Summary:


NtAdjustPrivilegesToken(>) 
 1 
NtFreeVirtualMemory(>) 
 2 
NtFsControlFile(>) 
 4 
NtUserWaitMessage(>) 
 11 

NtCallbackReturn(>) 
 1 
NtGdiCreatePatternBrushInternal(>) 
 2 
NtOpenProcessToken(>) 
 4 
NtGdiExtSelectClipRgn(>) 
 12 

NtConnectPort(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtQuerySection(>) 
 4 
NtGdiGetRandomRgn(>) 
 12 

NtGdiCreateBitmap(>) 
 1 
NtGdiGetWidthTable(>) 
 2 
NtReadFile(>) 
 4 
NtQuerySystemInformation(>) 
 13 

NtGdiExtCreateRegion(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtSetEvent(>) 
 4 
NtQueryAttributesFile(>) 
 15 

NtGdiExtGetObjectW(>) 
 1 
NtOpenThreadToken(>) 
 2 
NtUserCalcMenuBar(>) 
 4 
NtGdiIntersectClipRect(>) 
 16 

NtGdiGetDCDword(>) 
 1 
NtQueryDefaultUILanguage(>) 
 2 
NtUserCallHwndLock(>) 
 4 
NtGdiDrawStream(>) 
 18 

NtGdiGetTextExtent(>) 
 1 
NtQueryVirtualMemory(>) 
 2 
NtUserFillWindow(>) 
 4 
NtOpenProcess(>) 
 18 

NtGdiInit(>) 
 1 
NtSetInformationFile(>) 
 2 
NtUserGetAtomName(>) 
 4 
NtUserGetClassInfo(>) 
 18 

NtGdiOffsetRgn(>) 
 1 
NtUserGetForegroundWindow(>) 
 2 
NtUserGetClassName(>) 
 4 
NtWaitForSingleObject(>) 
 20 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserGetThreadDesktop(>) 
 2 
NtUserGetDCEx(>) 
 4 
NtQueryInformationThread(>) 
 24 

NtOpenKeyedEvent(>) 
 1 
NtUserRegisterWindowMessage(>) 
 2 
NtUserGetTitleBarInfo(>) 
 4 
NtUserGetWindowDC(>) 
 24 

NtOpenMutant(>) 
 1 
NtUserSetFocus(>) 
 2 
NtUserQueryWindow(>) 
 4 
NtCreateEvent(>) 
 25 

NtOpenSymbolicLinkObject(>) 
 1 
NtUserSetWindowRgn(>) 
 2 
NtUserSetProp(>) 
 4 
NtRegisterThreadTerminatePort(>) 
 25 

NtQueryInstallUILanguage(>) 
 1 
NtUserShowWindow(>) 
 2 
NtUserSetWindowFNID(>) 
 4 
NtResumeThread(>) 
 25 

NtQueryObject(>) 
 1 
NtDuplicateObject(>) 
 3 
NtUserThunkedMenuItemInfo(>) 
 4 
NtTestAlert(>) 
 25 

NtQueryPerformanceCounter(>) 
 1 
NtGdiBitBlt(>) 
 3 
NtGdiGetStockObject(>) 
 5 
NtContinue(>) 
 26 

NtQuerySymbolicLinkObject(>) 
 1 
NtGdiCreateCompatibleBitmap(>) 
 3 
NtUserGetAncestor(>) 
 5 
NtCreateThread(>) 
 26 

NtQuerySystemTime(>) 
 1 
NtGdiExcludeClipRect(>) 
 3 
NtUserSetWindowLong(>) 
 5 
NtUnmapViewOfSection(>) 
 26 

NtQueryTimerResolution(>) 
 1 
NtGdiGetCharSet(>) 
 3 
NtUserSystemParametersInfo(>) 
 5 
NtUserPeekMessage(>) 
 27 

NtQueryVolumeInformationFile(>) 
 1 
NtGdiGetTextCharsetInfo(>) 
 3 
NtGdiCombineRgn(>) 
 6 
NtUserCallOneParam(>) 
 29 

NtSecureConnectPort(>) 
 1 
NtGdiGetTextMetricsW(>) 
 3 
NtGdiCreateRectRgn(>) 
 6 
NtUserFindExistingCursorIcon(>) 
 29 

