, ...
 01925   384   NtContinue  (11861204, 0, ...
 01926   588   NtContinue  (9764056, 0, ...
 01927   384   NtContinue  (11861204, 0, ...
 01928   588   NtContinue  (9764056, 0, ...
 01929   384   NtContinue  (11861204, 0, ...
 01930   588   NtContinue  (9764056, 0, ...
 01931   384   NtContinue  (11861204, 0, ...
 01932   584   NtContinue  (12907708, 0, ...
 01933   588   NtContinue  (9764056, 0, ...
 01934   584   NtContinue  (12907708, 0, ...
 01935   588   NtContinue  (9764056, 0, ...
 01936   584   NtContinue  (12907708, 0, ...
 01937   588   NtContinue  (9764056, 0, ...
 01938   584   NtContinue  (12907708, 0, ...
 01939   588   NtContinue  (9764056, 0, ...
 01940   584   NtContinue  (12907708, 0, ...
 01941   588   NtContinue  (9764056, 0, ...
 01942   584   NtContinue  (12907708, 0, ...
 01943   588   NtContinue  (9764056, 0, ...
 01944   384   NtContinue  (11861204, 0, ...
 01945   584   NtContinue  (12907708, 0, ...
 01946   384   NtContinue  (11861204, 0, ...
 01947   584   NtContinue  (12907708, 0, ...
 01948   384   NtContinue  (11861204, 0, ...
 01949   584   NtContinue  (12907708, 0, ...
 01950   384   NtContinue  (11861204, 0, ...
 01951   584   NtContinue  (12907708, 0, ...
 01952   384   NtContinue  (11861204, 0, ...
 01953   584   NtContinue  (12907708, 0, ...
 01954   384   NtContinue  (11861204, 0, ...
 01955   584   NtContinue  (12907708, 0, ...
 01956   588   NtContinue  (9764056, 0, ...
 01957   384   NtContinue  (11861204, 0, ...
 01958   588   NtContinue  (9764056, 0, ...
 01959   384   NtContinue  (11861204, 0, ...
 01960   588   NtContinue  (9764056, 0, ...
 01961   384   NtContinue  (11861204, 0, ...
 01962   588   NtContinue  (9764056, 0, ...
 01963   384   NtContinue  (11861204, 0, ...
 01964   588   NtContinue  (9764056, 0, ...
 01965   384   NtContinue  (11861204, 0, ...
 01966   588   NtContinue  (9764056, 0, ...
 01967   384   NtContinue  (11861204, 0, ...
 01968   584   NtContinue  (12907708, 0, ...
 01969   588   NtContinue  (9764056, 0, ...
 01970   584   NtContinue  (12907708, 0, ...
 01971   588   NtContinue  (9764056, 0, ...
 01972   584   NtContinue  (12907708, 0, ...
 01973   588   NtContinue  (9764056, 0, ...
 01974   584   NtContinue  (12907708, 0, ...
 01975   588   NtContinue  (9764056, 0, ...
 01976   584   NtContinue  (12907708, 0, ...
 01977   588   NtContinue  (9764056, 0, ...
 01978   584   NtContinue  (12907708, 0, ...
 01979   588   NtContinue  (9764056, 0, ...
 01980   384   NtContinue  (11861204, 0, ...
 01981   584   NtContinue  (12907708, 0, ...
 01982   384   NtContinue  (11861204, 0, ...
 01983   584   NtContinue  (12907708, 0, ...
 01984   384   NtContinue  (11861204, 0, ...
 01985   584   NtContinue  (12907708, 0, ...
 01986   384   NtContinue  (11861204, 0, ...
 01987   584   NtContinue  (12907708, 0, ...
 01988   384   NtContinue  (11861204, 0, ...
 01989   584   NtContinue  (12907708, 0, ...
 01990   384   NtContinue  (11861204, 0, ...
 01991   584   NtContinue  (12907708, 0, ...
 01992   588   NtContinue  (9764056, 0, ...
 01993   384   NtContinue  (11861204, 0, ...
 01994   588   NtContinue  (9764056, 0, ...
 01995   384   NtContinue  (11861204, 0, ...
 01996   588   NtContinue  (9764056, 0, ...
 01997   384   NtContinue  (11861204, 0, ...
 01998   588   NtContinue  (9764056, 0, ...
 01999   384   NtContinue  (11861204, 0, ...
 02000   588   NtContinue  (9764056, 0, ...
 02001   384   NtContinue  (11861204, 0, ...
 02002   588   NtContinue  (9764056, 0, ...
 02003   384   NtContinue  (11861204, 0, ...
 02004   584   NtContinue  (12907708, 0, ...
 02005   588   NtContinue  (9764056, 0, ...
 02006   584   NtContinue  (12907708, 0, ...
 02007   588   NtContinue  (9764056, 0, ...
 02008   584   NtContinue  (12907708, 0, ...
 02009   588   NtContinue  (9764056, 0, ...
 02010   584   NtContinue  (12907708, 0, ...
 02011   588   NtContinue  (9764056, 0, ...
 02012   584   NtContinue  (12907708, 0, ...
 02013   588   NtContinue  (9764056, 0, ...
 02014   584   NtContinue  (12907708, 0, ...
 02015   588   NtContinue  (9764056, 0, ...
 02016   384   NtContinue  (11861204, 0, ...
 02017   584   NtContinue  (12907708, 0, ...
 02018   384   NtContinue  (11861204, 0, ...
 02019   584   NtContinue  (12907708, 0, ...
 02020   384   NtContinue  (11861204, 0, ...
 02021   584   NtContinue  (12907708, 0, ...
 02022   384   NtContinue  (11861204, 0, ...
 02023   584   NtContinue  (12907708, 0, ...
 02024   384   NtContinue  (11861204, 0, ...
 02025   584   NtContinue  (12907708, 0, ...
 02026   384   NtContinue  (11861204, 0, ...
 02027   584   NtContinue  (12907708, 0, ...
 02028   588   NtContinue  (9764056, 0, ...
 02029   384   NtContinue  (11861204, 0, ...
 02030   588   NtContinue  (9764056, 0, ...
 02031   384   NtContinue  (11861204, 0, ...
 02032   588   NtContinue  (9764056, 0, ...
 02033   384   NtContinue  (11861204, 0, ...
 02034   588   NtContinue  (9764056, 0, ...
 02035   384   NtContinue  (11861204, 0, ...
 02036   588   NtContinue  (9764056, 0, ...
 02037   384   NtContinue  (11861204, 0, ...
 02038   588   NtContinue  (9764056, 0, ...
 02039   384   NtContinue  (11861204, 0, ...
 02040   584   NtContinue  (12907708, 0, ...
 02041   588   NtContinue  (9764056, 0, ...
 02042   584   NtContinue  (12907708, 0, ...
 02043   588   NtContinue  (9764056, 0, ...
 02044   584   NtContinue  (12907708, 0, ...
 02045   588   NtContinue  (9764056, 0, ...
 02046   584   NtContinue  (12907708, 0, ...
 02047   588   NtContinue  (9764056, 0, ...
 02048   584   NtContinue  (12907708, 0, ...
 02049   588   NtContinue  (9764056, 0, ...
 02050   584   NtContinue  (12907708, 0, ...
 02051   588   NtContinue  (9764056, 0, ...
 02052   384   NtContinue  (11861204, 0, ...
 02053   584   NtContinue  (12907708, 0, ...
 02054   384   NtContinue  (11861204, 0, ...
 02055   584   NtContinue  (12907708, 0, ...
 02056   384   NtContinue  (11861204, 0, ...
 02057   584   NtContinue  (12907708, 0, ...
 02058   384   NtContinue  (11861204, 0, ...
 02059   584   NtContinue  (12907708, 0, ...
 02060   384   NtContinue  (11861204, 0, ...
 02061   584   NtContinue  (12907708, 0, ...
 02062   384   NtContinue  (11861204, 0, ...
 02063   584   NtContinue  (12907708, 0, ...
 02064   588   NtContinue  (9764056, 0, ...
 02065   384   NtContinue  (11861204, 0, ...
 02066   588   NtContinue  (9764056, 0, ...
 02067   384   NtContinue  (11861204, 0, ...
 02068   588   NtContinue  (9764056, 0, ...
 02069   384   NtContinue  (11861204, 0, ...
 02070   588   NtContinue  (9764056, 0, ...
 02071   384   NtContinue  (11861204, 0, ...
 02072   588   NtContinue  (9764056, 0, ...
 02073   384   NtContinue  (11861204, 0, ...
 02074   588   NtContinue  (9764056, 0, ...
 02075   384   NtContinue  (11861204, 0, ...
 02076   584   NtContinue  (12907708, 0, ...
 02077   588   NtContinue  (9764056, 0, ...
 02078   584   NtContinue  (12907708, 0, ...
 02079   588   NtContinue  (9764056, 0, ...
 02080   584   NtContinue  (12907708, 0, ...
 02081   588   NtContinue  (9764056, 0, ...
 02082   584   NtContinue  (12907708, 0, ...
 02083   588   NtContinue  (9764056, 0, ...
 02084   584   NtContinue  (12907708, 0, ...
 02085   588   NtContinue  (9764056, 0, ...
 02086   584   NtContinue  (12907708, 0, ...
 02087   588   NtContinue  (9764056, 0, ...
 02088   384   NtContinue  (11861204, 0, ...
 02089   584   NtContinue  (12907708, 0, ...
 02090   384   NtContinue  (11861204, 0, ...
 02091   584   NtContinue  (12907708, 0, ...
 02092   384   NtContinue  (11861204, 0, ...
 02093   584   NtContinue  (12907708, 0, ...
 02094   384   NtContinue  (11861204, 0, ...
 02095   584   NtContinue  (12907708, 0, ...
 02096   384   NtContinue  (11861204, 0, ...
 02097   584   NtContinue  (12907708, 0, ...
 02098   384   NtContinue  (11861204, 0, ...
 02099   584   NtContinue  (12907708, 0, ...
 02100   588   NtContinue  (9764056, 0, ...
 02101   384   NtContinue  (11861204, 0, ...
 02102   588   NtContinue  (9764056, 0, ...
 02103   384   NtContinue  (11861204, 0, ...
 02104   588   NtContinue  (9764056, 0, ...
 02105   384   NtContinue  (11861204, 0, ...
 02106   588   NtContinue  (9764056, 0, ...
 02107   384   NtContinue  (11861204, 0, ...
 02108   588   NtContinue  (9764056, 0, ...
 02109   384   NtContinue  (11861204, 0, ...
 02110   588   NtContinue  (9764056, 0, ...
 02111   384   NtContinue  (11861204, 0, ...
 02112   584   NtContinue  (12907708, 0, ...
 02113   588   NtContinue  (9764056, 0, ...
 02114   584   NtContinue  (12907708, 0, ...
 02115   588   NtContinue  (9764056, 0, ...
 02116   584   NtContinue  (12907708, 0, ...
 02117   588   NtContinue  (9764056, 0, ...
 02118   584   NtContinue  (12907708, 0, ...
 02119   588   NtContinue  (9764056, 0, ...
 02120   584   NtContinue  (12907708, 0, ...
 02121   588   NtContinue  (9764056, 0, ...
 02122   584   NtContinue  (12907708, 0, ...
 02123   588   NtContinue  (9764056, 0, ...
 02124   384   NtContinue  (11861204, 0, ...
 02125   584   NtContinue  (12907708, 0, ...
 02126   384   NtContinue  (11861204, 0, ...
 02127   584   NtContinue  (12907708, 0, ...
 02128   384   NtContinue  (11861204, 0, ...
 02129   584   NtContinue  (12907708, 0, ...
 02130   384   NtContinue  (11861204, 0, ...
 02131   584   NtContinue  (12907708, 0, ...
 02132   384   NtContinue  (11861204, 0, ...
 02133   584   NtContinue  (12907708, 0, ...
 02134   384   NtContinue  (11861204, 0, ...
 02135   584   NtContinue  (12907708, 0, ...
 02136   588   NtContinue  (9764056, 0, ...
 02137   384   NtContinue  (11861204, 0, ...
 02138   588   NtContinue  (9764056, 0, ...
 02139   384   NtContinue  (11861204, 0, ...
 02140   588   NtContinue  (9764056, 0, ...
 02141   384   NtContinue  (11861204, 0, ...
 02142   588   NtContinue  (9764056, 0, ...
 02143   384   NtContinue  (11861204, 0, ...
 02144   588   NtContinue  (9764056, 0, ...
 02145   384   NtContinue  (11861204, 0, ...
 02146   588   NtContinue  (9764056, 0, ...
 02147   384   NtContinue  (11861204, 0, ...
 02148   584   NtContinue  (12907708, 0, ...
 02149   588   NtContinue  (9764056, 0, ...
 02150   584   NtContinue  (12907708, 0, ...
 02151   588   NtContinue  (9764056, 0, ...
 02152   584   NtContinue  (12907708, 0, ...
 02153   588   NtContinue  (9764056, 0, ...
 02154   584   NtContinue  (12907708, 0, ...
 02155   588   NtContinue  (9764056, 0, ...
 02156   584   NtContinue  (12907708, 0, ...
 02157   588   NtContinue  (9764056, 0, ...
 02158   584   NtContinue  (12907708, 0, ...
 02159   588   NtContinue  (9764056, 0, ...
 02160   384   NtContinue  (11861204, 0, ...
 02161   584   NtContinue  (12907708, 0, ...
 02162   384   NtContinue  (11861204, 0, ...
 02163   584   NtContinue  (12907708, 0, ...
 02164   384   NtContinue  (11861204, 0, ...
 02165   584   NtContinue  (12907708, 0, ...
 02166   384   NtContinue  (11861204, 0, ...
 02167   584   NtContinue  (12907708, 0, ...
 02168   384   NtContinue  (11861204, 0, ...
 02169   584   NtContinue  (12907708, 0, ...
 02170   384   NtContinue  (11861204, 0, ...
 02171   584   NtContinue  (12907708, 0, ...
 02172   588   NtContinue  (9764056, 0, ...
 02173   384   NtContinue  (11861204, 0, ...
 02174   588   NtContinue  (9764056, 0, ...
 02175   384   NtContinue  (11861204, 0, ...
 02176   588   NtContinue  (9764056, 0, ...
 02177   384   NtContinue  (11861204, 0, ...
 02178   588   NtContinue  (9764056, 0, ...
 02179   384   NtContinue  (11861204, 0, ...
 02180   588   NtContinue  (9764056, 0, ...
 02181   384   NtContinue  (11861204, 0, ...
 02182   588   NtContinue  (9764056, 0, ...
 02183   384   NtContinue  (11861204, 0, ...
 02184   584   NtContinue  (12907708, 0, ...
 02185   588   NtContinue  (9764056, 0, ...
 02186   584   NtContinue  (12907708, 0, ...
 02187   588   NtContinue  (9764056, 0, ...
 02188   584   NtContinue  (12907708, 0, ...
 02189   588   NtContinue  (9764056, 0, ...
 02190   584   NtContinue  (12907708, 0, ...
 02191   588   NtContinue  (9764056, 0, ...
 02192   584   NtContinue  (12907708, 0, ...
 02193   588   NtContinue  (9764056, 0, ...
 02194   584   NtContinue  (12907708, 0, ...
 02195   588   NtContinue  (9764056, 0, ...
 02196   384   NtContinue  (11861204, 0, ...
 02197   584   NtContinue  (12907708, 0, ...
 02198   384   NtContinue  (11861204, 0, ...
 02199   584   NtContinue  (12907708, 0, ...
 02200   384   NtContinue  (11861204, 0, ...
 02201   584   NtContinue  (12907708, 0, ...
 02202   384   NtContinue  (11861204, 0, ...
 02203   588   NtContinue  (9764056, 0, ...
 02204   384   NtContinue  (11861204, 0, ...
 02205   588   NtContinue  (9764056, 0, ...
 02206   384   NtContinue  (11861204, 0, ...
 02207   588   NtContinue  (9764056, 0, ...
 02208   584   NtContinue  (12907708, 0, ...
 02209   588   NtContinue  (9764056, 0, ...
 02210   584   NtContinue  (12907708, 0, ...
 02211   588   NtContinue  (9764056, 0, ...
 02212   584   NtContinue  (12907708, 0, ...
 02213   588   NtContinue  (9764056, 0, ...
 02214   584   NtContinue  (12907708, 0, ...
 02215   384   NtContinue  (11861204, 0, ...
 02216   584   NtContinue  (12907708, 0, ...
 02217   384   NtContinue  (11861204, 0, ...
 02218   584   NtContinue  (12907708, 0, ...
 02219   384   NtContinue  (11861204, 0, ...
 02220   588   NtContinue  (9764056, 0, ...
 02221   384   NtContinue  (11861204, 0, ...
 02222   588   NtContinue  (9764056, 0, ...
 02223   384   NtContinue  (11861204, 0, ...
 02224   588   NtContinue  (9764056, 0, ...
 02225   384   NtContinue  (11861204, 0, ...
 02226   588   NtContinue  (9764056, 0, ...
 02227   584   NtContinue  (12907708, 0, ...
 02228   588   NtContinue  (9764056, 0, ...
 02229   584   NtContinue  (12907708, 0, ...
 02230   588   NtContinue  (9764056, 0, ...
 02231   584   NtContinue  (12907708, 0, ...
 02232   384   NtContinue  (11861204, 0, ...
 02233   584   NtContinue  (12907708, 0, ...
 02234   384   NtContinue  (11861204, 0, ...
 02235   584   NtContinue  (12907708, 0, ...
 02236   384   NtContinue  (11861204, 0, ...
 02237   584   NtContinue  (12907708, 0, ...
 02238   384   NtContinue  (11861204, 0, ...
 02239   588   NtContinue  (9764056, 0, ...
 02240   384   NtContinue  (11861204, 0, ...
 02241   588   NtContinue  (9764056, 0, ...
 02242   384   NtContinue  (11861204, 0, ...
 02243   588   NtContinue  (9764056, 0, ...
 02244   584   NtContinue  (12907708, 0, ...
 02245   588   NtContinue  (9764056, 0, ...
 02246   584   NtContinue  (12907708, 0, ...
 02247   588   NtContinue  (9764056, 0, ...
 02248   584   NtContinue  (12907708, 0, ...
 02249   588   NtContinue  (9764056, 0, ...
 02250   584   NtContinue  (12907708, 0, ...
 02251   384   NtContinue  (11861204, 0, ...
 02252   584   NtContinue  (12907708, 0, ...
 02253   384   NtContinue  (11861204, 0, ...
 02254   584   NtContinue  (12907708, 0, ...
 02255   384   NtContinue  (11861204, 0, ...
 02256   588   NtContinue  (9764056, 0, ...
 02257   384   NtContinue  (11861204, 0, ...
 02258   588   NtContinue  (9764056, 0, ...
 02259   384   NtContinue  (11861204, 0, ...
 02260   588   NtContinue  (9764056, 0, ...
 02261   384   NtContinue  (11861204, 0, ...
 02262   588   NtContinue  (9764056, 0, ...
 02263   584   NtContinue  (12907708, 0, ...
 02264   588   NtContinue  (9764056, 0, ...
 02265   584   NtContinue  (12907708, 0, ...
 02266   588   NtContinue  (9764056, 0, ...
 02267   584   NtContinue  (12907708, 0, ...
 02268   384   NtContinue  (11861204, 0, ...
 02269   584   NtContinue  (12907708, 0, ...
 02270   384   NtContinue  (11861204, 0, ...
 02271   584   NtContinue  (12907708, 0, ...
 02272   384   NtContinue  (11861204, 0, ...
 02273   584   NtContinue  (12907708, 0, ...
 02274   384   NtContinue  (11861204, 0, ...
 02275   588   NtContinue  (9764056, 0, ...
 02276   384   NtContinue  (11861204, 0, ...
 02277   588   NtContinue  (9764056, 0, ...
 02278   384   NtContinue  (11861204, 0, ...
 02279   588   NtContinue  (9764056, 0, ...
 02280   584   NtContinue  (12907708, 0, ...
 02281   588   NtContinue  (9764056, 0, ...
 02282   584   NtContinue  (12907708, 0, ...
 02283   588   NtContinue  (9764056, 0, ...
 02284   584   NtContinue  (12907708, 0, ...
 02285   588   NtContinue  (9764056, 0, ...
 02286   584   NtContinue  (12907708, 0, ...
 02287   384   NtContinue  (11861204, 0, ...
 02288   584   NtContinue  (12907708, 0, ...
 02289   384   NtContinue  (11861204, 0, ...
 02290   584   NtContinue  (12907708, 0, ...
 02291   384   NtContinue  (11861204, 0, ...
 02292   588   NtContinue  (9764056, 0, ...
 02293   384   NtContinue  (11861204, 0, ...
 02294   588   NtContinue  (9764056, 0, ...
 02295   384   NtContinue  (11861204, 0, ...
 02296   588   NtContinue  (9764056, 0, ...
 02297   384   NtContinue  (11861204, 0, ...
 02298   588   NtContinue  (9764056, 0, ...
 02299   584   NtContinue  (12907708, 0, ...
 02300   588   NtContinue  (9764056, 0, ...
 02301   584   NtContinue  (12907708, 0, ...
 02302   588   NtContinue  (9764056, 0, ...
 02303   584   NtContinue  (12907708, 0, ...
 02304   384   NtContinue  (11861204, 0, ...
 02305   584   NtContinue  (12907708, 0, ...
 02306   384   NtContinue  (11861204, 0, ...
 02307   584   NtContinue  (12907708, 0, ...
 02308   384   NtContinue  (11861204, 0, ...
 02309   584   NtContinue  (12907708, 0, ...
 02310   384   NtContinue  (11861204, 0, ...
 02311   588   NtContinue  (9764056, 0, ...
 02312   384   NtContinue  (11861204, 0, ...
 02313   588   NtContinue  (9764056, 0, ...
 02314   384   NtContinue  (11861204, 0, ...
 02315   588   NtContinue  (9764056, 0, ...
 02316   584   NtContinue  (12907708, 0, ...
 02317   588   NtContinue  (9764056, 0, ...
 02318   584   NtContinue  (12907708, 0, ...
 02319   588   NtContinue  (9764056, 0, ...
 02320   584   NtContinue  (12907708, 0, ...
 02321   588   NtContinue  (9764056, 0, ...
 02322   584   NtContinue  (12907708, 0, ...
 02323   384   NtContinue  (11861204, 0, ...
 02324   584   NtContinue  (12907708, 0, ...
 02325   384   NtContinue  (11861204, 0, ...
 02326   584   NtContinue  (12907708, 0, ...
 02327   384   NtContinue  (11861204, 0, ...
 02328   588   NtContinue  (9764056, 0, ...
 02329   384   NtContinue  (11861204, 0, ...
 02330   588   NtContinue  (9764056, 0, ...
 02331   384   NtContinue  (11861204, 0, ...
 02332   588   NtContinue  (9764056, 0, ...
 02333   384   NtContinue  (11861204, 0, ...
 02334   588   NtContinue  (9764056, 0, ...
 02335   584   NtContinue  (12907708, 0, ...
 02336   588   NtContinue  (9764056, 0, ...
 02337   584   NtContinue  (12907708, 0, ...
 02338   588   NtContinue  (9764056, 0, ...
 02339   584   NtContinue  (12907708, 0, ...
 02340   384   NtContinue  (11861204, 0, ...
 02341   584   NtContinue  (12907708, 0, ...
 02342   384   NtContinue  (11861204, 0, ...
 02343   584   NtContinue  (12907708, 0, ...
 02344   384   NtContinue  (11861204, 0, ...
 02345   584   NtContinue  (12907708, 0, ...
 02346   384   NtContinue  (11861204, 0, ...
 02347   588   NtContinue  (9764056, 0, ...
 02348   384   NtContinue  (11861204, 0, ...
 02349   588   NtContinue  (9764056, 0, ...
 02350   384   NtContinue  (11861204, 0, ...
 02351   588   NtContinue  (9764056, 0, ...
 02352   584   NtContinue  (12907708, 0, ...
 02353   588   NtContinue  (9764056, 0, ...
 02354   584   NtContinue  (12907708, 0, ...
 02355   588   NtContinue  (9764056, 0, ...
 02356   584   NtContinue  (12907708, 0, ...
 02357   588   NtContinue  (9764056, 0, ...
 02358   584   NtContinue  (12907708, 0, ...
 02359   384   NtContinue  (11861204, 0, ...
 02360   584   NtContinue  (12907708, 0, ...
 02361   384   NtContinue  (11861204, 0, ...
 02362   584   NtContinue  (12907708, 0, ...
 02363   384   NtContinue  (11861204, 0, ...
 02364   588   NtContinue  (9764056, 0, ...
 02365   384   NtContinue  (11861204, 0, ...
 02366   588   NtContinue  (9764056, 0, ...
 02367   384   NtContinue  (11861204, 0, ...
 02368   588   NtContinue  (9764056, 0, ...
 02369   384   NtContinue  (11861204, 0, ...
 02370   588   NtContinue  (9764056, 0, ...
 02371   584   NtContinue  (12907708, 0, ...
 02372   588   NtContinue  (9764056, 0, ...
 02373   584   NtContinue  (12907708, 0, ...
 02374   588   NtContinue  (9764056, 0, ...
 02375   584   NtContinue  (12907708, 0, ...
 02376   384   NtContinue  (11861204, 0, ...
 02377   584   NtContinue  (12907708, 0, ...
 02378   384   NtContinue  (11861204, 0, ...
 02379   584   NtContinue  (12907708, 0, ...
 02380   384   NtContinue  (11861204, 0, ...
 02381   584   NtContinue  (12907708, 0, ...
 02382   384   NtContinue  (11861204, 0, ...
 02383   588   NtContinue  (9764056, 0, ...
 02384   384   NtContinue  (11861204, 0, ...
 02385   588   NtContinue  (9764056, 0, ...
 02386   384   NtContinue  (11861204, 0, ...
 02387   588   NtContinue  (9764056, 0, ...
 02388   584   NtContinue  (12907708, 0, ...
 02389   588   NtContinue  (9764056, 0, ...
 02390   584   NtContinue  (12907708, 0, ...
 02391   588   NtContinue  (9764056, 0, ...
 02392   584   NtContinue  (12907708, 0, ...
 02393   588   NtContinue  (9764056, 0, ...
 02394   584   NtContinue  (12907708, 0, ...
 02395   384   NtContinue  (11861204, 0, ...
 02396   584   NtContinue  (12907708, 0, ...
 02397   384   NtContinue  (11861204, 0, ...
 02398   584   NtContinue  (12907708, 0, ...
 02399   384   NtContinue  (11861204, 0, ...
 02400   588   NtContinue  (9764056, 0, ...
 02401   384   NtContinue  (11861204, 0, ...
 02402   588   NtContinue  (9764056, 0, ...
 02403   384   NtContinue  (11861204, 0, ...
 02404   588   NtContinue  (9764056, 0, ...
 02405   384   NtContinue  (11861204, 0, ...
 02406   588   NtContinue  (9764056, 0, ...
 02407   584   NtContinue  (12907708, 0, ...
 02408   588   NtContinue  (9764056, 0, ...
 02409   584   NtContinue  (12907708, 0, ...
 02410   588   NtContinue  (9764056, 0, ...
 02411   584   NtContinue  (12907708, 0, ...
 02412   384   NtContinue  (11861204, 0, ...
 02413   584   NtContinue  (12907708, 0, ...
 02414   384   NtContinue  (11861204, 0, ...
 02415   584   NtContinue  (12907708, 0, ...
 02416   384   NtContinue  (11861204, 0, ...
 02417   584   NtContinue  (12907708, 0, ...
 02418   384   NtContinue  (11861204, 0, ...
 02419   588   NtContinue  (9764056, 0, ...
 02420   384   NtContinue  (11861204, 0, ...
 02421   588   NtContinue  (9764056, 0, ...
 02422   384   NtContinue  (11861204, 0, ...
 02423   588   NtContinue  (9764056, 0, ...
 02424   584   NtContinue  (12907708, 0, ...
 02425   588   NtContinue  (9764056, 0, ...
 02426   584   NtContinue  (12907708, 0, ...
 02427   588   NtContinue  (9764056, 0, ...
 02428   584   NtContinue  (12907708, 0, ...
 02429   588   NtContinue  (9764056, 0, ...
 02430   584   NtContinue  (12907708, 0, ...
 02431   384   NtContinue  (11861204, 0, ...
 02432   584   NtContinue  (12907708, 0, ...
 02433   384   NtContinue  (11861204, 0, ...
 02434   584   NtContinue  (12907708, 0, ...
 02435   384   NtContinue  (11861204, 0, ...
 02436   588   NtContinue  (9764056, 0, ...
 02437   384   NtContinue  (11861204, 0, ...
 02438   588   NtContinue  (9764056, 0, ...
 02439   384   NtContinue  (11861204, 0, ...
 02440   588   NtContinue  (9764056, 0, ...
 02441   384   NtContinue  (11861204, 0, ...
 02442   588   NtContinue  (9764056, 0, ...
 02443   584   NtContinue  (12907708, 0, ...
 02444   588   NtContinue  (9764056, 0, ...
 02445   584   NtContinue  (12907708, 0, ...
 02446   588   NtContinue  (9764056, 0, ...
 02447   584   NtContinue  (12907708, 0, ...
 02448   384   NtContinue  (11861204, 0, ...
 02449   584   NtContinue  (12907708, 0, ...
 02450   384   NtContinue  (11861204, 0, ...
 02451   584   NtContinue  (12907708, 0, ...
 02452   384   NtContinue  (11861204, 0, ...
 02453   584   NtContinue  (12907708, 0, ...
 02454   384   NtContinue  (11861204, 0, ...
 02455   588   NtContinue  (9764056, 0, ...
 02456   384   NtContinue  (11861204, 0, ...
 02457   588   NtContinue  (9764056, 0, ...
 02458   384   NtContinue  (11861204, 0, ...
 02459   588   NtContinue  (9764056, 0, ...
 02460   584   NtContinue  (12907708, 0, ...
 02461   588   NtContinue  (9764056, 0, ...
 02462   584   NtContinue  (12907708, 0, ...
 02463   588   NtContinue  (9764056, 0, ...
 02464   584   NtContinue  (12907708, 0, ...
 02465   588   NtContinue  (9764056, 0, ...
 02466   584   NtContinue  (12907708, 0, ...
 02467   384   NtContinue  (11861204, 0, ...
 02468   584   NtContinue  (12907708, 0, ...
 02469   384   NtContinue  (11861204, 0, ...
 02470   584   NtContinue  (12907708, 0, ...
 02471   384   NtContinue  (11861204, 0, ...
 02472   588   NtContinue  (9764056, 0, ...
 02473   384   NtContinue  (11861204, 0, ...
 02474   588   NtContinue  (9764056, 0, ...
 02475   384   NtContinue  (11861204, 0, ...
 02476   588   NtContinue  (9764056, 0, ...
 02477   384   NtContinue  (11861204, 0, ...
 02478   588   NtContinue  (9764056, 0, ...
 02479   584   NtContinue  (12907708, 0, ...
 02480   588   NtContinue  (9764056, 0, ...
 02481   584   NtContinue  (12907708, 0, ...
 02482   588   NtContinue  (9764056, 0, ...
 02483   584   NtContinue  (12907708, 0, ...
 02484   384   NtContinue  (11861204, 0, ...
 02485   584   NtContinue  (12907708, 0, ...
 02486   384   NtContinue  (11861204, 0, ...
 02487   584   NtContinue  (12907708, 0, ...
 02488   384   NtContinue  (11861204, 0, ...
 02489   584   NtContinue  (12907708, 0, ...
 02490   384   NtContinue  (11861204, 0, ...
 02491   588   NtContinue  (9764056, 0, ...
 02492   384   NtContinue  (11861204, 0, ...
 02493   588   NtContinue  (9764056, 0, ...
 02494   384   NtContinue  (11861204, 0, ...
 02495   588   NtContinue  (9764056, 0, ...
 02496   584   NtContinue  (12907708, 0, ...
 02497   588   NtContinue  (9764056, 0, ...
 02498   584   NtContinue  (12907708, 0, ...
 02499   588   NtContinue  (9764056, 0, ...
 02500   584   NtContinue  (12907708, 0, ...
 02501   588   NtContinue  (9764056, 0, ...
 02502   584   NtContinue  (12907708, 0, ...
 02503   384   NtContinue  (11861204, 0, ...
 02504   584   NtContinue  (12907708, 0, ...
 02505   384   NtContinue  (11861204, 0, ...
 02506   584   NtContinue  (12907708, 0, ...
 02507   384   NtContinue  (11861204, 0, ...
 02508   588   NtContinue  (9764056, 0, ...
 02509   384   NtContinue  (11861204, 0, ...
 02510   588   NtContinue  (9764056, 0, ...
 02511   384   NtContinue  (11861204, 0, ...
 02512   588   NtContinue  (9764056, 0, ...
 02513   384   NtContinue  (11861204, 0, ...
 02514   588   NtContinue  (9764056, 0, ...
 02515   584   NtContinue  (12907708, 0, ...
 02516   588   NtContinue  (9764056, 0, ...
 02517   584   NtContinue  (12907708, 0, ...
 02518   588   NtContinue  (9764056, 0, ...
 02519   584   NtContinue  (12907708, 0, ...
 02520   384   NtContinue  (11861204, 0, ...
 02521   584   NtContinue  (12907708, 0, ...
 02522   384   NtContinue  (11861204, 0, ...
 02523   584   NtContinue  (12907708, 0, ...
 02524   384   NtContinue  (11861204, 0, ...
 02525   584   NtContinue  (12907708, 0, ...
 02526   384   NtContinue  (11861204, 0, ...
 02527   588   NtContinue  (9764056, 0, ...
 02528   384   NtContinue  (11861204, 0, ...
 02529   588   NtContinue  (9764056, 0, ...
 02530   384   NtContinue  (11861204, 0, ...
 02531   588   NtContinue  (9764056, 0, ...
 02532   584   NtContinue  (12907708, 0, ...
 02533   588   NtContinue  (9764056, 0, ...
 02534   584   NtContinue  (12907708, 0, ...
 02535   588   NtContinue  (9764056, 0, ...
 02536   584   NtContinue  (12907708, 0, ...
 02537   588   NtContinue  (9764056, 0, ...
 02538   584   NtContinue  (12907708, 0, ...
 02539   384   NtContinue  (11861204, 0, ...
 02540   584   NtContinue  (12907708, 0, ...
 02541   384   NtContinue  (11861204, 0, ...
 02542   584   NtContinue  (12907708, 0, ...
 02543   384   NtContinue  (11861204, 0, ...
 02544   588   NtContinue  (9764056, 0, ...
 02545   384   NtContinue  (11861204, 0, ...
 02546   588   NtContinue  (9764056, 0, ...
 02547   384   NtContinue  (11861204, 0, ...
 02548   588   NtContinue  (9764056, 0, ...
 02549   384   NtContinue  (11861204, 0, ...
 02550   588   NtContinue  (9764056, 0, ...
 02551   584   NtContinue  (12907708, 0, ...
 02552   588   NtContinue  (9764056, 0, ...
 02553   584   NtContinue  (12907708, 0, ...
 02554   588   NtContinue  (9764056, 0, ...
 02555   584   NtContinue  (12907708, 0, ...
 02556   384   NtContinue  (11861204, 0, ...
 02557   584   NtContinue  (12907708, 0, ...
 02558   384   NtContinue  (11861204, 0, ...
 02559   584   NtContinue  (12907708, 0, ...
 02560   384   NtContinue  (11861204, 0, ...
 02561   584   NtContinue  (12907708, 0, ...
 02562   384   NtContinue  (11861204, 0, ...
 02563   588   NtContinue  (9764056, 0, ...
 02564   384   NtContinue  (11861204, 0, ...
 02565   588   NtContinue  (9764056, 0, ...
 02566   384   NtContinue  (11861204, 0, ...
 02567   588   NtContinue  (9764056, 0, ...
 02568   584   NtContinue  (12907708, 0, ...
 02569   588   NtContinue  (9764056, 0, ...
 02570   584   NtContinue  (12907708, 0, ...
 02571   588   NtContinue  (9764056, 0, ...
 02572   584   NtContinue  (12907708, 0, ...
 02573   588   NtContinue  (9764056, 0, ...
 02574   584   NtContinue  (12907708, 0, ...
 02575   384   NtContinue  (11861204, 0, ...
 02576   584   NtContinue  (12907708, 0, ...
 02577   384   NtContinue  (11861204, 0, ...
 02578   584   NtContinue  (12907708, 0, ...
 02579   384   NtContinue  (11861204, 0, ...
 02580   588   NtContinue  (9764056, 0, ...
 02581   384   NtContinue  (11861204, 0, ...
 02582   588   NtContinue  (9764056, 0, ...
 02583   384   NtContinue  (11861204, 0, ...
 02584   588   NtContinue  (9764056, 0, ...
 02585   384   NtContinue  (11861204, 0, ...
 02586   588   NtContinue  (9764056, 0, ...
 02587   584   NtContinue  (12907708, 0, ...
 02588   588   NtContinue  (9764056, 0, ...
 02589   584   NtContinue  (12907708, 0, ...
 02590   588   NtContinue  (9764056, 0, ...
 02591   584   NtContinue  (12907708, 0, ...
 02592   384   NtContinue  (11861204, 0, ...
 02593   584   NtContinue  (12907708, 0, ...
 02594   384   NtContinue  (11861204, 0, ...
 02595   584   NtContinue  (12907708, 0, ...
 02596   384   NtContinue  (11861204, 0, ...
 02597   584   NtContinue  (12907708, 0, ...
 02598   384   NtContinue  (11861204, 0, ...
 02599   588   NtContinue  (9764056, 0, ...
 02600   384   NtContinue  (11861204, 0, ...
 02601   588   NtContinue  (9764056, 0, ...
 02602   588   NtContinue  (9764056, 0, ...
 02603   588   NtContinue  (9764056, 0, ...