NtUserBuildHwndList(>) 
 1 
NtGdiHfontCreate(>) 
 3 
NtOpenFile(>) 
 6 
NtOpenKey(>) 
 32 

NtUserCallHwnd(>) 
 1 
NtGdiSetupPublicCFONT(>) 
 3 
NtOpenProcessTokenEx(>) 
 6 
NtOpenSection(>) 
 32 

NtUserCallHwndParam(>) 
 1 
NtQueryDefaultLocale(>) 
 3 
NtOpenThreadTokenEx(>) 
 6 
NtRequestWaitReplyPort(>) 
 32 

NtUserDrawIconEx(>) 
 1 
NtQueryInformationFile(>) 
 3 
NtUserBeginPaint(>) 
 6 
NtSetInformationThread(>) 
 32 

NtUserGetCursorFrameInfo(>) 
 1 
NtQueryInformationProcess(>) 
 3 
NtGdiCreateCompatibleDC(>) 
 7 
NtUserRegisterClassExWOW(>) 
 34 

NtUserGetGUIThreadInfo(>) 
 1 
NtSetInformationObject(>) 
 3 
NtGdiSelectBitmap(>) 
 7 
NtQueryValueKey(>) 
 57 

NtUserGetIconSize(>) 
 1 
NtUserEndPaint(>) 
 3 
NtUserCallMsgFilter(>) 
 7 
NtMapViewOfSection(>) 
 61 

NtUserGetProcessWindowStation(>) 
 1 
NtUserGetControlBrush(>) 
 3 
NtUserInternalGetWindowText(>) 
 7 
NtUserMessageCall(>) 
 67 

NtUserModifyUserStartupInfoFlags(>) 
 1 
NtUserGetObjectInformation(>) 
 3 
NtCreateSection(>) 
 8 
NtWriteVirtualMemory(>) 
 68 

NtUserRemoveProp(>) 
 1 
NtUserSetCursor(>) 
 3 
NtGdiDeleteObjectApp(>) 
 8 
NtAllocateVirtualMemory(>) 
 86 

NtWriteFile(>) 
 1 
NtUserSetWindowPos(>) 
 3 
NtUserCreateWindowEx(>) 
 8 
NtClose(>) 
 96 

NtCreateIoCompletion(>) 
 2 
NtCreateFile(>) 
 4 
NtUserCallNoParam(>) 
 9 
NtProtectVirtualMemory(>) 
 101 

NtCreateSemaphore(>) 
 2 
NtFlushInstructionCache(>) 
 4 
NtQueryInformationToken(>) 
 10 
NtDelayExecution(>) 
 564 


Trace:
 00001   412   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   412   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   412   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   412   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   412   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   412   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   412   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   412   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   412   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   412   NtClose  (12, ... ) == 0x0
 00014   412   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   412   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   412   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   412   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   412   NtClose  (16, ... ) == 0x0
 00021   412   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   412   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   412   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   412   NtClose  (16, ... ) == 0x0
 00026   412   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   412   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   412   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   412   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 400, 412, 1480, 0} "\240=\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 400, 412, 1480, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 400, 412, 1480, 0} "\240=\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00032   412   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   412   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   412   NtClose  (16, ... ) == 0x0
 00036   412   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   412   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   412   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   412   NtClose  (28, ... ) == 0x0
 00041   412   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   412   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   412   NtClose  (28, ... ) == 0x0
 00045   412   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   412   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   412   NtClose  (28, ... ) == 0x0
 00049   412   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   412   NtClose  (28, ... ) == 0x0
 00052   412   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   412   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   412   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 400, 412, 1483, 0} "\230\243\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 400, 412, 1483, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 400, 412, 1483, 0} "\230\243\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00056   412   NtProtectVirtualMemory  (-1, (0x74a000), 4096, 4, ... (0x74a000), 4096, 8, ) == 0x0
 00057   412   NtProtectVirtualMemory  (-1, (0x74a000), 4096, 8, ... (0x74a000), 4096, 4, ) == 0x0
 00058   412   NtFlushInstructionCache  (-1, 7643136, 4096, ... ) == 0x0
 00059   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "COMCTL32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0
 00061   412   NtClose  (28, ... ) == 0x0
 00062   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00064   412   NtClose  (28, ... ) == 0x0
 00065   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00066   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00067   412   NtClose  (28, ... ) == 0x0
 00068   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00070   412   NtClose  (28, ... ) == 0x0
 00071   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00072   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00073   412   NtClose  (28, ... ) == 0x0
 00074   412   NtProtectVirtualMemory  (-1, (0x74a000), 4096, 4, ... (0x74a000), 4096, 4, ) == 0x0
 00075   412   NtProtectVirtualMemory  (-1, (0x74a000), 4096, 4, ... (0x74a000), 4096, 4, ) == 0x0
 00076   412   NtFlushInstructionCache  (-1, 7643136, 4096, ... ) == 0x0
 00077   412   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00078   412   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00079   412   NtClose  (28, ... ) == 0x0
 00080   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00081   412   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00082   412   NtClose  (28, ... ) == 0x0
 00083   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00084   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566}  (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566} "\210\6\31\1\0\0\0\0\314\4\23\0\374\207\16\366\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 400, 412, 1486, 0} "XQ\26\0\0\0\0\0\0\0\0\0\374\207\16\366\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 400, 412, 1486, 0}  (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566} "\210\6\31\1\0\0\0\0\314\4\23\0\374\207\16\366\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 400, 412, 1486, 0} "XQ\26\0\0\0\0\0\0\0\0\0\374\207\16\366\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00085   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00086   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x820000), 0x0, 1060864, ) == 0x0
 00087   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00088   412   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00089   412   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482032, ) == 0x0
 00090   412   NtQueryInformationToken  (-2147482032, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00091   412   NtQueryInformationToken  (-2147482032, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00092   412   NtClose  (-2147482032, ... ) == 0x0
 00093   412   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0
 00094   412   NtFreeVirtualMemory  (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0
 00095   412   NtDuplicateObject  (-1, 36, -1, 0x0, 0, 2, ... 44, ) == 0x0
 00096   412   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00097   412   NtQueryValueKey  (-2147482032,  (-2147482032, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00098   412   NtClose  (-2147482032, ... ) == 0x0
 00099   412   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00100   412   NtQueryValueKey  (-2147482032,  (-2147482032, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00101   412   NtClose  (-2147482032, ... ) == 0x0
 00102   412   NtQueryDefaultLocale  (0, -104224244, ... ) == 0x0
 00103   412   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00104   412   NtUserCallNoParam  (24, ... ) == 0x0
 00105   412   NtGdiCreateCompatibleDC  (0, ...
 00106   412   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0
 00105   412   NtGdiCreateCompatibleDC  ... ) == 0x160103c7
 00107   412   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00108   412   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00109   412   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0x1105039b
 00110   412   NtGdiCreateSolidBrush  (0, 0, ...
 00111   412   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 12779520, 4096, ) == 0x0
 00110   412   NtGdiCreateSolidBrush  ... ) == 0x131003cd
 00112   412   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00113   412   NtGdiCreateCompatibleDC  (0, ... ) == 0x3e01040c
 00114   412   NtGdiSelectBitmap  (1040253964, 285541275, ... ) == 0x185000f
 00115   412   NtUserGetThreadDesktop  (412, 0, ... ) == 0x28
 00116   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 48, ) }, ... 48, ) == 0x0
 00117   412   NtQueryValueKey  (48,  (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00118   412   NtClose  (48, ... ) == 0x0
 00119   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00120   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810cc017
 00121   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00122   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810cc01c
 00123   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00124   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810cc01e
 00125   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00126   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810c8002
 00127   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00128   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810cc018