 02604   588   NtContinue  (9764056, 0, ...
 02605   588   NtContinue  (9764056, 0, ...
 02606   588   NtContinue  (9764056, 0, ...
 02607   588   NtContinue  (9764056, 0, ...
 02608   588   NtContinue  (9764056, 0, ...
 02609   588   NtContinue  (9764056, 0, ...
 02610   588   NtContinue  (9764056, 0, ...
 02611   588   NtContinue  (9764056, 0, ...
 02612   384   NtContinue  (11861204, 0, ...
 02613   584   NtContinue  (12907708, 0, ...
 02614   384   NtContinue  (11861204, 0, ...
 02615   584   NtContinue  (12907708, 0, ...
 02616   384   NtContinue  (11861204, 0, ...
 02617   584   NtContinue  (12907708, 0, ...
 02618   384   NtContinue  (11861204, 0, ...
 02619   584   NtContinue  (12907708, 0, ...
 02620   384   NtContinue  (11861204, 0, ...
 02621   584   NtContinue  (12907708, 0, ...
 02622   384   NtContinue  (11861204, 0, ...
 02623   584   NtContinue  (12907708, 0, ...
 02624   588   NtContinue  (9764056, 0, ...
 02625   384   NtContinue  (11861204, 0, ...
 02626   588   NtContinue  (9764056, 0, ...
 02627   384   NtContinue  (11861204, 0, ...
 02628   588   NtContinue  (9764056, 0, ...
 02629   384   NtContinue  (11861204, 0, ...
 02630   588   NtContinue  (9764056, 0, ...
 02631   384   NtContinue  (11861204, 0, ...
 02632   588   NtContinue  (9764056, 0, ...
 02633   384   NtContinue  (11861204, 0, ...
 02634   588   NtContinue  (9764056, 0, ...
 02635   384   NtContinue  (11861204, 0, ...
 02636   584   NtContinue  (12907708, 0, ...
 02637   588   NtContinue  (9764056, 0, ...
 02638   584   NtContinue  (12907708, 0, ...
 02639   588   NtContinue  (9764056, 0, ...
 02640   584   NtContinue  (12907708, 0, ...
 02641   588   NtContinue  (9764056, 0, ...
 02642   584   NtContinue  (12907708, 0, ...
 02643   588   NtContinue  (9764056, 0, ...
 02644   584   NtContinue  (12907708, 0, ...
 02645   588   NtContinue  (9764056, 0, ...
 02646   584   NtContinue  (12907708, 0, ...
 02647   588   NtContinue  (9764056, 0, ...
 02648   384   NtContinue  (11861204, 0, ...
 02649   584   NtContinue  (12907708, 0, ...
 02650   384   NtContinue  (11861204, 0, ...
 02651   584   NtContinue  (12907708, 0, ...
 02652   384   NtContinue  (11861204, 0, ...
 02653   584   NtContinue  (12907708, 0, ...
 02654   384   NtContinue  (11861204, 0, ...
 02655   584   NtContinue  (12907708, 0, ...
 02656   384   NtContinue  (11861204, 0, ...
 02657   584   NtContinue  (12907708, 0, ...
 02658   384   NtContinue  (11861204, 0, ...
 02659   584   NtContinue  (12907708, 0, ...
 02660   588   NtContinue  (9764056, 0, ...
 02661   384   NtContinue  (11861204, 0, ...
 02662   588   NtContinue  (9764056, 0, ...
 02663   384   NtContinue  (11861204, 0, ...
 02664   588   NtContinue  (9764056, 0, ...
 02665   384   NtContinue  (11861204, 0, ...
 02666   588   NtContinue  (9764056, 0, ...
 02667   384   NtContinue  (11861204, 0, ...
 02668   588   NtContinue  (9764056, 0, ...
 02669   384   NtContinue  (11861204, 0, ...
 02670   588   NtContinue  (9764056, 0, ...
 02671   384   NtContinue  (11861204, 0, ...
 02672   584   NtContinue  (12907708, 0, ...
 02673   588   NtContinue  (9764056, 0, ...
 02674   584   NtContinue  (12907708, 0, ...
 02675   588   NtContinue  (9764056, 0, ...
 02676   584   NtContinue  (12907708, 0, ...
 02677   588   NtContinue  (9764056, 0, ...
 02678   584   NtContinue  (12907708, 0, ...
 02679   588   NtContinue  (9764056, 0, ...
 02680   584   NtContinue  (12907708, 0, ...
 02681   588   NtContinue  (9764056, 0, ...
 02682   584   NtContinue  (12907708, 0, ...
 02683   588   NtContinue  (9764056, 0, ...
 02684   384   NtContinue  (11861204, 0, ...
 02685   584   NtContinue  (12907708, 0, ...
 02686   384   NtContinue  (11861204, 0, ...
 02687   584   NtContinue  (12907708, 0, ...
 02688   384   NtContinue  (11861204, 0, ...
 02689   584   NtContinue  (12907708, 0, ...
 02690   384   NtContinue  (11861204, 0, ...
 02691   584   NtContinue  (12907708, 0, ...
 02692   384   NtContinue  (11861204, 0, ...
 02693   584   NtContinue  (12907708, 0, ...
 02694   384   NtContinue  (11861204, 0, ...
 02695   584   NtContinue  (12907708, 0, ...
 02696   588   NtContinue  (9764056, 0, ...
 02697   384   NtContinue  (11861204, 0, ...
 02698   588   NtContinue  (9764056, 0, ...
 02699   384   NtContinue  (11861204, 0, ...
 02700   588   NtContinue  (9764056, 0, ...
 02701   384   NtContinue  (11861204, 0, ...
 02702   588   NtContinue  (9764056, 0, ...
 02703   384   NtContinue  (11861204, 0, ...
 02704   588   NtContinue  (9764056, 0, ...
 02705   384   NtContinue  (11861204, 0, ...
 02706   588   NtContinue  (9764056, 0, ...
 02707   384   NtContinue  (11861204, 0, ...
 02708   584   NtContinue  (12907708, 0, ...
 02709   588   NtContinue  (9764056, 0, ...
 02710   584   NtContinue  (12907708, 0, ...
 02711   588   NtContinue  (9764056, 0, ...
 02712   584   NtContinue  (12907708, 0, ...
 02713   588   NtContinue  (9764056, 0, ...
 02714   584   NtContinue  (12907708, 0, ...
 02715   588   NtContinue  (9764056, 0, ...
 02716   584   NtContinue  (12907708, 0, ...
 02717   588   NtContinue  (9764056, 0, ...
 02718   584   NtContinue  (12907708, 0, ...
 02719   588   NtContinue  (9764056, 0, ...
 02720   384   NtContinue  (11861204, 0, ...
 02721   584   NtContinue  (12907708, 0, ...
 02722   384   NtContinue  (11861204, 0, ...
 02723   584   NtContinue  (12907708, 0, ...
 02724   384   NtContinue  (11861204, 0, ...
 02725   584   NtContinue  (12907708, 0, ...
 02726   384   NtContinue  (11861204, 0, ...
 02727   584   NtContinue  (12907708, 0, ...
 02728   384   NtContinue  (11861204, 0, ...
 02729   584   NtContinue  (12907708, 0, ...
 02730   384   NtContinue  (11861204, 0, ...
 02731   584   NtContinue  (12907708, 0, ...
 02732   588   NtContinue  (9764056, 0, ...
 02733   384   NtContinue  (11861204, 0, ...
 02734   588   NtContinue  (9764056, 0, ...
 02735   384   NtContinue  (11861204, 0, ...
 02736   588   NtContinue  (9764056, 0, ...
 02737   384   NtContinue  (11861204, 0, ...
 02738   588   NtContinue  (9764056, 0, ...
 02739   384   NtContinue  (11861204, 0, ...
 02740   588   NtContinue  (9764056, 0, ...
 02741   384   NtContinue  (11861204, 0, ...
 02742   588   NtContinue  (9764056, 0, ...
 02743   384   NtContinue  (11861204, 0, ...
 02744   584   NtContinue  (12907708, 0, ...
 02745   588   NtContinue  (9764056, 0, ...
 02746   584   NtContinue  (12907708, 0, ...
 02747   588   NtContinue  (9764056, 0, ...
 02748   584   NtContinue  (12907708, 0, ...
 02749   588   NtContinue  (9764056, 0, ...
 02750   584   NtContinue  (12907708, 0, ...
 02751   588   NtContinue  (9764056, 0, ...
 02752   584   NtContinue  (12907708, 0, ...
 02753   588   NtContinue  (9764056, 0, ...
 02754   584   NtContinue  (12907708, 0, ...
 02755   588   NtContinue  (9764056, 0, ...
 02756   384   NtContinue  (11861204, 0, ...
 02757   584   NtContinue  (12907708, 0, ...
 02758   384   NtContinue  (11861204, 0, ...
 02759   584   NtContinue  (12907708, 0, ...
 02760   384   NtContinue  (11861204, 0, ...
 02761   584   NtContinue  (12907708, 0, ...
 02762   384   NtContinue  (11861204, 0, ...
 02763   584   NtContinue  (12907708, 0, ...
 02764   384   NtContinue  (11861204, 0, ...
 02765   584   NtContinue  (12907708, 0, ...
 02766   384   NtContinue  (11861204, 0, ...
 02767   584   NtContinue  (12907708, 0, ...
 02768   588   NtContinue  (9764056, 0, ...
 02769   384   NtContinue  (11861204, 0, ...
 02770   588   NtContinue  (9764056, 0, ...
 02771   384   NtContinue  (11861204, 0, ...
 02772   588   NtContinue  (9764056, 0, ...
 02773   384   NtContinue  (11861204, 0, ...
 02774   588   NtContinue  (9764056, 0, ...
 02775   384   NtContinue  (11861204, 0, ...
 02776   588   NtContinue  (9764056, 0, ...
 02777   384   NtContinue  (11861204, 0, ...
 02778   588   NtContinue  (9764056, 0, ...
 02779   384   NtContinue  (11861204, 0, ...
 02780   584   NtContinue  (12907708, 0, ...
 02781   588   NtContinue  (9764056, 0, ...
 02782   584   NtContinue  (12907708, 0, ...
 02783   588   NtContinue  (9764056, 0, ...
 02784   584   NtContinue  (12907708, 0, ...
 02785   588   NtContinue  (9764056, 0, ...
 02786   584   NtContinue  (12907708, 0, ...
 02787   588   NtContinue  (9764056, 0, ...
 02788   584   NtContinue  (12907708, 0, ...
 02789   588   NtContinue  (9764056, 0, ...
 02790   584   NtContinue  (12907708, 0, ...
 02791   588   NtContinue  (9764056, 0, ...
 02792   384   NtContinue  (11861204, 0, ...
 02793   584   NtContinue  (12907708, 0, ...
 02794   384   NtContinue  (11861204, 0, ...
 02795   584   NtContinue  (12907708, 0, ...
 02796   384   NtContinue  (11861204, 0, ...
 02797   584   NtContinue  (12907708, 0, ...
 02798   384   NtContinue  (11861204, 0, ...
 02799   584   NtContinue  (12907708, 0, ...
 02800   384   NtContinue  (11861204, 0, ...
 02801   584   NtContinue  (12907708, 0, ...
 02802   384   NtContinue  (11861204, 0, ...
 02803   584   NtContinue  (12907708, 0, ...
 02804   588   NtContinue  (9764056, 0, ...
 02805   384   NtContinue  (11861204, 0, ...
 02806   588   NtContinue  (9764056, 0, ...
 02807   384   NtContinue  (11861204, 0, ...
 02808   588   NtContinue  (9764056, 0, ...
 02809   384   NtContinue  (11861204, 0, ...
 02810   588   NtContinue  (9764056, 0, ...
 02811   384   NtContinue  (11861204, 0, ...
 02812   588   NtContinue  (9764056, 0, ...
 02813   384   NtContinue  (11861204, 0, ...
 02814   588   NtContinue  (9764056, 0, ...
 02815   384   NtContinue  (11861204, 0, ...
 02816   584   NtContinue  (12907708, 0, ...
 02817   588   NtContinue  (9764056, 0, ...
 02818   584   NtContinue  (12907708, 0, ...
 02819   588   NtContinue  (9764056, 0, ...
 02820   584   NtContinue  (12907708, 0, ...
 02821   588   NtContinue  (9764056, 0, ...
 02822   584   NtContinue  (12907708, 0, ...
 02823   588   NtContinue  (9764056, 0, ...
 02824   584   NtContinue  (12907708, 0, ...
 02825   588   NtContinue  (9764056, 0, ...
 02826   584   NtContinue  (12907708, 0, ...
 02827   588   NtContinue  (9764056, 0, ...
 02828   384   NtContinue  (11861204, 0, ...
 02829   584   NtContinue  (12907708, 0, ...
 02830   384   NtContinue  (11861204, 0, ...
 02831   584   NtContinue  (12907708, 0, ...
 02832   384   NtContinue  (11861204, 0, ...
 02833   584   NtContinue  (12907708, 0, ...
 02834   384   NtContinue  (11861204, 0, ...
 02835   584   NtContinue  (12907708, 0, ...
 02836   384   NtContinue  (11861204, 0, ...
 02837   584   NtContinue  (12907708, 0, ...
 02838   384   NtContinue  (11861204, 0, ...
 02839   584   NtContinue  (12907708, 0, ...
 02840   588   NtContinue  (9764056, 0, ...
 02841   384   NtContinue  (11861204, 0, ...
 02842   588   NtContinue  (9764056, 0, ...
 02843   384   NtContinue  (11861204, 0, ...
 02844   588   NtContinue  (9764056, 0, ...
 02845   384   NtContinue  (11861204, 0, ...
 02846   588   NtContinue  (9764056, 0, ...
 02847   384   NtContinue  (11861204, 0, ...
 02848   588   NtContinue  (9764056, 0, ...
 02849   384   NtContinue  (11861204, 0, ...
 02850   588   NtContinue  (9764056, 0, ...
 02851   384   NtContinue  (11861204, 0, ...
 02852   584   NtContinue  (12907708, 0, ...
 02853   588   NtContinue  (9764056, 0, ...
 02854   584   NtContinue  (12907708, 0, ...
 02855   588   NtContinue  (9764056, 0, ...
 02856   584   NtContinue  (12907708, 0, ...
 02857   588   NtContinue  (9764056, 0, ...
 02858   584   NtContinue  (12907708, 0, ...
 02859   588   NtContinue  (9764056, 0, ...
 02860   584   NtContinue  (12907708, 0, ...
 02861   588   NtContinue  (9764056, 0, ...
 02862   584   NtContinue  (12907708, 0, ...
 02863   588   NtContinue  (9764056, 0, ...
 02864   384   NtContinue  (11861204, 0, ...
 02865   584   NtContinue  (12907708, 0, ...
 02866   384   NtContinue  (11861204, 0, ...
 02867   584   NtContinue  (12907708, 0, ...
 02868   384   NtContinue  (11861204, 0, ...
 02869   584   NtContinue  (12907708, 0, ...
 02870   384   NtContinue  (11861204, 0, ...
 02871   584   NtContinue  (12907708, 0, ...
 02872   384   NtContinue  (11861204, 0, ...
 02873   584   NtContinue  (12907708, 0, ...
 02874   384   NtContinue  (11861204, 0, ...
 02875   584   NtContinue  (12907708, 0, ...
 02876   588   NtContinue  (9764056, 0, ...
 02877   384   NtContinue  (11861204, 0, ...
 02878   588   NtContinue  (9764056, 0, ...
 02879   384   NtContinue  (11861204, 0, ...
 02880   588   NtContinue  (9764056, 0, ...
 02881   384   NtContinue  (11861204, 0, ...
 02882   588   NtContinue  (9764056, 0, ...
 02883   384   NtContinue  (11861204, 0, ...
 02884   588   NtContinue  (9764056, 0, ...
 02885   384   NtContinue  (11861204, 0, ...
 02886   588   NtContinue  (9764056, 0, ...
 02887   384   NtContinue  (11861204, 0, ...
 02888   584   NtContinue  (12907708, 0, ...
 02889   588   NtContinue  (9764056, 0, ...
 02890   584   NtContinue  (12907708, 0, ...
 02891   588   NtContinue  (9764056, 0, ...
 02892   584   NtContinue  (12907708, 0, ...
 02893   588   NtContinue  (9764056, 0, ...
 02894   584   NtContinue  (12907708, 0, ...
 02895   588   NtContinue  (9764056, 0, ...
 02896   584   NtContinue  (12907708, 0, ...
 02897   588   NtContinue  (9764056, 0, ...
 02898   584   NtContinue  (12907708, 0, ...
 02899   588   NtContinue  (9764056, 0, ...
 02900   384   NtContinue  (11861204, 0, ...
 02901   584   NtContinue  (12907708, 0, ...
 02902   384   NtContinue  (11861204, 0, ...
 02903   584   NtContinue  (12907708, 0, ...
 02904   384   NtContinue  (11861204, 0, ...
 02905   584   NtContinue  (12907708, 0, ...
 02906   384   NtContinue  (11861204, 0, ...
 02907   584   NtContinue  (12907708, 0, ...
 02908   384   NtContinue  (11861204, 0, ...
 02909   584   NtContinue  (12907708, 0, ...
 02910   384   NtContinue  (11861204, 0, ...
 02911   584   NtContinue  (12907708, 0, ...
 02912   588   NtContinue  (9764056, 0, ...
 02913   384   NtContinue  (11861204, 0, ...
 02914   588   NtContinue  (9764056, 0, ...
 02915   384   NtContinue  (11861204, 0, ...
 02916   588   NtContinue  (9764056, 0, ...
 02917   384   NtContinue  (11861204, 0, ...
 02918   588   NtContinue  (9764056, 0, ...
 02919   384   NtContinue  (11861204, 0, ...
 02920   588   NtContinue  (9764056, 0, ...
 02921   384   NtContinue  (11861204, 0, ...
 02922   588   NtContinue  (9764056, 0, ...
 02923   384   NtContinue  (11861204, 0, ...
 02924   584   NtContinue  (12907708, 0, ...
 02925   588   NtContinue  (9764056, 0, ...
 02926   584   NtContinue  (12907708, 0, ...
 02927   588   NtContinue  (9764056, 0, ...
 02928   584   NtContinue  (12907708, 0, ...
 02929   588   NtContinue  (9764056, 0, ...
 02930   584   NtContinue  (12907708, 0, ...
 02931   588   NtContinue  (9764056, 0, ...
 02932   584   NtContinue  (12907708, 0, ...
 02933   588   NtContinue  (9764056, 0, ...
 02934   584   NtContinue  (12907708, 0, ...
 02935   588   NtContinue  (9764056, 0, ...
 02936   384   NtContinue  (11861204, 0, ...
 02937   584   NtContinue  (12907708, 0, ...
 02938   384   NtContinue  (11861204, 0, ...
 02939   584   NtContinue  (12907708, 0, ...
 02940   384   NtContinue  (11861204, 0, ...
 02941   584   NtContinue  (12907708, 0, ...
 02942   384   NtContinue  (11861204, 0, ...
 02943   584   NtContinue  (12907708, 0, ...
 02944   384   NtContinue  (11861204, 0, ...
 02945   584   NtContinue  (12907708, 0, ...
 02946   384   NtContinue  (11861204, 0, ...
 02947   584   NtContinue  (12907708, 0, ...
 02948   588   NtContinue  (9764056, 0, ...
 02949   384   NtContinue  (11861204, 0, ...
 02950   588   NtContinue  (9764056, 0, ...
 02951   384   NtContinue  (11861204, 0, ...
 02952   588   NtContinue  (9764056, 0, ...
 02953   384   NtContinue  (11861204, 0, ...
 02954   588   NtContinue  (9764056, 0, ...
 02955   384   NtContinue  (11861204, 0, ...
 02956   588   NtContinue  (9764056, 0, ...
 02957   384   NtContinue  (11861204, 0, ...
 02958   588   NtContinue  (9764056, 0, ...
 02959   384   NtContinue  (11861204, 0, ...
 02960   584   NtContinue  (12907708, 0, ...
 02961   588   NtContinue  (9764056, 0, ...
 02962   584   NtContinue  (12907708, 0, ...
 02963   588   NtContinue  (9764056, 0, ...
 02964   584   NtContinue  (12907708, 0, ...
 02965   588   NtContinue  (9764056, 0, ...
 02966   584   NtContinue  (12907708, 0, ...
 02967   588   NtContinue  (9764056, 0, ...
 02968   584   NtContinue  (12907708, 0, ...
 02969   588   NtContinue  (9764056, 0, ...
 02970   584   NtContinue  (12907708, 0, ...
 02971   588   NtContinue  (9764056, 0, ...
 02972   384   NtContinue  (11861204, 0, ...
 02973   584   NtContinue  (12907708, 0, ...
 02974   384   NtContinue  (11861204, 0, ...
 02975   584   NtContinue  (12907708, 0, ...
 02976   384   NtContinue  (11861204, 0, ...
 02977   584   NtContinue  (12907708, 0, ...
 02978   384   NtContinue  (11861204, 0, ...
 02979   584   NtContinue  (12907708, 0, ...
 02980   384   NtContinue  (11861204, 0, ...
 02981   584   NtContinue  (12907708, 0, ...
 02982   384   NtContinue  (11861204, 0, ...
 02983   584   NtContinue  (12907708, 0, ...
 02984   588   NtContinue  (9764056, 0, ...
 02985   384   NtContinue  (11861204, 0, ...
 02986   588   NtContinue  (9764056, 0, ...
 02987   384   NtContinue  (11861204, 0, ...
 02988   588   NtContinue  (9764056, 0, ...
 02989   384   NtContinue  (11861204, 0, ...
 02990   588   NtContinue  (9764056, 0, ...
 02991   384   NtContinue  (11861204, 0, ...
 02992   588   NtContinue  (9764056, 0, ...
 02993   384   NtContinue  (11861204, 0, ...
 02994   588   NtContinue  (9764056, 0, ...
 02995   384   NtContinue  (11861204, 0, ...
 02996   584   NtContinue  (12907708, 0, ...
 02997   588   NtContinue  (9764056, 0, ...
 02998   584   NtContinue  (12907708, 0, ...
 02999   588   NtContinue  (9764056, 0, ...
 03000   584   NtContinue  (12907708, 0, ...
 03001   588   NtContinue  (9764056, 0, ...
 03002   584   NtContinue  (12907708, 0, ...
 03003   588   NtContinue  (9764056, 0, ...
 03004   584   NtContinue  (12907708, 0, ...
 03005   584   NtContinue  (12907708, 0, ...
 03006   584   NtContinue  (12907708, 0, ...
 03007   584   NtContinue  (12907708, 0, ...
 03008   584   NtContinue  (12907708, 0, ...
 03009   584   NtContinue  (12907708, 0, ...
 03010   584   NtContinue  (12907708, 0, ...
 03011   584   NtContinue  (12907708, 0, ...
 03012   384   NtContinue  (11861204, 0, ...
 03013   588   NtContinue  (9764056, 0, ...
 03014   384   NtContinue  (11861204, 0, ...
 03015   588   NtContinue  (9764056, 0, ...
 03016   384   NtContinue  (11861204, 0, ...
 03017   588   NtContinue  (9764056, 0, ...
 03018   384   NtContinue  (11861204, 0, ...
 03019   588   NtContinue  (9764056, 0, ...
 03020   384   NtContinue  (11861204, 0, ...
 03021   588   NtContinue  (9764056, 0, ...
 03022   384   NtContinue  (11861204, 0, ...
 03023   588   NtContinue  (9764056, 0, ...
 03024   584   NtContinue  (12907708, 0, ...
 03025   384   NtContinue  (11861204, 0, ...
 03026   584   NtContinue  (12907708, 0, ...
 03027   384   NtContinue  (11861204, 0, ...
 03028   584   NtContinue  (12907708, 0, ...
 03029   384   NtContinue  (11861204, 0, ...
 03030   584   NtContinue  (12907708, 0, ...
 03031   384   NtContinue  (11861204, 0, ...
 03032   584   NtContinue  (12907708, 0, ...
 03033   384   NtContinue  (11861204, 0, ...
 03034   584   NtContinue  (12907708, 0, ...
 03035   384   NtContinue  (11861204, 0, ...
 03036   588   NtContinue  (9764056, 0, ...
 03037   584   NtContinue  (12907708, 0, ...
 03038   588   NtContinue  (9764056, 0, ...
 03039   584   NtContinue  (12907708, 0, ...
 03040   588   NtContinue  (9764056, 0, ...
 03041   584   NtContinue  (12907708, 0, ...
 03042   588   NtContinue  (9764056, 0, ...
 03043   584   NtContinue  (12907708, 0, ...
 03044   588   NtContinue  (9764056, 0, ...
 03045   584   NtContinue  (12907708, 0, ...
 03046   588   NtContinue  (9764056, 0, ...
 03047   584   NtContinue  (12907708, 0, ...
 03048   384   NtContinue  (11861204, 0, ...
 03049   588   NtContinue  (9764056, 0, ...
 03050   384   NtContinue  (11861204, 0, ...
 03051   588   NtContinue  (9764056, 0, ...
 03052   384   NtContinue  (11861204, 0, ...
 03053   588   NtContinue  (9764056, 0, ...
 03054   384   NtContinue  (11861204, 0, ...
 03055   588   NtContinue  (9764056, 0, ...
 03056   384   NtContinue  (11861204, 0, ...
 03057   588   NtContinue  (9764056, 0, ...
 03058   384   NtContinue  (11861204, 0, ...
 03059   588   NtContinue  (9764056, 0, ...
 03060   584   NtContinue  (12907708, 0, ...
 03061   384   NtContinue  (11861204, 0, ...
 03062   584   NtContinue  (12907708, 0, ...
 03063   384   NtContinue  (11861204, 0, ...
 03064   584   NtContinue  (12907708, 0, ...
 03065   384   NtContinue  (11861204, 0, ...
 03066   584   NtContinue  (12907708, 0, ...
 03067   384   NtContinue  (11861204, 0, ...
 03068   584   NtContinue  (12907708, 0, ...
 03069   384   NtContinue  (11861204, 0, ...
 03070   584   NtContinue  (12907708, 0, ...
 03071   384   NtContinue  (11861204, 0, ...
 03072   588   NtContinue  (9764056, 0, ...
 03073   584   NtContinue  (12907708, 0, ...
 03074   588   NtContinue  (9764056, 0, ...
 03075   584   NtContinue  (12907708, 0, ...
 03076   588   NtContinue  (9764056, 0, ...
 03077   584   NtContinue  (12907708, 0, ...
 03078   588   NtContinue  (9764056, 0, ...
 03079   584   NtContinue  (12907708, 0, ...
 03080   588   NtContinue  (9764056, 0, ...
 03081   584   NtContinue  (12907708, 0, ...
 03082   588   NtContinue  (9764056, 0, ...
 03083   584   NtContinue  (12907708, 0, ...
 03084   384   NtContinue  (11861204, 0, ...
 03085   588   NtContinue  (9764056, 0, ...
 03086   384   NtContinue  (11861204, 0, ...
 03087   588   NtContinue  (9764056, 0, ...
 03088   384   NtContinue  (11861204, 0, ...
 03089   588   NtContinue  (9764056, 0, ...
 03090   384   NtContinue  (11861204, 0, ...
 03091   588   NtContinue  (9764056, 0, ...
 03092   384   NtContinue  (11861204, 0, ...
 03093   588   NtContinue  (9764056, 0, ...
 03094   384   NtContinue  (11861204, 0, ...
 03095   588   NtContinue  (9764056, 0, ...
 03096   584   NtContinue  (12907708, 0, ...
 03097   384   NtContinue  (11861204, 0, ...
 03098   584   NtContinue  (12907708, 0, ...
 03099   384   NtContinue  (11861204, 0, ...
 03100   584   NtContinue  (12907708, 0, ...
 03101   384   NtContinue  (11861204, 0, ...
 03102   584   NtContinue  (12907708, 0, ...
 03103   384   NtContinue  (11861204, 0, ...
 03104   584   NtContinue  (12907708, 0, ...
 03105   384   NtContinue  (11861204, 0, ...
 03106   584   NtContinue  (12907708, 0, ...
 03107   384   NtContinue  (11861204, 0, ...
 03108   588   NtContinue  (9764056, 0, ...
 03109   584   NtContinue  (12907708, 0, ...
 03110   588   NtContinue  (9764056, 0, ...
 03111   584   NtContinue  (12907708, 0, ...
 03112   588   NtContinue  (9764056, 0, ...
 03113   584   NtContinue  (12907708, 0, ...
 03114   588   NtContinue  (9764056, 0, ...
 03115   584   NtContinue  (12907708, 0, ...
 03116   588   NtContinue  (9764056, 0, ...
 03117   584   NtContinue  (12907708, 0, ...
 03118   588   NtContinue  (9764056, 0, ...
 03119   584   NtContinue  (12907708, 0, ...
 03120   384   NtContinue  (11861204, 0, ...
 03121   588   NtContinue  (9764056, 0, ...
 03122   384   NtContinue  (11861204, 0, ...
 03123   588   NtContinue  (9764056, 0, ...
 03124   384   NtContinue  (11861204, 0, ...
 03125   588   NtContinue  (9764056, 0, ...
 03126   384   NtContinue  (11861204, 0, ...
 03127   588   NtContinue  (9764056, 0, ...
 03128   384   NtContinue  (11861204, 0, ...
 03129   588   NtContinue  (9764056, 0, ...
 03130   384   NtContinue  (11861204, 0, ...
 03131   588   NtContinue  (9764056, 0, ...
 03132   584   NtContinue  (12907708, 0, ...
 03133   384   NtContinue  (11861204, 0, ...
 03134   584   NtContinue  (12907708, 0, ...
 03135   384   NtContinue  (11861204, 0, ...
 03136   584   NtContinue  (12907708, 0, ...
 03137   384   NtContinue  (11861204, 0, ...
 03138   584   NtContinue  (12907708, 0, ...
 03139   384   NtContinue  (11861204, 0, ...
 03140   584   NtContinue  (12907708, 0, ...
 03141   384   NtContinue  (11861204, 0, ...
 03142   584   NtContinue  (12907708, 0, ...
 03143   384   NtContinue  (11861204, 0, ...
 03144   588   NtContinue  (9764056, 0, ...
 03145   584   NtContinue  (12907708, 0, ...
 03146   588   NtContinue  (9764056, 0, ...
 03147   584   NtContinue  (12907708, 0, ...
 03148   588   NtContinue  (9764056, 0, ...
 03149   584   NtContinue  (12907708, 0, ...
 03150   588   NtContinue  (9764056, 0, ...
 03151   584   NtContinue  (12907708, 0, ...
 03152   588   NtContinue  (9764056, 0, ...
 03153   584   NtContinue  (12907708, 0, ...
 03154   588   NtContinue  (9764056, 0, ...
 03155   584   NtContinue  (12907708, 0, ...
 03156   384   NtContinue  (11861204, 0, ...
 03157   588   NtContinue  (9764056, 0, ...
 03158   384   NtContinue  (11861204, 0, ...
 03159   588   NtContinue  (9764056, 0, ...
 03160   384   NtContinue  (11861204, 0, ...
 03161   588   NtContinue  (9764056, 0, ...
 03162   384   NtContinue  (11861204, 0, ...
 03163   588   NtContinue  (9764056, 0, ...
 03164   384   NtContinue  (11861204, 0, ...
 03165   588   NtContinue  (9764056, 0, ...
 03166   384   NtContinue  (11861204, 0, ...
 03167   588   NtContinue  (9764056, 0, ...
 03168   584   NtContinue  (12907708, 0, ...
 03169   384   NtContinue  (11861204, 0, ...
 03170   584   NtContinue  (12907708, 0, ...
 03171   384   NtContinue  (11861204, 0, ...
 03172   584   NtContinue  (12907708, 0, ...
 03173   384   NtContinue  (11861204, 0, ...
 03174   584   NtContinue  (12907708, 0, ...
 03175   384   NtContinue  (11861204, 0, ...
 03176   584   NtContinue  (12907708, 0, ...
 03177   384   NtContinue  (11861204, 0, ...
 03178   584   NtContinue  (12907708, 0, ...
 03179   384   NtContinue  (11861204, 0, ...
 03180   588   NtContinue  (9764056, 0, ...
 03181   584   NtContinue  (12907708, 0, ...
 03182   588   NtContinue  (9764056, 0, ...
 03183   584   NtContinue  (12907708, 0, ...
 03184   588   NtContinue  (9764056, 0, ...
 03185   584   NtContinue  (12907708, 0, ...
 03186   588   NtContinue  (9764056, 0, ...
 03187   584   NtContinue  (12907708, 0, ...
 03188   588   NtContinue  (9764056, 0, ...
 03189   584   NtContinue  (12907708, 0, ...
 03190   588   NtContinue  (9764056, 0, ...
 03191   584   NtContinue  (12907708, 0, ...
 03192   384   NtContinue  (11861204, 0, ...
 03193   588   NtContinue  (9764056, 0, ...
 03194   384   NtContinue  (11861204, 0, ...
 03195   588   NtContinue  (9764056, 0, ...
 03196   384   NtContinue  (11861204, 0, ...
 03197   588   NtContinue  (9764056, 0, ...
 03198   384   NtContinue  (11861204, 0, ...
 03199   588   NtContinue  (9764056, 0, ...
 03200   384   NtContinue  (11861204, 0, ...
 03201   588   NtContinue  (9764056, 0, ...
 03202   384   NtContinue  (11861204, 0, ...
 03203   588   NtContinue  (9764056, 0, ...
 03204   584   NtContinue  (12907708, 0, ...
 03205   384   NtContinue  (11861204, 0, ...
 03206   584   NtContinue  (12907708, 0, ...
 03207   384   NtContinue  (11861204, 0, ...
 03208   584   NtContinue  (12907708, 0, ...
 03209   384   NtContinue  (11861204, 0, ...
 03210   584   NtContinue  (12907708, 0, ...
 03211   384   NtContinue  (11861204, 0, ...
 03212   584   NtContinue  (12907708, 0, ...
 03213   384   NtContinue  (11861204, 0, ...
 03214   384   NtContinue  (11861204, 0, ...
 03215   384   NtContinue  (11861204, 0, ...
 03216   384   NtContinue  (11861204, 0, ...
 03217   384   NtContinue  (11861204, 0, ...
 03218   384   NtContinue  (11861204, 0, ...
 03219   384   NtContinue  (11861204, 0, ...
 03220   384   NtContinue  (11861204, 0, ...
 03221   584   NtContinue  (12907708, 0, ...
 03222   588   NtContinue  (9764056, 0, ...
 03223   584   NtContinue  (12907708, 0, ...
 03224   588   NtContinue  (9764056, 0, ...
 03225   584   NtContinue  (12907708, 0, ...
 03226   588   NtContinue  (9764056, 0, ...
 03227   584   NtContinue  (12907708, 0, ...
 03228   588   NtContinue  (9764056, 0, ...
 03229   584   NtContinue  (12907708, 0, ...
 03230   588   NtContinue  (9764056, 0, ...
 03231   584   NtContinue  (12907708, 0, ...
 03232   588   NtContinue  (9764056, 0, ...
 03233   384   NtContinue  (11861204, 0, ...
 03234   584   NtContinue  (12907708, 0, ...
 03235   384   NtContinue  (11861204, 0, ...
 03236   584   NtContinue  (12907708, 0, ...
 03237   384   NtContinue  (11861204, 0, ...
 03238   584   NtContinue  (12907708, 0, ...
 03239   384   NtContinue  (11861204, 0, ...
 03240   584   NtContinue  (12907708, 0, ...
 03241   384   NtContinue  (11861204, 0, ...
 03242   584   NtContinue  (12907708, 0, ...
 03243   384   NtContinue  (11861204, 0, ...
 03244   584   NtContinue  (12907708, 0, ...
 03245   588   NtContinue  (9764056, 0, ...
 03246   384   NtContinue  (11861204, 0, ...
 03247   588   NtContinue  (9764056, 0, ...
 03248   384   NtContinue  (11861204, 0, ...
 03249   588   NtContinue  (9764056, 0, ...
 03250   384   NtContinue  (11861204, 0, ...
 03251   588   NtContinue  (9764056, 0, ...
 03252   384   NtContinue  (11861204, 0, ...
 03253   588   NtContinue  (9764056, 0, ...
 03254   384   NtContinue  (11861204, 0, ...
 03255   588   NtContinue  (9764056, 0, ...
 03256   384   NtContinue  (11861204, 0, ...
 03257   584   NtContinue  (12907708, 0, ...
 03258   588   NtContinue  (9764056, 0, ...
 03259   584   NtContinue  (12907708, 0, ...
 03260   588   NtContinue  (9764056, 0, ...
 03261   584   NtContinue  (12907708, 0, ...
 03262   588   NtContinue  (9764056, 0, ...
 03263   584   NtContinue  (12907708, 0, ...
 03264   588   NtContinue  (9764056, 0, ...
 03265   584   NtContinue  (12907708, 0, ...
 03266   588   NtContinue  (9764056, 0, ...
 03267   584   NtContinue  (12907708, 0, ...
 03268   588   NtContinue  (9764056, 0, ...
 03269   384   NtContinue  (11861204, 0, ...
 03270   584   NtContinue  (12907708, 0, ...
 03271   384   NtContinue  (11861204, 0, ...
 03272   584   NtContinue  (12907708, 0, ...
 03273   384   NtContinue  (11861204, 0, ...
 03274   584   NtContinue  (12907708, 0, ...
 03275   384   NtContinue  (11861204, 0, ...
 03276   584   NtContinue  (12907708, 0, ...
 03277   384   NtContinue  (11861204, 0, ...
 03278   584   NtContinue  (12907708, 0, ...
 03279   384   NtContinue  (11861204, 0, ...
 03280   584   NtContinue  (12907708, 0, ...
 03281   588   NtContinue  (9764056, 0, ...
 03282   384   NtContinue  (11861204, 0, ...