 00129   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00130   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810cc01a
 00131   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00132   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810cc01d
 00133   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00134   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ...
 00135   412   NtAllocateVirtualMemory  (-1, 9728000, 0, 4096, 4096, 32, ... 9728000, 4096, ) == 0x0
 00134   412   NtUserRegisterClassExWOW  ... ) == 0x810cc026
 00136   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00137   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810cc019
 00138   412   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc020
 00139   412   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810cc022
 00140   412   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc023
 00141   412   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00142   412   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810cc024
 00143   412   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc025
 00144   412   NtCallbackReturn  (0, 0, 0, ...
 00145   412   NtGdiInit  (... ) == 0x1
 00146   412   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00147   412   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00148   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 48, ) }, ... 48, ) == 0x0
 00149   412   NtQueryValueKey  (48,  (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00150   412   NtQueryValueKey  (48,  (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00151   412   NtClose  (48, ... ) == 0x0
 00152   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 48, ) }, ... 48, ) == 0x0
 00153   412   NtQueryValueKey  (48,  (48, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00154   412   NtClose  (48, ... ) == 0x0
 00155   412   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 48, ) }, ... 48, ) == 0x0
 00156   412   NtSetInformationObject  (48, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00157   412   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00158   412   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0
 00159   412   NtQueryValueKey  (52,  (52, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00160   412   NtClose  (52, ... ) == 0x0
 00161   412   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {400, 0}, ... 52, ) == 0x0
 00162   412   NtQueryInformationProcess  (52, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00163   412   NtClose  (52, ... ) == 0x0
 00164   412   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00165   412   NtUserSystemParametersInfo  (104, 0, 2000318720, 0, ... ) == 0x1
 00166   412   NtUserSystemParametersInfo  (38, 4, 2000318708, 0, ... ) == 0x1
 00167   412   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00168   412   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 52, ) == 0x0
 00169   412   NtQueryInformationToken  (52, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00170   412   NtClose  (52, ... ) == 0x0
 00171   412   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 52, ) }, ... 52, ) == 0x0
 00172   412   NtSetInformationObject  (52, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00173   412   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Control Panel\Desktop"}, ... 56, ) }, ... 56, ) == 0x0
 00174   412   NtQueryValueKey  (56,  (56, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00175   412   NtClose  (56, ... ) == 0x0
 00176   412   NtUserSystemParametersInfo  (41, 500, 1243132, 0, ... ) == 0x1
 00177   412   NtUserSystemParametersInfo  (102, 0, 2000318732, 0, ... ) == 0x1
 00178   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00179   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00180   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc03b
 00181   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00182   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc03d
 00183   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00184   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00185   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc03f
 00186   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00187   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00188   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc041
 00189   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00190   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00191   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc043
 00192   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00193   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc045
 00194   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00195   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00196   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc047
 00197   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00198   412   NtUserFindExistingCursorIcon  (1242920, 1242936, 1243504, ... ) == 0x10011
 00199   412   NtUserRegisterClassExWOW  (1243372, 1243452, 1243436, 1243468, 0, 384, 0, ... ) == 0x810cc049
 00200   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00201   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00202   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc04b
 00203   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00204   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00205   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc04d
 00206   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00207   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00208   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc04f
 00209   412   NtUserGetClassInfo  (1999896576, 1243544, 1243496, 1243572, 0, ... ) == 0x0
 00210   412   NtUserRegisterClassExWOW  (1243380, 1243460, 1243444, 1243476, 0, 384, 0, ... ) == 0x810cc051
 00211   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00212   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00213   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc053
 00214   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00215   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00216   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc055
 00217   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc057
 00218   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00219   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00220   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc059
 00221   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00222   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10013
 00223   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc05b
 00224   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00225   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00226   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc05d
 00227   412   NtUserGetClassInfo  (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0
 00228   412   NtUserFindExistingCursorIcon  (1242924, 1242940, 1243508, ... ) == 0x10011
 00229   412   NtUserRegisterClassExWOW  (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810cc05f
 00230   412   NtTestAlert  (... ) == 0x0
 00231   412   NtContinue  (1244464, 1, ...
 00232   412   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x74b014,}, 4, ... ) == 0x0
 00233   412   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 56, ) }, ... 56, ) == 0x0
 00234   412   NtCreateEvent  (0x1f0003, {24, 56, 0x80, 1245092, 0,  (0x1f0003, {24, 56, 0x80, 1245092, 0, "VT_3"}, 1, 0, ... 60, ) }, 1, 0, ... 60, ) == 0x0
 00235   412   NtCreateSection  (0xe, {24, 0, 0x40, 1245092, 0,  (0xe, {24, 0, 0x40, 1245092, 0, "\BaseNamedObjects\W32_Virtu"}, {27086, 0}, 64, 134217728, 0, ... 64, ) }, {27086, 0}, 64, 134217728, 0, ... 64, ) == 0x0
 00236   412   NtMapViewOfSection  (64, -1, (0x0), 0, 27086, 0x0, 27086, 2, 0, 64, ... (0xc40000), 0x0, 28672, ) == 0x0
 00237   412   NtOpenProcessToken  (-1, 0x20, ... 68, ) == 0x0
 00238   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00239   412   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00240   412   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 72, ) }, ... 72, ) == 0x0
 00241   412   NtQueryValueKey  (72,  (72, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   412   NtClose  (72, ... ) == 0x0