 03283   588   NtContinue  (9764056, 0, ...
 03284   384   NtContinue  (11861204, 0, ...
 03285   588   NtContinue  (9764056, 0, ...
 03286   384   NtContinue  (11861204, 0, ...
 03287   588   NtContinue  (9764056, 0, ...
 03288   384   NtContinue  (11861204, 0, ...
 03289   588   NtContinue  (9764056, 0, ...
 03290   384   NtContinue  (11861204, 0, ...
 03291   588   NtContinue  (9764056, 0, ...
 03292   384   NtContinue  (11861204, 0, ...
 03293   584   NtContinue  (12907708, 0, ...
 03294   588   NtContinue  (9764056, 0, ...
 03295   584   NtContinue  (12907708, 0, ...
 03296   588   NtContinue  (9764056, 0, ...
 03297   584   NtContinue  (12907708, 0, ...
 03298   588   NtContinue  (9764056, 0, ...
 03299   584   NtContinue  (12907708, 0, ...
 03300   588   NtContinue  (9764056, 0, ...
 03301   584   NtContinue  (12907708, 0, ...
 03302   588   NtContinue  (9764056, 0, ...
 03303   584   NtContinue  (12907708, 0, ...
 03304   588   NtContinue  (9764056, 0, ...
 03305   384   NtContinue  (11861204, 0, ...
 03306   584   NtContinue  (12907708, 0, ...
 03307   384   NtContinue  (11861204, 0, ...
 03308   584   NtContinue  (12907708, 0, ...
 03309   384   NtContinue  (11861204, 0, ...
 03310   584   NtContinue  (12907708, 0, ...
 03311   384   NtContinue  (11861204, 0, ...
 03312   584   NtContinue  (12907708, 0, ...
 03313   384   NtContinue  (11861204, 0, ...
 03314   584   NtContinue  (12907708, 0, ...
 03315   384   NtContinue  (11861204, 0, ...
 03316   584   NtContinue  (12907708, 0, ...
 03317   588   NtContinue  (9764056, 0, ...
 03318   384   NtContinue  (11861204, 0, ...
 03319   588   NtContinue  (9764056, 0, ...
 03320   384   NtContinue  (11861204, 0, ...
 03321   588   NtContinue  (9764056, 0, ...
 03322   384   NtContinue  (11861204, 0, ...
 03323   588   NtContinue  (9764056, 0, ...
 03324   384   NtContinue  (11861204, 0, ...
 03325   588   NtContinue  (9764056, 0, ...
 03326   384   NtContinue  (11861204, 0, ...
 03327   588   NtContinue  (9764056, 0, ...
 03328   384   NtContinue  (11861204, 0, ...
 03329   584   NtContinue  (12907708, 0, ...
 03330   588   NtContinue  (9764056, 0, ...
 03331   584   NtContinue  (12907708, 0, ...
 03332   588   NtContinue  (9764056, 0, ...
 03333   584   NtContinue  (12907708, 0, ...
 03334   588   NtContinue  (9764056, 0, ...
 03335   584   NtContinue  (12907708, 0, ...
 03336   588   NtContinue  (9764056, 0, ...
 03337   584   NtContinue  (12907708, 0, ...
 03338   588   NtContinue  (9764056, 0, ...
 03339   584   NtContinue  (12907708, 0, ...
 03340   588   NtContinue  (9764056, 0, ...
 03341   384   NtContinue  (11861204, 0, ...
 03342   584   NtContinue  (12907708, 0, ...
 03343   384   NtContinue  (11861204, 0, ...
 03344   584   NtContinue  (12907708, 0, ...
 03345   384   NtContinue  (11861204, 0, ...
 03346   584   NtContinue  (12907708, 0, ...
 03347   384   NtContinue  (11861204, 0, ...
 03348   584   NtContinue  (12907708, 0, ...
 03349   384   NtContinue  (11861204, 0, ...
 03350   584   NtContinue  (12907708, 0, ...
 03351   384   NtContinue  (11861204, 0, ...
 03352   584   NtContinue  (12907708, 0, ...
 03353   588   NtContinue  (9764056, 0, ...
 03354   384   NtContinue  (11861204, 0, ...
 03355   588   NtContinue  (9764056, 0, ...
 03356   384   NtContinue  (11861204, 0, ...
 03357   588   NtContinue  (9764056, 0, ...
 03358   384   NtContinue  (11861204, 0, ...
 03359   588   NtContinue  (9764056, 0, ...
 03360   384   NtContinue  (11861204, 0, ...
 03361   588   NtContinue  (9764056, 0, ...
 03362   384   NtContinue  (11861204, 0, ...
 03363   588   NtContinue  (9764056, 0, ...
 03364   384   NtContinue  (11861204, 0, ...
 03365   584   NtContinue  (12907708, 0, ...
 03366   588   NtContinue  (9764056, 0, ...
 03367   584   NtContinue  (12907708, 0, ...
 03368   588   NtContinue  (9764056, 0, ...
 03369   584   NtContinue  (12907708, 0, ...
 03370   588   NtContinue  (9764056, 0, ...
 03371   584   NtContinue  (12907708, 0, ...
 03372   588   NtContinue  (9764056, 0, ...
 03373   584   NtContinue  (12907708, 0, ...
 03374   588   NtContinue  (9764056, 0, ...
 03375   584   NtContinue  (12907708, 0, ...
 03376   588   NtContinue  (9764056, 0, ...
 03377   384   NtContinue  (11861204, 0, ...
 03378   584   NtContinue  (12907708, 0, ...
 03379   384   NtContinue  (11861204, 0, ...
 03380   584   NtContinue  (12907708, 0, ...
 03381   384   NtContinue  (11861204, 0, ...
 03382   584   NtContinue  (12907708, 0, ...
 03383   384   NtContinue  (11861204, 0, ...
 03384   584   NtContinue  (12907708, 0, ...
 03385   384   NtContinue  (11861204, 0, ...
 03386   584   NtContinue  (12907708, 0, ...
 03387   384   NtContinue  (11861204, 0, ...
 03388   584   NtContinue  (12907708, 0, ...
 03389   588   NtContinue  (9764056, 0, ...
 03390   384   NtContinue  (11861204, 0, ...
 03391   588   NtContinue  (9764056, 0, ...
 03392   384   NtContinue  (11861204, 0, ...
 03393   588   NtContinue  (9764056, 0, ...
 03394   384   NtContinue  (11861204, 0, ...
 03395   588   NtContinue  (9764056, 0, ...
 03396   384   NtContinue  (11861204, 0, ...
 03397   588   NtContinue  (9764056, 0, ...
 03398   384   NtContinue  (11861204, 0, ...
 03399   588   NtContinue  (9764056, 0, ...
 03400   384   NtContinue  (11861204, 0, ...
 03401   584   NtContinue  (12907708, 0, ...
 03402   588   NtContinue  (9764056, 0, ...
 03403   584   NtContinue  (12907708, 0, ...
 03404   588   NtContinue  (9764056, 0, ...
 03405   584   NtContinue  (12907708, 0, ...
 03406   588   NtContinue  (9764056, 0, ...
 03407   584   NtContinue  (12907708, 0, ...
 03408   588   NtContinue  (9764056, 0, ...
 03409   584   NtContinue  (12907708, 0, ...
 03410   588   NtContinue  (9764056, 0, ...
 03411   584   NtContinue  (12907708, 0, ...
 03412   588   NtContinue  (9764056, 0, ...
 03413   384   NtContinue  (11861204, 0, ...
 03414   584   NtContinue  (12907708, 0, ...
 03415   384   NtContinue  (11861204, 0, ...
 03416   584   NtContinue  (12907708, 0, ...
 03417   384   NtContinue  (11861204, 0, ...
 03418   584   NtContinue  (12907708, 0, ...
 03419   384   NtContinue  (11861204, 0, ...
 03420   584   NtContinue  (12907708, 0, ...
 03421   384   NtContinue  (11861204, 0, ...
 03422   584   NtContinue  (12907708, 0, ...
 03423   384   NtContinue  (11861204, 0, ...
 03424   584   NtContinue  (12907708, 0, ...
 03425   588   NtContinue  (9764056, 0, ...
 03426   384   NtContinue  (11861204, 0, ...
 03427   588   NtContinue  (9764056, 0, ...
 03428   384   NtContinue  (11861204, 0, ...
 03429   588   NtContinue  (9764056, 0, ...
 03430   384   NtContinue  (11861204, 0, ...
 03431   588   NtContinue  (9764056, 0, ...
 03432   384   NtContinue  (11861204, 0, ...
 03433   588   NtContinue  (9764056, 0, ...
 03434   384   NtContinue  (11861204, 0, ...
 03435   588   NtContinue  (9764056, 0, ...
 03436   384   NtContinue  (11861204, 0, ...
 03437   584   NtContinue  (12907708, 0, ...
 03438   588   NtContinue  (9764056, 0, ...
 03439   584   NtContinue  (12907708, 0, ...
 03440   588   NtContinue  (9764056, 0, ...
 03441   584   NtContinue  (12907708, 0, ...
 03442   588   NtContinue  (9764056, 0, ...
 03443   584   NtContinue  (12907708, 0, ...
 03444   588   NtContinue  (9764056, 0, ...
 03445   584   NtContinue  (12907708, 0, ...
 03446   588   NtContinue  (9764056, 0, ...
 03447   584   NtContinue  (12907708, 0, ...
 03448   588   NtContinue  (9764056, 0, ...
 03449   384   NtContinue  (11861204, 0, ...
 03450   584   NtContinue  (12907708, 0, ...
 03451   384   NtContinue  (11861204, 0, ...
 03452   584   NtContinue  (12907708, 0, ...
 03453   384   NtContinue  (11861204, 0, ...
 03454   584   NtContinue  (12907708, 0, ...
 03455   384   NtContinue  (11861204, 0, ...
 03456   584   NtContinue  (12907708, 0, ...
 03457   384   NtContinue  (11861204, 0, ...
 03458   584   NtContinue  (12907708, 0, ...
 03459   384   NtContinue  (11861204, 0, ...
 03460   584   NtContinue  (12907708, 0, ...
 03461   588   NtContinue  (9764056, 0, ...
 03462   384   NtContinue  (11861204, 0, ...
 03463   588   NtContinue  (9764056, 0, ...
 03464   384   NtContinue  (11861204, 0, ...
 03465   588   NtContinue  (9764056, 0, ...
 03466   384   NtContinue  (11861204, 0, ...
 03467   588   NtContinue  (9764056, 0, ...
 03468   384   NtContinue  (11861204, 0, ...
 03469   588   NtContinue  (9764056, 0, ...
 03470   384   NtContinue  (11861204, 0, ...
 03471   588   NtContinue  (9764056, 0, ...
 03472   384   NtContinue  (11861204, 0, ...
 03473   584   NtContinue  (12907708, 0, ...
 03474   588   NtContinue  (9764056, 0, ...
 03475   584   NtContinue  (12907708, 0, ...
 03476   588   NtContinue  (9764056, 0, ...
 03477   584   NtContinue  (12907708, 0, ...
 03478   588   NtContinue  (9764056, 0, ...
 03479   584   NtContinue  (12907708, 0, ...
 03480   588   NtContinue  (9764056, 0, ...
 03481   584   NtContinue  (12907708, 0, ...
 03482   588   NtContinue  (9764056, 0, ...
 03483   584   NtContinue  (12907708, 0, ...
 03484   588   NtContinue  (9764056, 0, ...
 03485   384   NtContinue  (11861204, 0, ...
 03486   584   NtContinue  (12907708, 0, ...
 03487   384   NtContinue  (11861204, 0, ...
 03488   584   NtContinue  (12907708, 0, ...
 03489   384   NtContinue  (11861204, 0, ...
 03490   584   NtContinue  (12907708, 0, ...
 03491   384   NtContinue  (11861204, 0, ...
 03492   584   NtContinue  (12907708, 0, ...
 03493   384   NtContinue  (11861204, 0, ...
 03494   584   NtContinue  (12907708, 0, ...
 03495   384   NtContinue  (11861204, 0, ...
 03496   584   NtContinue  (12907708, 0, ...
 03497   588   NtContinue  (9764056, 0, ...
 03498   384   NtContinue  (11861204, 0, ...
 03499   588   NtContinue  (9764056, 0, ...
 03500   384   NtContinue  (11861204, 0, ...
 03501   588   NtContinue  (9764056, 0, ...
 03502   384   NtContinue  (11861204, 0, ...
 03503   588   NtContinue  (9764056, 0, ...
 03504   384   NtContinue  (11861204, 0, ...
 03505   588   NtContinue  (9764056, 0, ...
 03506   384   NtContinue  (11861204, 0, ...
 03507   588   NtContinue  (9764056, 0, ...
 03508   384   NtContinue  (11861204, 0, ...
 03509   584   NtContinue  (12907708, 0, ...
 03510   588   NtContinue  (9764056, 0, ...
 03511   584   NtContinue  (12907708, 0, ...
 03512   588   NtContinue  (9764056, 0, ...
 03513   584   NtContinue  (12907708, 0, ...
 03514   588   NtContinue  (9764056, 0, ...
 03515   584   NtContinue  (12907708, 0, ...
 03516   588   NtContinue  (9764056, 0, ...
 03517   584   NtContinue  (12907708, 0, ...
 03518   588   NtContinue  (9764056, 0, ...
 03519   584   NtContinue  (12907708, 0, ...
 03520   588   NtContinue  (9764056, 0, ...
 03521   384   NtContinue  (11861204, 0, ...
 03522   584   NtContinue  (12907708, 0, ...
 03523   384   NtContinue  (11861204, 0, ...
 03524   584   NtContinue  (12907708, 0, ...
 03525   384   NtContinue  (11861204, 0, ...
 03526   584   NtContinue  (12907708, 0, ...
 03527   384   NtContinue  (11861204, 0, ...
 03528   584   NtContinue  (12907708, 0, ...
 03529   384   NtContinue  (11861204, 0, ...
 03530   584   NtContinue  (12907708, 0, ...
 03531   384   NtContinue  (11861204, 0, ...
 03532   584   NtContinue  (12907708, 0, ...
 03533   588   NtContinue  (9764056, 0, ...
 03534   384   NtContinue  (11861204, 0, ...
 03535   588   NtContinue  (9764056, 0, ...
 03536   384   NtContinue  (11861204, 0, ...
 03537   588   NtContinue  (9764056, 0, ...
 03538   384   NtContinue  (11861204, 0, ...
 03539   588   NtContinue  (9764056, 0, ...
 03540   384   NtContinue  (11861204, 0, ...
 03541   588   NtContinue  (9764056, 0, ...
 03542   384   NtContinue  (11861204, 0, ...
 03543   588   NtContinue  (9764056, 0, ...
 03544   384   NtContinue  (11861204, 0, ...
 03545   584   NtContinue  (12907708, 0, ...
 03546   588   NtContinue  (9764056, 0, ...
 03547   584   NtContinue  (12907708, 0, ...
 03548   588   NtContinue  (9764056, 0, ...
 03549   584   NtContinue  (12907708, 0, ...
 03550   588   NtContinue  (9764056, 0, ...
 03551   584   NtContinue  (12907708, 0, ...
 03552   588   NtContinue  (9764056, 0, ...
 03553   584   NtContinue  (12907708, 0, ...
 03554   588   NtContinue  (9764056, 0, ...
 03555   584   NtContinue  (12907708, 0, ...
 03556   588   NtContinue  (9764056, 0, ...
 03557   384   NtContinue  (11861204, 0, ...
 03558   584   NtContinue  (12907708, 0, ...
 03559   384   NtContinue  (11861204, 0, ...
 03560   584   NtContinue  (12907708, 0, ...
 03561   384   NtContinue  (11861204, 0, ...
 03562   584   NtContinue  (12907708, 0, ...
 03563   384   NtContinue  (11861204, 0, ...
 03564   584   NtContinue  (12907708, 0, ...
 03565   384   NtContinue  (11861204, 0, ...
 03566   584   NtContinue  (12907708, 0, ...
 03567   384   NtContinue  (11861204, 0, ...
 03568   584   NtContinue  (12907708, 0, ...
 03569   588   NtContinue  (9764056, 0, ...
 03570   384   NtContinue  (11861204, 0, ...
 03571   588   NtContinue  (9764056, 0, ...
 03572   384   NtContinue  (11861204, 0, ...
 03573   588   NtContinue  (9764056, 0, ...
 03574   384   NtContinue  (11861204, 0, ...
 03575   588   NtContinue  (9764056, 0, ...
 03576   384   NtContinue  (11861204, 0, ...
 03577   588   NtContinue  (9764056, 0, ...
 03578   384   NtContinue  (11861204, 0, ...
 03579   384   NtContinue  (11861204, 0, ...
 03580   384   NtContinue  (11861204, 0, ...
 03581   384   NtContinue  (11861204, 0, ...
 03582   384   NtContinue  (11861204, 0, ...
 03583   384   NtContinue  (11861204, 0, ...
 03584   384   NtContinue  (11861204, 0, ...
 03585   384   NtContinue  (11861204, 0, ...
 03586   588   NtContinue  (9764056, 0, ...
 03587   584   NtContinue  (12907708, 0, ...
 03588   588   NtContinue  (9764056, 0, ...
 03589   584   NtContinue  (12907708, 0, ...
 03590   588   NtContinue  (9764056, 0, ...
 03591   584   NtContinue  (12907708, 0, ...
 03592   588   NtContinue  (9764056, 0, ...
 03593   584   NtContinue  (12907708, 0, ...
 03594   588   NtContinue  (9764056, 0, ...
 03595   584   NtContinue  (12907708, 0, ...
 03596   588   NtContinue  (9764056, 0, ...
 03597   584   NtContinue  (12907708, 0, ...
 03598   384   NtContinue  (11861204, 0, ...
 03599   588   NtContinue  (9764056, 0, ...
 03600   384   NtContinue  (11861204, 0, ...
 03601   588   NtContinue  (9764056, 0, ...
 03602   384   NtContinue  (11861204, 0, ...
 03603   588   NtContinue  (9764056, 0, ...
 03604   384   NtContinue  (11861204, 0, ...
 03605   588   NtContinue  (9764056, 0, ...
 03606   384   NtContinue  (11861204, 0, ...
 03607   588   NtContinue  (9764056, 0, ...
 03608   384   NtContinue  (11861204, 0, ...
 03609   588   NtContinue  (9764056, 0, ...
 03610   584   NtContinue  (12907708, 0, ...
 03611   384   NtContinue  (11861204, 0, ...
 03612   584   NtContinue  (12907708, 0, ...
 03613   384   NtContinue  (11861204, 0, ...
 03614   584   NtContinue  (12907708, 0, ...
 03615   384   NtContinue  (11861204, 0, ...
 03616   584   NtContinue  (12907708, 0, ...
 03617   384   NtContinue  (11861204, 0, ...
 03618   584   NtContinue  (12907708, 0, ...
 03619   384   NtContinue  (11861204, 0, ...
 03620   584   NtContinue  (12907708, 0, ...
 03621   384   NtContinue  (11861204, 0, ...
 03622   588   NtContinue  (9764056, 0, ...
 03623   584   NtContinue  (12907708, 0, ...
 03624   588   NtContinue  (9764056, 0, ...
 03625   584   NtContinue  (12907708, 0, ...
 03626   588   NtContinue  (9764056, 0, ...
 03627   584   NtContinue  (12907708, 0, ...
 03628   588   NtContinue  (9764056, 0, ...
 03629   584   NtContinue  (12907708, 0, ...
 03630   588   NtContinue  (9764056, 0, ...
 03631   584   NtContinue  (12907708, 0, ...
 03632   588   NtContinue  (9764056, 0, ...
 03633   584   NtContinue  (12907708, 0, ...
 03634   384   NtContinue  (11861204, 0, ...
 03635   588   NtContinue  (9764056, 0, ...
 03636   384   NtContinue  (11861204, 0, ...
 03637   588   NtContinue  (9764056, 0, ...
 03638   384   NtContinue  (11861204, 0, ...
 03639   588   NtContinue  (9764056, 0, ...
 03640   384   NtContinue  (11861204, 0, ...
 03641   588   NtContinue  (9764056, 0, ...
 03642   384   NtContinue  (11861204, 0, ...
 03643   588   NtContinue  (9764056, 0, ...
 03644   384   NtContinue  (11861204, 0, ...
 03645   588   NtContinue  (9764056, 0, ...
 03646   584   NtContinue  (12907708, 0, ...
 03647   384   NtContinue  (11861204, 0, ...
 03648   584   NtContinue  (12907708, 0, ...
 03649   384   NtContinue  (11861204, 0, ...
 03650   584   NtContinue  (12907708, 0, ...
 03651   384   NtContinue  (11861204, 0, ...
 03652   584   NtContinue  (12907708, 0, ...
 03653   384   NtContinue  (11861204, 0, ...
 03654   584   NtContinue  (12907708, 0, ...
 03655   384   NtContinue  (11861204, 0, ...
 03656   584   NtContinue  (12907708, 0, ...
 03657   384   NtContinue  (11861204, 0, ...
 03658   588   NtContinue  (9764056, 0, ...
 03659   584   NtContinue  (12907708, 0, ...
 03660   588   NtContinue  (9764056, 0, ...
 03661   584   NtContinue  (12907708, 0, ...
 03662   588   NtContinue  (9764056, 0, ...
 03663   584   NtContinue  (12907708, 0, ...
 03664   588   NtContinue  (9764056, 0, ...
 03665   584   NtContinue  (12907708, 0, ...
 03666   588   NtContinue  (9764056, 0, ...
 03667   584   NtContinue  (12907708, 0, ...
 03668   588   NtContinue  (9764056, 0, ...
 03669   584   NtContinue  (12907708, 0, ...
 03670   384   NtContinue  (11861204, 0, ...
 03671   588   NtContinue  (9764056, 0, ...
 03672   384   NtContinue  (11861204, 0, ...
 03673   588   NtContinue  (9764056, 0, ...
 03674   384   NtContinue  (11861204, 0, ...
 03675   588   NtContinue  (9764056, 0, ...
 03676   384   NtContinue  (11861204, 0, ...
 03677   588   NtContinue  (9764056, 0, ...
 03678   384   NtContinue  (11861204, 0, ...
 03679   588   NtContinue  (9764056, 0, ...
 03680   384   NtContinue  (11861204, 0, ...
 03681   588   NtContinue  (9764056, 0, ...
 03682   584   NtContinue  (12907708, 0, ...
 03683   384   NtContinue  (11861204, 0, ...
 03684   584   NtContinue  (12907708, 0, ...
 03685   384   NtContinue  (11861204, 0, ...
 03686   584   NtContinue  (12907708, 0, ...
 03687   384   NtContinue  (11861204, 0, ...
 03688   584   NtContinue  (12907708, 0, ...
 03689   384   NtContinue  (11861204, 0, ...
 03690   584   NtContinue  (12907708, 0, ...
 03691   384   NtContinue  (11861204, 0, ...
 03692   584   NtContinue  (12907708, 0, ...
 03693   384   NtContinue  (11861204, 0, ...
 03694   588   NtContinue  (9764056, 0, ...
 03695   584   NtContinue  (12907708, 0, ...
 03696   588   NtContinue  (9764056, 0, ...
 03697   584   NtContinue  (12907708, 0, ...
 03698   588   NtContinue  (9764056, 0, ...
 03699   584   NtContinue  (12907708, 0, ...
 03700   588   NtContinue  (9764056, 0, ...
 03701   584   NtContinue  (12907708, 0, ...
 03702   588   NtContinue  (9764056, 0, ...
 03703   584   NtContinue  (12907708, 0, ...
 03704   588   NtContinue  (9764056, 0, ...
 03705   584   NtContinue  (12907708, 0, ...
 03706   384   NtContinue  (11861204, 0, ...
 03707   588   NtContinue  (9764056, 0, ...
 03708   384   NtContinue  (11861204, 0, ...
 03709   588   NtContinue  (9764056, 0, ...
 03710   384   NtContinue  (11861204, 0, ...
 03711   588   NtContinue  (9764056, 0, ...
 03712   384   NtContinue  (11861204, 0, ...
 03713   588   NtContinue  (9764056, 0, ...
 03714   384   NtContinue  (11861204, 0, ...
 03715   588   NtContinue  (9764056, 0, ...
 03716   384   NtContinue  (11861204, 0, ...
 03717   588   NtContinue  (9764056, 0, ...
 03718   584   NtContinue  (12907708, 0, ...
 03719   384   NtContinue  (11861204, 0, ...
 03720   584   NtContinue  (12907708, 0, ...
 03721   384   NtContinue  (11861204, 0, ...
 03722   584   NtContinue  (12907708, 0, ...
 03723   384   NtContinue  (11861204, 0, ...
 03724   584   NtContinue  (12907708, 0, ...
 03725   384   NtContinue  (11861204, 0, ...
 03726   584   NtContinue  (12907708, 0, ...
 03727   384   NtContinue  (11861204, 0, ...
 03728   584   NtContinue  (12907708, 0, ...
 03729   384   NtContinue  (11861204, 0, ...
 03730   588   NtContinue  (9764056, 0, ...
 03731   584   NtContinue  (12907708, 0, ...
 03732   588   NtContinue  (9764056, 0, ...
 03733   584   NtContinue  (12907708, 0, ...
 03734   588   NtContinue  (9764056, 0, ...
 03735   584   NtContinue  (12907708, 0, ...
 03736   588   NtContinue  (9764056, 0, ...
 03737   584   NtContinue  (12907708, 0, ...
 03738   588   NtContinue  (9764056, 0, ...
 03739   584   NtContinue  (12907708, 0, ...
 03740   588   NtContinue  (9764056, 0, ...
 03741   584   NtContinue  (12907708, 0, ...
 03742   384   NtContinue  (11861204, 0, ...
 03743   588   NtContinue  (9764056, 0, ...
 03744   384   NtContinue  (11861204, 0, ...
 03745   588   NtContinue  (9764056, 0, ...
 03746   384   NtContinue  (11861204, 0, ...
 03747   588   NtContinue  (9764056, 0, ...
 03748   384   NtContinue  (11861204, 0, ...
 03749   588   NtContinue  (9764056, 0, ...
 03750   384   NtContinue  (11861204, 0, ...
 03751   588   NtContinue  (9764056, 0, ...
 03752   384   NtContinue  (11861204, 0, ...
 03753   588   NtContinue  (9764056, 0, ...
 03754   584   NtContinue  (12907708, 0, ...
 03755   384   NtContinue  (11861204, 0, ...
 03756   584   NtContinue  (12907708, 0, ...
 03757   384   NtContinue  (11861204, 0, ...
 03758   584   NtContinue  (12907708, 0, ...
 03759   384   NtContinue  (11861204, 0, ...
 03760   584   NtContinue  (12907708, 0, ...
 03761   384   NtContinue  (11861204, 0, ...
 03762   584   NtContinue  (12907708, 0, ...
 03763   384   NtContinue  (11861204, 0, ...
 03764   584   NtContinue  (12907708, 0, ...
 03765   384   NtContinue  (11861204, 0, ...
 03766   588   NtContinue  (9764056, 0, ...
 03767   584   NtContinue  (12907708, 0, ...
 03768   588   NtContinue  (9764056, 0, ...
 03769   584   NtContinue  (12907708, 0, ...
 03770   588   NtContinue  (9764056, 0, ...
 03771   584   NtContinue  (12907708, 0, ...
 03772   588   NtContinue  (9764056, 0, ...
 03773   584   NtContinue  (12907708, 0, ...
 03774   588   NtContinue  (9764056, 0, ...
 03775   584   NtContinue  (12907708, 0, ...
 03776   588   NtContinue  (9764056, 0, ...
 03777   584   NtContinue  (12907708, 0, ...
 03778   384   NtContinue  (11861204, 0, ...
 03779   588   NtContinue  (9764056, 0, ...
 03780   384   NtContinue  (11861204, 0, ...
 03781   588   NtContinue  (9764056, 0, ...
 03782   384   NtContinue  (11861204, 0, ...
 03783   588   NtContinue  (9764056, 0, ...
 03784   384   NtContinue  (11861204, 0, ...
 03785   588   NtContinue  (9764056, 0, ...
 03786   384   NtContinue  (11861204, 0, ...
 03787   588   NtContinue  (9764056, 0, ...
 03788   384   NtContinue  (11861204, 0, ...
 03789   588   NtContinue  (9764056, 0, ...
 03790   584   NtContinue  (12907708, 0, ...
 03791   384   NtContinue  (11861204, 0, ...
 03792   584   NtContinue  (12907708, 0, ...
 03793   384   NtContinue  (11861204, 0, ...
 03794   584   NtContinue  (12907708, 0, ...
 03795   384   NtContinue  (11861204, 0, ...
 03796   584   NtContinue  (12907708, 0, ...
 03797   384   NtContinue  (11861204, 0, ...
 03798   584   NtContinue  (12907708, 0, ...
 03799   384   NtContinue  (11861204, 0, ...
 03800   584   NtContinue  (12907708, 0, ...
 03801   384   NtContinue  (11861204, 0, ...
 03802   588   NtContinue  (9764056, 0, ...
 03803   584   NtContinue  (12907708, 0, ...
 03804   588   NtContinue  (9764056, 0, ...
 03805   584   NtContinue  (12907708, 0, ...
 03806   588   NtContinue  (9764056, 0, ...
 03807   584   NtContinue  (12907708, 0, ...
 03808   588   NtContinue  (9764056, 0, ...
 03809   584   NtContinue  (12907708, 0, ...
 03810   588   NtContinue  (9764056, 0, ...
 03811   584   NtContinue  (12907708, 0, ...
 03812   588   NtContinue  (9764056, 0, ...
 03813   584   NtContinue  (12907708, 0, ...
 03814   384   NtContinue  (11861204, 0, ...
 03815   588   NtContinue  (9764056, 0, ...
 03816   384   NtContinue  (11861204, 0, ...
 03817   588   NtContinue  (9764056, 0, ...
 03818   384   NtContinue  (11861204, 0, ...
 03819   588   NtContinue  (9764056, 0, ...
 03820   384   NtContinue  (11861204, 0, ...
 03821   588   NtContinue  (9764056, 0, ...
 03822   384   NtContinue  (11861204, 0, ...
 03823   588   NtContinue  (9764056, 0, ...
 03824   384   NtContinue  (11861204, 0, ...
 03825   588   NtContinue  (9764056, 0, ...
 03826   584   NtContinue  (12907708, 0, ...
 03827   384   NtContinue  (11861204, 0, ...
 03828   584   NtContinue  (12907708, 0, ...
 03829   384   NtContinue  (11861204, 0, ...
 03830   584   NtContinue  (12907708, 0, ...
 03831   384   NtContinue  (11861204, 0, ...
 03832   584   NtContinue  (12907708, 0, ...
 03833   384   NtContinue  (11861204, 0, ...
 03834   584   NtContinue  (12907708, 0, ...
 03835   384   NtContinue  (11861204, 0, ...
 03836   584   NtContinue  (12907708, 0, ...
 03837   384   NtContinue  (11861204, 0, ...
 03838   588   NtContinue  (9764056, 0, ...
 03839   584   NtContinue  (12907708, 0, ...
 03840   588   NtContinue  (9764056, 0, ...
 03841   584   NtContinue  (12907708, 0, ...
 03842   588   NtContinue  (9764056, 0, ...
 03843   584   NtContinue  (12907708, 0, ...
 03844   588   NtContinue  (9764056, 0, ...
 03845   584   NtContinue  (12907708, 0, ...
 03846   588   NtContinue  (9764056, 0, ...
 03847   584   NtContinue  (12907708, 0, ...
 03848   588   NtContinue  (9764056, 0, ...
 03849   584   NtContinue  (12907708, 0, ...
 03850   384   NtContinue  (11861204, 0, ...
 03851   588   NtContinue  (9764056, 0, ...
 03852   384   NtContinue  (11861204, 0, ...
 03853   588   NtContinue  (9764056, 0, ...
 03854   384   NtContinue  (11861204, 0, ...
 03855   588   NtContinue  (9764056, 0, ...
 03856   384   NtContinue  (11861204, 0, ...
 03857   588   NtContinue  (9764056, 0, ...
 03858   384   NtContinue  (11861204, 0, ...
 03859   588   NtContinue  (9764056, 0, ...
 03860   384   NtContinue  (11861204, 0, ...
 03861   588   NtContinue  (9764056, 0, ...
 03862   584   NtContinue  (12907708, 0, ...
 03863   384   NtContinue  (11861204, 0, ...
 03864   584   NtContinue  (12907708, 0, ...
 03865   384   NtContinue  (11861204, 0, ...
 03866   584   NtContinue  (12907708, 0, ...
 03867   384   NtContinue  (11861204, 0, ...
 03868   584   NtContinue  (12907708, 0, ...
 03869   384   NtContinue  (11861204, 0, ...
 03870   584   NtContinue  (12907708, 0, ...
 03871   384   NtContinue  (11861204, 0, ...
 03872   584   NtContinue  (12907708, 0, ...
 03873   384   NtContinue  (11861204, 0, ...
 03874   588   NtContinue  (9764056, 0, ...
 03875   584   NtContinue  (12907708, 0, ...
 03876   588   NtContinue  (9764056, 0, ...
 03877   584   NtContinue  (12907708, 0, ...
 03878   588   NtContinue  (9764056, 0, ...
 03879   584   NtContinue  (12907708, 0, ...
 03880   588   NtContinue  (9764056, 0, ...
 03881   584   NtContinue  (12907708, 0, ...
 03882   588   NtContinue  (9764056, 0, ...
 03883   584   NtContinue  (12907708, 0, ...
 03884   588   NtContinue  (9764056, 0, ...
 03885   584   NtContinue  (12907708, 0, ...
 03886   384   NtContinue  (11861204, 0, ...
 03887   588   NtContinue  (9764056, 0, ...
 03888   384   NtContinue  (11861204, 0, ...
 03889   588   NtContinue  (9764056, 0, ...
 03890   384   NtContinue  (11861204, 0, ...
 03891   588   NtContinue  (9764056, 0, ...
 03892   384   NtContinue  (11861204, 0, ...
 03893   588   NtContinue  (9764056, 0, ...
 03894   384   NtContinue  (11861204, 0, ...
 03895   588   NtContinue  (9764056, 0, ...
 03896   384   NtContinue  (11861204, 0, ...
 03897   588   NtContinue  (9764056, 0, ...
 03898   584   NtContinue  (12907708, 0, ...
 03899   384   NtContinue  (11861204, 0, ...
 03900   584   NtContinue  (12907708, 0, ...
 03901   384   NtContinue  (11861204, 0, ...
 03902   584   NtContinue  (12907708, 0, ...
 03903   384   NtContinue  (11861204, 0, ...
 03904   584   NtContinue  (12907708, 0, ...
 03905   384   NtContinue  (11861204, 0, ...
 03906   584   NtContinue  (12907708, 0, ...
 03907   384   NtContinue  (11861204, 0, ...
 03908   584   NtContinue  (12907708, 0, ...
 03909   384   NtContinue  (11861204, 0, ...
 03910   588   NtContinue  (9764056, 0, ...
 03911   584   NtContinue  (12907708, 0, ...
 03912   588   NtContinue  (9764056, 0, ...
 03913   584   NtContinue  (12907708, 0, ...
 03914   588   NtContinue  (9764056, 0, ...
 03915   584   NtContinue  (12907708, 0, ...
 03916   588   NtContinue  (9764056, 0, ...
 03917   584   NtContinue  (12907708, 0, ...
 03918   588   NtContinue  (9764056, 0, ...
 03919   584   NtContinue  (12907708, 0, ...
 03920   588   NtContinue  (9764056, 0, ...
 03921   584   NtContinue  (12907708, 0, ...
 03922   384   NtContinue  (11861204, 0, ...
 03923   588   NtContinue  (9764056, 0, ...
 03924   384   NtContinue  (11861204, 0, ...
 03925   588   NtContinue  (9764056, 0, ...
 03926   384   NtContinue  (11861204, 0, ...
 03927   588   NtContinue  (9764056, 0, ...
 03928   384   NtContinue  (11861204, 0, ...
 03929   588   NtContinue  (9764056, 0, ...
 03930   384   NtContinue  (11861204, 0, ...
 03931   588   NtContinue  (9764056, 0, ...
 03932   384   NtContinue  (11861204, 0, ...
 03933   588   NtContinue  (9764056, 0, ...
 03934   584   NtContinue  (12907708, 0, ...
 03935   384   NtContinue  (11861204, 0, ...
 03936   584   NtContinue  (12907708, 0, ...
 03937   384   NtContinue  (11861204, 0, ...
 03938   584   NtContinue  (12907708, 0, ...
 03939   384   NtContinue  (11861204, 0, ...
 03940   584   NtContinue  (12907708, 0, ...
 03941   384   NtContinue  (11861204, 0, ...
 03942   584   NtContinue  (12907708, 0, ...
 03943   384   NtContinue  (11861204, 0, ...
 03944   584   NtContinue  (12907708, 0, ...
 03945   384   NtContinue  (11861204, 0, ...
 03946   588   NtContinue  (9764056, 0, ...
 03947   584   NtContinue  (12907708, 0, ...
 03948   588   NtContinue  (9764056, 0, ...
 03949   584   NtContinue  (12907708, 0, ...
 03950   588   NtContinue  (9764056, 0, ...
 03951   584   NtContinue  (12907708, 0, ...
 03952   588   NtContinue  (9764056, 0, ...
 03953   584   NtContinue  (12907708, 0, ...
 03954   588   NtContinue  (9764056, 0, ...
 03955   584   NtContinue  (12907708, 0, ...
 03956   588   NtContinue  (9764056, 0, ...
 03957   584   NtContinue  (12907708, 0, ...
 03958   384   NtContinue  (11861204, 0, ...
 03959   588   NtContinue  (9764056, 0, ...
 03960   384   NtContinue  (11861204, 0, ...
 03961   588   NtContinue  (9764056, 0, ...
 03962   384   NtContinue  (11861204, 0, ...