 00243   412   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00244   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 72, ) == 0x0
 00245   412   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00246   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 76, ) == 0x0
 00247   412   NtQuerySystemTime  (... {-1408260704, 29889248}, ) == 0x0
 00248   412   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 80, ) == 0x0
 00249   412   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00250   412   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00251   412   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00252   412   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00253   412   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 84, ) == 0x0
 00254   412   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 88, ) == 0x0
 00255   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 92, ) }, ... 92, ) == 0x0
 00256   412   NtOpenKey  (0x20019, {24, 92, 0x40, 0, 0,  (0x20019, {24, 92, 0x40, 0, 0, "ActiveComputerName"}, ... 96, ) }, ... 96, ) == 0x0
 00257   412   NtQueryValueKey  (96,  (96, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (96, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (96, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 00258   412   NtClose  (96, ... ) == 0x0
 00259   412   NtClose  (92, ... ) == 0x0
 00260   412   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 92, ) == 0x0
 00261   412   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 96, ) == 0x0
 00262   412   NtDuplicateObject  (-1, 92, -1, 0x0, 0, 2, ... 100, ) == 0x0
 00263   412   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00264   412   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00265   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 104, ) == 0x0
 00266   412   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00267   412   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00268   412   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243268,  (0xc0100080, {24, 0, 0x40, 0, 1243268, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 108, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 108, {status=0x0, info=1}, ) == 0x0
 00269   412   NtSetInformationFile  (108, 1243324, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00270   412   NtSetInformationFile  (108, 1243316, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00271   412   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00272   412   NtWriteFile  (108, 85, 0, 0,  (108, 85, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00273   412   NtReadFile  (108, 85, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (108, 85, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\344$\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00274   412   NtFsControlFile  (108, 85, 0x0, 0x0, 0x11c017,  (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\344$\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\344$\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00275   412   NtFsControlFile  (108, 85, 0x0, 0x0, 0x11c017,  (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\23h\33\345\323~\334\21\261\310\0\14)\371\246\305 \0"\0\330/\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\23h\33\345\323~\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) \0\330/\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\23h\33\345\323~\334\21\261\310\0\14)\371\246\305 \0"\0\330/\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\23h\33\345\323~\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\23h\33\345\323~\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) == 0x103
 00276   412   NtFsControlFile  (108, 85, 0x0, 0x0, 0x11c017,  (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\23h\33\345\323~\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\23h\33\345\323~\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 00277   412   NtClose  (104, ... ) == 0x0
 00278   412   NtClose  (108, ... ) == 0x0
 00279   412   NtAdjustPrivilegesToken  (68, 0, 1245096, 0, 0, 0, ... ) == 0x0
 00280   412   NtClose  (68, ... ) == 0x0
 00281   412   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 12910592, 65536, ) == 0x0
 00282   412   NtQuerySystemInformation  (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00283   412   NtCreateSection  (0xf0007, 0x0, {11728, 0}, 4, 134217728, 0, ... 68, ) == 0x0
 00284   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc60000), {0, 0}, 12288, ) == 0x0
 00285   412   NtUnmapViewOfSection  (-1, 0xc60000, ... ) == 0x0
 00286   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc60000), {0, 0}, 12288, ) == 0x0
 00287   412   NtFreeVirtualMemory  (-1, (0xc50000), 0, 32768, ... (0xc50000), 65536, ) == 0x0
 00288   412   NtUnmapViewOfSection  (-1, 0xc60000, ... ) == 0x0
 00289   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00290   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00291   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00292   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00293   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00294   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00295   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00296   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00297   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00298   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00299   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {616, 0}, ... 108, ) == 0x0
 00300   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00301   412   NtMapViewOfSection  (104, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00302   412   NtClose  (104, ... ) == 0x0
 00303   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00304   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00305   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00306   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00307   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00308   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00309   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00310   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00311   412   NtAllocateVirtualMemory  (108, 0, 0, 1048576, 8192, 4, ... 22020096, 1048576, ) == 0x0
 00312   412   NtAllocateVirtualMemory  (108, 23060480, 0, 8192, 4096, 4, ... 23060480, 8192, ) == 0x0
 00313   412   NtProtectVirtualMemory  (108, (0x15fe000), 4096, 260, ... (0x15fe000), 4096, 4, ) == 0x0
 00314   412   NtCreateThread  (0x1f03ff, 0x0, 108, 1244008, 1244724, 1, ... 104, {616, 548}, ) == 0x0
 00315   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244852, 2012750850, 2012697848, -1}  (24, {28, 56, new_msg, 0, 1244852, 2012750850, 2012697848, -1} "\0\0\0\0\1\0\1\0\0\0\24\0\0\0\0\0h\0\0\0h\2\0\0$\2\0\0" ... {28, 56, reply, 0, 400, 412, 1496, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0h\0\0\0h\2\0\0$\2\0\0" )  ... {28, 56, reply, 0, 400, 412, 1496, 0}  (24, {28, 56, new_msg, 0, 1244852, 2012750850, 2012697848, -1} "\0\0\0\0\1\0\1\0\0\0\24\0\0\0\0\0h\0\0\0h\2\0\0$\2\0\0" ... {28, 56, reply, 0, 400, 412, 1496, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0h\0\0\0h\2\0\0$\2\0\0" )  ) == 0x0
 00316   412   NtResumeThread  (104, ... 1, ) == 0x0
 00317   412   NtClose  (108, ... ) == 0x0
 00318   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00319   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00320   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {660, 0}, ... 108, ) == 0x0
 00321   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00322   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00323   412   NtClose  (112, ... ) == 0x0
 00324   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00325   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00326   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00327   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00328   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00329   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00330   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00331   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00332   412   NtClose  (108, ... ) == 0x0