 03963   588   NtContinue  (9764056, 0, ...
 03964   384   NtContinue  (11861204, 0, ...
 03965   588   NtContinue  (9764056, 0, ...
 03966   384   NtContinue  (11861204, 0, ...
 03967   588   NtContinue  (9764056, 0, ...
 03968   384   NtContinue  (11861204, 0, ...
 03969   588   NtContinue  (9764056, 0, ...
 03970   584   NtContinue  (12907708, 0, ...
 03971   384   NtContinue  (11861204, 0, ...
 03972   584   NtContinue  (12907708, 0, ...
 03973   384   NtContinue  (11861204, 0, ...
 03974   584   NtContinue  (12907708, 0, ...
 03975   384   NtContinue  (11861204, 0, ...
 03976   584   NtContinue  (12907708, 0, ...
 03977   384   NtContinue  (11861204, 0, ...
 03978   584   NtContinue  (12907708, 0, ...
 03979   384   NtContinue  (11861204, 0, ...
 03980   584   NtContinue  (12907708, 0, ...
 03981   384   NtContinue  (11861204, 0, ...
 03982   588   NtContinue  (9764056, 0, ...
 03983   384   NtContinue  (11861204, 0, ...
 03984   588   NtContinue  (9764056, 0, ...
 03985   384   NtContinue  (11861204, 0, ...
 03986   588   NtContinue  (9764056, 0, ...
 03987   384   NtContinue  (11861204, 0, ...
 03988   588   NtContinue  (9764056, 0, ...
 03989   384   NtContinue  (11861204, 0, ...
 03990   588   NtContinue  (9764056, 0, ...
 03991   384   NtContinue  (11861204, 0, ...
 03992   588   NtContinue  (9764056, 0, ...
 03993   584   NtContinue  (12907708, 0, ...
 03994   384   NtContinue  (11861204, 0, ...
 03995   584   NtContinue  (12907708, 0, ...
 03996   384   NtContinue  (11861204, 0, ...
 03997   584   NtContinue  (12907708, 0, ...
 03998   384   NtContinue  (11861204, 0, ...
 03999   584   NtContinue  (12907708, 0, ...
 04000   384   NtContinue  (11861204, 0, ...
 04001   584   NtContinue  (12907708, 0, ...
 04002   384   NtContinue  (11861204, 0, ...
 04003   584   NtContinue  (12907708, 0, ...
 04004   384   NtContinue  (11861204, 0, ...
 04005   588   NtContinue  (9764056, 0, ...
 04006   584   NtContinue  (12907708, 0, ...
 04007   588   NtContinue  (9764056, 0, ...
 04008   584   NtContinue  (12907708, 0, ...
 04009   588   NtContinue  (9764056, 0, ...
 04010   584   NtContinue  (12907708, 0, ...
 04011   588   NtContinue  (9764056, 0, ...
 04012   584   NtContinue  (12907708, 0, ...
 04013   588   NtContinue  (9764056, 0, ...
 04014   584   NtContinue  (12907708, 0, ...
 04015   588   NtContinue  (9764056, 0, ...
 04016   584   NtContinue  (12907708, 0, ...
 04017   384   NtContinue  (11861204, 0, ...
 04018   588   NtContinue  (9764056, 0, ...
 04019   384   NtContinue  (11861204, 0, ...
 04020   588   NtContinue  (9764056, 0, ...
 04021   384   NtContinue  (11861204, 0, ...
 04022   588   NtContinue  (9764056, 0, ...
 04023   384   NtContinue  (11861204, 0, ...
 04024   588   NtContinue  (9764056, 0, ...
 04025   384   NtContinue  (11861204, 0, ...
 04026   588   NtContinue  (9764056, 0, ...
 04027   384   NtContinue  (11861204, 0, ...
 04028   588   NtContinue  (9764056, 0, ...
 04029   584   NtContinue  (12907708, 0, ...
 04030   384   NtContinue  (11861204, 0, ...
 04031   584   NtContinue  (12907708, 0, ...
 04032   384   NtContinue  (11861204, 0, ...
 04033   584   NtContinue  (12907708, 0, ...
 04034   384   NtContinue  (11861204, 0, ...
 04035   584   NtContinue  (12907708, 0, ...
 04036   384   NtContinue  (11861204, 0, ...
 04037   584   NtContinue  (12907708, 0, ...
 04038   384   NtContinue  (11861204, 0, ...
 04039   584   NtContinue  (12907708, 0, ...
 04040   384   NtContinue  (11861204, 0, ...
 04041   588   NtContinue  (9764056, 0, ...
 04042   584   NtContinue  (12907708, 0, ...
 04043   588   NtContinue  (9764056, 0, ...
 04044   584   NtContinue  (12907708, 0, ...
 04045   588   NtContinue  (9764056, 0, ...
 04046   584   NtContinue  (12907708, 0, ...
 04047   588   NtContinue  (9764056, 0, ...
 04048   584   NtContinue  (12907708, 0, ...
 04049   588   NtContinue  (9764056, 0, ...
 04050   584   NtContinue  (12907708, 0, ...
 04051   588   NtContinue  (9764056, 0, ...
 04052   584   NtContinue  (12907708, 0, ...
 04053   384   NtContinue  (11861204, 0, ...
 04054   588   NtContinue  (9764056, 0, ...
 04055   384   NtContinue  (11861204, 0, ...
 04056   588   NtContinue  (9764056, 0, ...
 04057   384   NtContinue  (11861204, 0, ...
 04058   588   NtContinue  (9764056, 0, ...
 04059   384   NtContinue  (11861204, 0, ...
 04060   588   NtContinue  (9764056, 0, ...
 04061   384   NtContinue  (11861204, 0, ...
 04062   588   NtContinue  (9764056, 0, ...
 04063   384   NtContinue  (11861204, 0, ...
 04064   588   NtContinue  (9764056, 0, ...
 04065   584   NtContinue  (12907708, 0, ...
 04066   384   NtContinue  (11861204, 0, ...
 04067   584   NtContinue  (12907708, 0, ...
 04068   384   NtContinue  (11861204, 0, ...
 04069   584   NtContinue  (12907708, 0, ...
 04070   384   NtContinue  (11861204, 0, ...
 04071   584   NtContinue  (12907708, 0, ...
 04072   384   NtContinue  (11861204, 0, ...
 04073   584   NtContinue  (12907708, 0, ...
 04074   384   NtContinue  (11861204, 0, ...
 04075   584   NtContinue  (12907708, 0, ...
 04076   384   NtContinue  (11861204, 0, ...
 04077   588   NtContinue  (9764056, 0, ...
 04078   584   NtContinue  (12907708, 0, ...
 04079   588   NtContinue  (9764056, 0, ...
 04080   584   NtContinue  (12907708, 0, ...
 04081   588   NtContinue  (9764056, 0, ...
 04082   584   NtContinue  (12907708, 0, ...
 04083   588   NtContinue  (9764056, 0, ...
 04084   584   NtContinue  (12907708, 0, ...
 04085   588   NtContinue  (9764056, 0, ...
 04086   584   NtContinue  (12907708, 0, ...
 04087   588   NtContinue  (9764056, 0, ...
 04088   584   NtContinue  (12907708, 0, ...
 04089   384   NtContinue  (11861204, 0, ...
 04090   588   NtContinue  (9764056, 0, ...
 04091   384   NtContinue  (11861204, 0, ...
 04092   588   NtContinue  (9764056, 0, ...
 04093   384   NtContinue  (11861204, 0, ...
 04094   588   NtContinue  (9764056, 0, ...
 04095   384   NtContinue  (11861204, 0, ...
 04096   588   NtContinue  (9764056, 0, ...
 04097   384   NtContinue  (11861204, 0, ...
 04098   588   NtContinue  (9764056, 0, ...
 04099   384   NtContinue  (11861204, 0, ...
 04100   588   NtContinue  (9764056, 0, ...
 04101   584   NtContinue  (12907708, 0, ...
 04102   384   NtContinue  (11861204, 0, ...
 04103   584   NtContinue  (12907708, 0, ...
 04104   384   NtContinue  (11861204, 0, ...
 04105   584   NtContinue  (12907708, 0, ...
 04106   384   NtContinue  (11861204, 0, ...
 04107   584   NtContinue  (12907708, 0, ...
 04108   384   NtContinue  (11861204, 0, ...
 04109   584   NtContinue  (12907708, 0, ...
 04110   384   NtContinue  (11861204, 0, ...
 04111   584   NtContinue  (12907708, 0, ...
 04112   384   NtContinue  (11861204, 0, ...
 04113   588   NtContinue  (9764056, 0, ...
 04114   584   NtContinue  (12907708, 0, ...
 04115   588   NtContinue  (9764056, 0, ...
 04116   584   NtContinue  (12907708, 0, ...
 04117   588   NtContinue  (9764056, 0, ...
 04118   584   NtContinue  (12907708, 0, ...
 04119   588   NtContinue  (9764056, 0, ...
 04120   584   NtContinue  (12907708, 0, ...
 04121   588   NtContinue  (9764056, 0, ...
 04122   584   NtContinue  (12907708, 0, ...
 04123   588   NtContinue  (9764056, 0, ...
 04124   584   NtContinue  (12907708, 0, ...
 04125   384   NtContinue  (11861204, 0, ...
 04126   588   NtContinue  (9764056, 0, ...
 04127   384   NtContinue  (11861204, 0, ...
 04128   588   NtContinue  (9764056, 0, ...
 04129   384   NtContinue  (11861204, 0, ...
 04130   588   NtContinue  (9764056, 0, ...
 04131   384   NtContinue  (11861204, 0, ...
 04132   588   NtContinue  (9764056, 0, ...
 04133   384   NtContinue  (11861204, 0, ...
 04134   588   NtContinue  (9764056, 0, ...
 04135   384   NtContinue  (11861204, 0, ...
 04136   588   NtContinue  (9764056, 0, ...
 04137   584   NtContinue  (12907708, 0, ...
 04138   384   NtContinue  (11861204, 0, ...
 04139   584   NtContinue  (12907708, 0, ...
 04140   384   NtContinue  (11861204, 0, ...
 04141   584   NtContinue  (12907708, 0, ...
 04142   384   NtContinue  (11861204, 0, ...
 04143   584   NtContinue  (12907708, 0, ...
 04144   384   NtContinue  (11861204, 0, ...
 04145   584   NtContinue  (12907708, 0, ...
 04146   384   NtContinue  (11861204, 0, ...
 04147   584   NtContinue  (12907708, 0, ...
 04148   384   NtContinue  (11861204, 0, ...
 04149   588   NtContinue  (9764056, 0, ...
 04150   584   NtContinue  (12907708, 0, ...
 04151   588   NtContinue  (9764056, 0, ...
 04152   584   NtContinue  (12907708, 0, ...
 04153   588   NtContinue  (9764056, 0, ...
 04154   584   NtContinue  (12907708, 0, ...
 04155   588   NtContinue  (9764056, 0, ...
 04156   584   NtContinue  (12907708, 0, ...
 04157   588   NtContinue  (9764056, 0, ...
 04158   584   NtContinue  (12907708, 0, ...
 04159   588   NtContinue  (9764056, 0, ...
 04160   584   NtContinue  (12907708, 0, ...
 04161   384   NtContinue  (11861204, 0, ...
 04162   588   NtContinue  (9764056, 0, ...
 04163   384   NtContinue  (11861204, 0, ...
 04164   588   NtContinue  (9764056, 0, ...
 04165   384   NtContinue  (11861204, 0, ...
 04166   588   NtContinue  (9764056, 0, ...
 04167   384   NtContinue  (11861204, 0, ...
 04168   588   NtContinue  (9764056, 0, ...
 04169   384   NtContinue  (11861204, 0, ...
 04170   588   NtContinue  (9764056, 0, ...
 04171   384   NtContinue  (11861204, 0, ...
 04172   588   NtContinue  (9764056, 0, ...
 04173   584   NtContinue  (12907708, 0, ...
 04174   384   NtContinue  (11861204, 0, ...
 04175   584   NtContinue  (12907708, 0, ...
 04176   384   NtContinue  (11861204, 0, ...
 04177   584   NtContinue  (12907708, 0, ...
 04178   384   NtContinue  (11861204, 0, ...
 04179   584   NtContinue  (12907708, 0, ...
 04180   384   NtContinue  (11861204, 0, ...
 04181   584   NtContinue  (12907708, 0, ...
 04182   384   NtContinue  (11861204, 0, ...
 04183   584   NtContinue  (12907708, 0, ...
 04184   384   NtContinue  (11861204, 0, ...
 04185   588   NtContinue  (9764056, 0, ...
 04186   584   NtContinue  (12907708, 0, ...
 04187   588   NtContinue  (9764056, 0, ...
 04188   584   NtContinue  (12907708, 0, ...
 04189   588   NtContinue  (9764056, 0, ...
 04190   584   NtContinue  (12907708, 0, ...
 04191   588   NtContinue  (9764056, 0, ...
 04192   584   NtContinue  (12907708, 0, ...
 04193   588   NtContinue  (9764056, 0, ...
 04194   584   NtContinue  (12907708, 0, ...
 04195   588   NtContinue  (9764056, 0, ...
 04196   584   NtContinue  (12907708, 0, ...
 04197   384   NtContinue  (11861204, 0, ...
 04198   588   NtContinue  (9764056, 0, ...
 04199   384   NtContinue  (11861204, 0, ...
 04200   588   NtContinue  (9764056, 0, ...
 04201   384   NtContinue  (11861204, 0, ...
 04202   588   NtContinue  (9764056, 0, ...
 04203   384   NtContinue  (11861204, 0, ...
 04204   588   NtContinue  (9764056, 0, ...
 04205   384   NtContinue  (11861204, 0, ...
 04206   588   NtContinue  (9764056, 0, ...
 04207   384   NtContinue  (11861204, 0, ...
 04208   588   NtContinue  (9764056, 0, ...
 04209   584   NtContinue  (12907708, 0, ...
 04210   384   NtContinue  (11861204, 0, ...
 04211   584   NtContinue  (12907708, 0, ...
 04212   384   NtContinue  (11861204, 0, ...
 04213   584   NtContinue  (12907708, 0, ...
 04214   384   NtContinue  (11861204, 0, ...
 04215   584   NtContinue  (12907708, 0, ...
 04216   384   NtContinue  (11861204, 0, ...
 04217   584   NtContinue  (12907708, 0, ...
 04218   384   NtContinue  (11861204, 0, ...
 04219   584   NtContinue  (12907708, 0, ...
 04220   384   NtContinue  (11861204, 0, ...
 04221   588   NtContinue  (9764056, 0, ...
 04222   584   NtContinue  (12907708, 0, ...
 04223   588   NtContinue  (9764056, 0, ...
 04224   584   NtContinue  (12907708, 0, ...
 04225   588   NtContinue  (9764056, 0, ...
 04226   584   NtContinue  (12907708, 0, ...
 04227   588   NtContinue  (9764056, 0, ...
 04228   584   NtContinue  (12907708, 0, ...
 04229   588   NtContinue  (9764056, 0, ...
 04230   584   NtContinue  (12907708, 0, ...
 04231   588   NtContinue  (9764056, 0, ...
 04232   584   NtContinue  (12907708, 0, ...
 04233   384   NtContinue  (11861204, 0, ...
 04234   588   NtContinue  (9764056, 0, ...
 04235   384   NtContinue  (11861204, 0, ...
 04236   588   NtContinue  (9764056, 0, ...
 04237   384   NtContinue  (11861204, 0, ...
 04238   588   NtContinue  (9764056, 0, ...
 04239   384   NtContinue  (11861204, 0, ...
 04240   588   NtContinue  (9764056, 0, ...
 04241   384   NtContinue  (11861204, 0, ...
 04242   588   NtContinue  (9764056, 0, ...
 04243   384   NtContinue  (11861204, 0, ...
 04244   588   NtContinue  (9764056, 0, ...
 04245   584   NtContinue  (12907708, 0, ...
 04246   384   NtContinue  (11861204, 0, ...
 04247   584   NtContinue  (12907708, 0, ...
 04248   384   NtContinue  (11861204, 0, ...
 04249   584   NtContinue  (12907708, 0, ...
 04250   384   NtContinue  (11861204, 0, ...
 04251   584   NtContinue  (12907708, 0, ...
 04252   384   NtContinue  (11861204, 0, ...
 04253   584   NtContinue  (12907708, 0, ...
 04254   384   NtContinue  (11861204, 0, ...
 04255   584   NtContinue  (12907708, 0, ...
 04256   384   NtContinue  (11861204, 0, ...
 04257   588   NtContinue  (9764056, 0, ...
 04258   584   NtContinue  (12907708, 0, ...
 04259   588   NtContinue  (9764056, 0, ...
 04260   584   NtContinue  (12907708, 0, ...
 04261   588   NtContinue  (9764056, 0, ...
 04262   584   NtContinue  (12907708, 0, ...
 04263   588   NtContinue  (9764056, 0, ...
 04264   584   NtContinue  (12907708, 0, ...
 04265   588   NtContinue  (9764056, 0, ...
 04266   584   NtContinue  (12907708, 0, ...
 04267   588   NtContinue  (9764056, 0, ...
 04268   584   NtContinue  (12907708, 0, ...
 04269   384   NtContinue  (11861204, 0, ...
 04270   588   NtContinue  (9764056, 0, ...
 04271   384   NtContinue  (11861204, 0, ...
 04272   588   NtContinue  (9764056, 0, ...
 04273   384   NtContinue  (11861204, 0, ...
 04274   588   NtContinue  (9764056, 0, ...
 04275   384   NtContinue  (11861204, 0, ...
 04276   588   NtContinue  (9764056, 0, ...
 04277   384   NtContinue  (11861204, 0, ...
 04278   588   NtContinue  (9764056, 0, ...
 04279   384   NtContinue  (11861204, 0, ...
 04280   588   NtContinue  (9764056, 0, ...
 04281   584   NtContinue  (12907708, 0, ...
 04282   384   NtContinue  (11861204, 0, ...
 04283   584   NtContinue  (12907708, 0, ...
 04284   384   NtContinue  (11861204, 0, ...
 04285   584   NtContinue  (12907708, 0, ...
 04286   384   NtContinue  (11861204, 0, ...
 04287   584   NtContinue  (12907708, 0, ...
 04288   384   NtContinue  (11861204, 0, ...
 04289   584   NtContinue  (12907708, 0, ...
 04290   384   NtContinue  (11861204, 0, ...
 04291   584   NtContinue  (12907708, 0, ...
 04292   384   NtContinue  (11861204, 0, ...
 04293   588   NtContinue  (9764056, 0, ...
 04294   584   NtContinue  (12907708, 0, ...
 04295   588   NtContinue  (9764056, 0, ...
 04296   584   NtContinue  (12907708, 0, ...
 04297   588   NtContinue  (9764056, 0, ...
 04298   584   NtContinue  (12907708, 0, ...
 04299   588   NtContinue  (9764056, 0, ...
 04300   584   NtContinue  (12907708, 0, ...
 04301   588   NtContinue  (9764056, 0, ...
 04302   584   NtContinue  (12907708, 0, ...
 04303   588   NtContinue  (9764056, 0, ...
 04304   584   NtContinue  (12907708, 0, ...
 04305   384   NtContinue  (11861204, 0, ...
 04306   588   NtContinue  (9764056, 0, ...
 04307   384   NtContinue  (11861204, 0, ...
 04308   588   NtContinue  (9764056, 0, ...
 04309   384   NtContinue  (11861204, 0, ...
 04310   588   NtContinue  (9764056, 0, ...
 04311   384   NtContinue  (11861204, 0, ...
 04312   588   NtContinue  (9764056, 0, ...
 04313   384   NtContinue  (11861204, 0, ...
 04314   588   NtContinue  (9764056, 0, ...
 04315   384   NtContinue  (11861204, 0, ...
 04316   588   NtContinue  (9764056, 0, ...
 04317   584   NtContinue  (12907708, 0, ...
 04318   384   NtContinue  (11861204, 0, ...
 04319   584   NtContinue  (12907708, 0, ...
 04320   384   NtContinue  (11861204, 0, ...
 04321   584   NtContinue  (12907708, 0, ...
 04322   384   NtContinue  (11861204, 0, ...
 04323   584   NtContinue  (12907708, 0, ...
 04324   384   NtContinue  (11861204, 0, ...
 04325   584   NtContinue  (12907708, 0, ...
 04326   384   NtContinue  (11861204, 0, ...
 04327   584   NtContinue  (12907708, 0, ...
 04328   384   NtContinue  (11861204, 0, ...
 04329   588   NtContinue  (9764056, 0, ...
 04330   584   NtContinue  (12907708, 0, ...
 04331   588   NtContinue  (9764056, 0, ...
 04332   584   NtContinue  (12907708, 0, ...
 04333   588   NtContinue  (9764056, 0, ...
 04334   584   NtContinue  (12907708, 0, ...
 04335   588   NtContinue  (9764056, 0, ...
 04336   584   NtContinue  (12907708, 0, ...
 04337   588   NtContinue  (9764056, 0, ...
 04338   584   NtContinue  (12907708, 0, ...
 04339   588   NtContinue  (9764056, 0, ...
 04340   584   NtContinue  (12907708, 0, ...
 04341   384   NtContinue  (11861204, 0, ...
 04342   588   NtContinue  (9764056, 0, ...
 04343   384   NtContinue  (11861204, 0, ...
 04344   588   NtContinue  (9764056, 0, ...
 04345   384   NtContinue  (11861204, 0, ...
 04346   588   NtContinue  (9764056, 0, ...
 04347   384   NtContinue  (11861204, 0, ...
 04348   588   NtContinue  (9764056, 0, ...
 04349   384   NtContinue  (11861204, 0, ...
 04350   588   NtContinue  (9764056, 0, ...
 04351   384   NtContinue  (11861204, 0, ...
 04352   588   NtContinue  (9764056, 0, ...
 04353   584   NtContinue  (12907708, 0, ...
 04354   384   NtContinue  (11861204, 0, ...
 04355   584   NtContinue  (12907708, 0, ...
 04356   384   NtContinue  (11861204, 0, ...
 04357   584   NtContinue  (12907708, 0, ...
 04358   384   NtContinue  (11861204, 0, ...
 04359   584   NtContinue  (12907708, 0, ...
 04360   384   NtContinue  (11861204, 0, ...
 04361   584   NtContinue  (12907708, 0, ...
 04362   384   NtContinue  (11861204, 0, ...
 04363   584   NtContinue  (12907708, 0, ...
 04364   384   NtContinue  (11861204, 0, ...
 04365   588   NtContinue  (9764056, 0, ...
 04366   584   NtContinue  (12907708, 0, ...
 04367   588   NtContinue  (9764056, 0, ...
 04368   584   NtContinue  (12907708, 0, ...
 04369   588   NtContinue  (9764056, 0, ...
 04370   584   NtContinue  (12907708, 0, ...
 04371   588   NtContinue  (9764056, 0, ...
 04372   584   NtContinue  (12907708, 0, ...
 04373   584   NtContinue  (12907708, 0, ...
 04374   584   NtContinue  (12907708, 0, ...
 04375   584   NtContinue  (12907708, 0, ...
 04376   584   NtContinue  (12907708, 0, ...
 04377   584   NtContinue  (12907708, 0, ...
 04378   584   NtContinue  (12907708, 0, ...
 04379   584   NtContinue  (12907708, 0, ...
 04380   584   NtContinue  (12907708, 0, ...
 04381   588   NtContinue  (9764056, 0, ...
 04382   384   NtContinue  (11861204, 0, ...
 04383   588   NtContinue  (9764056, 0, ...
 04384   384   NtContinue  (11861204, 0, ...
 04385   588   NtContinue  (9764056, 0, ...
 04386   384   NtContinue  (11861204, 0, ...
 04387   588   NtContinue  (9764056, 0, ...
 04388   384   NtContinue  (11861204, 0, ...
 04389   588   NtContinue  (9764056, 0, ...
 04390   384   NtContinue  (11861204, 0, ...
 04391   588   NtContinue  (9764056, 0, ...
 04392   384   NtContinue  (11861204, 0, ...
 04393   584   NtContinue  (12907708, 0, ...
 04394   588   NtContinue  (9764056, 0, ...
 04395   584   NtContinue  (12907708, 0, ...
 04396   588   NtContinue  (9764056, 0, ...
 04397   584   NtContinue  (12907708, 0, ...
 04398   588   NtContinue  (9764056, 0, ...
 04399   584   NtContinue  (12907708, 0, ...
 04400   588   NtContinue  (9764056, 0, ...
 04401   584   NtContinue  (12907708, 0, ...
 04402   588   NtContinue  (9764056, 0, ...
 04403   584   NtContinue  (12907708, 0, ...
 04404   588   NtContinue  (9764056, 0, ...
 04405   384   NtContinue  (11861204, 0, ...
 04406   584   NtContinue  (12907708, 0, ...
 04407   384   NtContinue  (11861204, 0, ...
 04408   584   NtContinue  (12907708, 0, ...
 04409   384   NtContinue  (11861204, 0, ...
 04410   584   NtContinue  (12907708, 0, ...
 04411   384   NtContinue  (11861204, 0, ...
 04412   584   NtContinue  (12907708, 0, ...
 04413   384   NtContinue  (11861204, 0, ...
 04414   584   NtContinue  (12907708, 0, ...
 04415   384   NtContinue  (11861204, 0, ...
 04416   584   NtContinue  (12907708, 0, ...
 04417   588   NtContinue  (9764056, 0, ...
 04418   384   NtContinue  (11861204, 0, ...
 04419   588   NtContinue  (9764056, 0, ...
 04420   384   NtContinue  (11861204, 0, ...
 04421   588   NtContinue  (9764056, 0, ...
 04422   384   NtContinue  (11861204, 0, ...
 04423   588   NtContinue  (9764056, 0, ...
 04424   384   NtContinue  (11861204, 0, ...
 04425   588   NtContinue  (9764056, 0, ...
 04426   384   NtContinue  (11861204, 0, ...
 04427   588   NtContinue  (9764056, 0, ...
 04428   384   NtContinue  (11861204, 0, ...
 04429   584   NtContinue  (12907708, 0, ...
 04430   588   NtContinue  (9764056, 0, ...
 04431   584   NtContinue  (12907708, 0, ...
 04432   588   NtContinue  (9764056, 0, ...
 04433   584   NtContinue  (12907708, 0, ...
 04434   588   NtContinue  (9764056, 0, ...
 04435   584   NtContinue  (12907708, 0, ...
 04436   588   NtContinue  (9764056, 0, ...
 04437   584   NtContinue  (12907708, 0, ...
 04438   588   NtContinue  (9764056, 0, ...
 04439   584   NtContinue  (12907708, 0, ...
 04440   588   NtContinue  (9764056, 0, ...
 04441   384   NtContinue  (11861204, 0, ...
 04442   584   NtContinue  (12907708, 0, ...
 04443   384   NtContinue  (11861204, 0, ...
 04444   584   NtContinue  (12907708, 0, ...
 04445   384   NtContinue  (11861204, 0, ...
 04446   584   NtContinue  (12907708, 0, ...
 04447   384   NtContinue  (11861204, 0, ...
 04448   584   NtContinue  (12907708, 0, ...
 04449   384   NtContinue  (11861204, 0, ...
 04450   584   NtContinue  (12907708, 0, ...
 04451   384   NtContinue  (11861204, 0, ...
 04452   584   NtContinue  (12907708, 0, ...
 04453   588   NtContinue  (9764056, 0, ...
 04454   384   NtContinue  (11861204, 0, ...
 04455   588   NtContinue  (9764056, 0, ...
 04456   384   NtContinue  (11861204, 0, ...
 04457   588   NtContinue  (9764056, 0, ...
 04458   384   NtContinue  (11861204, 0, ...
 04459   588   NtContinue  (9764056, 0, ...
 04460   384   NtContinue  (11861204, 0, ...
 04461   588   NtContinue  (9764056, 0, ...
 04462   384   NtContinue  (11861204, 0, ...
 04463   588   NtContinue  (9764056, 0, ...
 04464   384   NtContinue  (11861204, 0, ...
 04465   584   NtContinue  (12907708, 0, ...
 04466   588   NtContinue  (9764056, 0, ...
 04467   584   NtContinue  (12907708, 0, ...
 04468   588   NtContinue  (9764056, 0, ...
 04469   584   NtContinue  (12907708, 0, ...
 04470   588   NtContinue  (9764056, 0, ...
 04471   584   NtContinue  (12907708, 0, ...
 04472   588   NtContinue  (9764056, 0, ...
 04473   584   NtContinue  (12907708, 0, ...
 04474   588   NtContinue  (9764056, 0, ...
 04475   584   NtContinue  (12907708, 0, ...
 04476   588   NtContinue  (9764056, 0, ...
 04477   384   NtContinue  (11861204, 0, ...
 04478   584   NtContinue  (12907708, 0, ...
 04479   384   NtContinue  (11861204, 0, ...
 04480   584   NtContinue  (12907708, 0, ...
 04481   384   NtContinue  (11861204, 0, ...
 04482   584   NtContinue  (12907708, 0, ...
 04483   384   NtContinue  (11861204, 0, ...
 04484   584   NtContinue  (12907708, 0, ...
 04485   384   NtContinue  (11861204, 0, ...
 04486   584   NtContinue  (12907708, 0, ...
 04487   384   NtContinue  (11861204, 0, ...
 04488   584   NtContinue  (12907708, 0, ...
 04489   588   NtContinue  (9764056, 0, ...
 04490   384   NtContinue  (11861204, 0, ...
 04491   588   NtContinue  (9764056, 0, ...
 04492   384   NtContinue  (11861204, 0, ...
 04493   588   NtContinue  (9764056, 0, ...
 04494   384   NtContinue  (11861204, 0, ...
 04495   588   NtContinue  (9764056, 0, ...
 04496   384   NtContinue  (11861204, 0, ...
 04497   588   NtContinue  (9764056, 0, ...
 04498   384   NtContinue  (11861204, 0, ...
 04499   588   NtContinue  (9764056, 0, ...
 04500   384   NtContinue  (11861204, 0, ...
 04501   584   NtContinue  (12907708, 0, ...
 04502   588   NtContinue  (9764056, 0, ...
 04503   584   NtContinue  (12907708, 0, ...
 04504   588   NtContinue  (9764056, 0, ...
 04505   584   NtContinue  (12907708, 0, ...
 04506   588   NtContinue  (9764056, 0, ...
 04507   584   NtContinue  (12907708, 0, ...
 04508   588   NtContinue  (9764056, 0, ...
 04509   584   NtContinue  (12907708, 0, ...
 04510   588   NtContinue  (9764056, 0, ...
 04511   584   NtContinue  (12907708, 0, ...
 04512   588   NtContinue  (9764056, 0, ...
 04513   384   NtContinue  (11861204, 0, ...
 04514   584   NtContinue  (12907708, 0, ...
 04515   384   NtContinue  (11861204, 0, ...
 04516   584   NtContinue  (12907708, 0, ...
 04517   384   NtContinue  (11861204, 0, ...
 04518   584   NtContinue  (12907708, 0, ...
 04519   384   NtContinue  (11861204, 0, ...
 04520   584   NtContinue  (12907708, 0, ...
 04521   384   NtContinue  (11861204, 0, ...
 04522   584   NtContinue  (12907708, 0, ...
 04523   384   NtContinue  (11861204, 0, ...
 04524   584   NtContinue  (12907708, 0, ...
 04525   588   NtContinue  (9764056, 0, ...
 04526   384   NtContinue  (11861204, 0, ...
 04527   588   NtContinue  (9764056, 0, ...
 04528   384   NtContinue  (11861204, 0, ...
 04529   588   NtContinue  (9764056, 0, ...
 04530   384   NtContinue  (11861204, 0, ...
 04531   588   NtContinue  (9764056, 0, ...
 04532   384   NtContinue  (11861204, 0, ...
 04533   588   NtContinue  (9764056, 0, ...
 04534   384   NtContinue  (11861204, 0, ...
 04535   588   NtContinue  (9764056, 0, ...
 04536   384   NtContinue  (11861204, 0, ...
 04537   584   NtContinue  (12907708, 0, ...
 04538   588   NtContinue  (9764056, 0, ...
 04539   584   NtContinue  (12907708, 0, ...
 04540   588   NtContinue  (9764056, 0, ...
 04541   584   NtContinue  (12907708, 0, ...
 04542   588   NtContinue  (9764056, 0, ...
 04543   584   NtContinue  (12907708, 0, ...
 04544   588   NtContinue  (9764056, 0, ...
 04545   584   NtContinue  (12907708, 0, ...
 04546   588   NtContinue  (9764056, 0, ...
 04547   584   NtContinue  (12907708, 0, ...
 04548   588   NtContinue  (9764056, 0, ...
 04549   384   NtContinue  (11861204, 0, ...
 04550   584   NtContinue  (12907708, 0, ...
 04551   384   NtContinue  (11861204, 0, ...
 04552   584   NtContinue  (12907708, 0, ...
 04553   384   NtContinue  (11861204, 0, ...
 04554   584   NtContinue  (12907708, 0, ...
 04555   384   NtContinue  (11861204, 0, ...
 04556   584   NtContinue  (12907708, 0, ...
 04557   384   NtContinue  (11861204, 0, ...
 04558   584   NtContinue  (12907708, 0, ...
 04559   384   NtContinue  (11861204, 0, ...
 04560   584   NtContinue  (12907708, 0, ...
 04561   588   NtContinue  (9764056, 0, ...
 04562   384   NtContinue  (11861204, 0, ...
 04563   588   NtContinue  (9764056, 0, ...
 04564   384   NtContinue  (11861204, 0, ...
 04565   588   NtContinue  (9764056, 0, ...
 04566   384   NtContinue  (11861204, 0, ...
 04567   588   NtContinue  (9764056, 0, ...
 04568   384   NtContinue  (11861204, 0, ...
 04569   588   NtContinue  (9764056, 0, ...
 04570   384   NtContinue  (11861204, 0, ...
 04571   588   NtContinue  (9764056, 0, ...
 04572   384   NtContinue  (11861204, 0, ...
 04573   584   NtContinue  (12907708, 0, ...
 04574   588   NtContinue  (9764056, 0, ...
 04575   584   NtContinue  (12907708, 0, ...
 04576   588   NtContinue  (9764056, 0, ...
 04577   584   NtContinue  (12907708, 0, ...
 04578   588   NtContinue  (9764056, 0, ...
 04579   584   NtContinue  (12907708, 0, ...
 04580   588   NtContinue  (9764056, 0, ...
 04581   584   NtContinue  (12907708, 0, ...
 04582   588   NtContinue  (9764056, 0, ...
 04583   584   NtContinue  (12907708, 0, ...
 04584   588   NtContinue  (9764056, 0, ...
 04585   384   NtContinue  (11861204, 0, ...
 04586   584   NtContinue  (12907708, 0, ...
 04587   384   NtContinue  (11861204, 0, ...
 04588   584   NtContinue  (12907708, 0, ...
 04589   384   NtContinue  (11861204, 0, ...
 04590   584   NtContinue  (12907708, 0, ...
 04591   384   NtContinue  (11861204, 0, ...
 04592   584   NtContinue  (12907708, 0, ...
 04593   384   NtContinue  (11861204, 0, ...
 04594   584   NtContinue  (12907708, 0, ...
 04595   384   NtContinue  (11861204, 0, ...
 04596   584   NtContinue  (12907708, 0, ...
 04597   588   NtContinue  (9764056, 0, ...
 04598   384   NtContinue  (11861204, 0, ...
 04599   588   NtContinue  (9764056, 0, ...
 04600   384   NtContinue  (11861204, 0, ...
 04601   588   NtContinue  (9764056, 0, ...
 04602   384   NtContinue  (11861204, 0, ...
 04603   588   NtContinue  (9764056, 0, ...
 04604   384   NtContinue  (11861204, 0, ...
 04605   588   NtContinue  (9764056, 0, ...
 04606   384   NtContinue  (11861204, 0, ...
 04607   588   NtContinue  (9764056, 0, ...
 04608   384   NtContinue  (11861204, 0, ...
 04609   584   NtContinue  (12907708, 0, ...
 04610   588   NtContinue  (9764056, 0, ...
 04611   584   NtContinue  (12907708, 0, ...
 04612   588   NtContinue  (9764056, 0, ...
 04613   584   NtContinue  (12907708, 0, ...
 04614   588   NtContinue  (9764056, 0, ...
 04615   584   NtContinue  (12907708, 0, ...
 04616   588   NtContinue  (9764056, 0, ...
 04617   584   NtContinue  (12907708, 0, ...
 04618   588   NtContinue  (9764056, 0, ...
 04619   584   NtContinue  (12907708, 0, ...
 04620   588   NtContinue  (9764056, 0, ...
 04621   384   NtContinue  (11861204, 0, ...
 04622   584   NtContinue  (12907708, 0, ...
 04623   384   NtContinue  (11861204, 0, ...
 04624   584   NtContinue  (12907708, 0, ...
 04625   384   NtContinue  (11861204, 0, ...
 04626   584   NtContinue  (12907708, 0, ...
 04627   384   NtContinue  (11861204, 0, ...
 04628   584   NtContinue  (12907708, 0, ...
 04629   384   NtContinue  (11861204, 0, ...
 04630   584   NtContinue  (12907708, 0, ...
 04631   384   NtContinue  (11861204, 0, ...
 04632   584   NtContinue  (12907708, 0, ...
 04633   588   NtContinue  (9764056, 0, ...
 04634   384   NtContinue  (11861204, 0, ...
 04635   588   NtContinue  (9764056, 0, ...
 04636   384   NtContinue  (11861204, 0, ...
 04637   588   NtContinue  (9764056, 0, ...
 04638   384   NtContinue  (11861204, 0, ...
 04639   588   NtContinue  (9764056, 0, ...
 04640   384   NtContinue  (11861204, 0, ...
 04641   588   NtContinue  (9764056, 0, ...