 00333   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00334   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00335   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {672, 0}, ... 108, ) == 0x0
 00336   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00337   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00338   412   NtClose  (112, ... ) == 0x0
 00339   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00340   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00341   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00342   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00343   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00344   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00345   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00346   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\1\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00347   412   NtClose  (108, ... ) == 0x0
 00348   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00349   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00350   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {852, 0}, ... 108, ) == 0x0
 00351   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00352   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00353   412   NtClose  (112, ... ) == 0x0
 00354   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00355   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00356   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00357   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00358   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00359   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00360   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00361   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00362   412   NtClose  (108, ... ) == 0x0
 00363   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00364   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00365   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {972, 0}, ... 108, ) == 0x0
 00366   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00367   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff70000), 0x0, 28672, ) == 0x0
 00368   412   NtClose  (112, ... ) == 0x0
 00369   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00370   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\377\7", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00371   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00372   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\377\7", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00373   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00374   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\377\7", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00375   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00376   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\377\7", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00377   412   NtClose  (108, ... ) == 0x0
 00378   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00379   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00380   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1048, 0}, ... 108, ) == 0x0
 00381   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00382   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00383   412   NtClose  (112, ... ) == 0x0
 00384   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00385   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00386   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00387   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00388   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00389   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00390   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00391   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00392   412   NtClose  (108, ... ) == 0x0
 00393   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00394   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00395   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1068, 0}, ... 108, ) == 0x0
 00396   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00397   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00398   412   NtClose  (112, ... ) == 0x0
 00399   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00400   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00401   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00402   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00403   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00404   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00405   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00406   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00407   412   NtClose  (108, ... ) == 0x0
 00408   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00409   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00410   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1412, 0}, ... 108, ) == 0x0
 00411   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00412   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00413   412   NtClose  (112, ... ) == 0x0
 00414   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00415   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00416   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00417   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00418   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00419   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00420   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00421   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00422   412   NtClose  (108, ... ) == 0x0
 00423   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00424   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00425   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1636, 0}, ... 108, ) == 0x0
 00426   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00427   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00428   412   NtClose  (112, ... ) == 0x0
 00429   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00430   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00431   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00432   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00433   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00434   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00435   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00436   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00437   412   NtClose  (108, ... ) == 0x0
 00438   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00439   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00440   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1872, 0}, ... 108, ) == 0x0
 00441   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00442   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00443   412   NtClose  (112, ... ) == 0x0
 00444   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00445   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00446   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00447   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00448   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00449   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00450   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00451   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00452   412   NtClose  (108, ... ) == 0x0
 00453   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00454   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00455   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1924, 0}, ... 108, ) == 0x0
 00456   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00457   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00458   412   NtClose  (112, ... ) == 0x0
 00459   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00460   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00461   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00462   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00463   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00464   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00465   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00466   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00467   412   NtClose  (108, ... ) == 0x0
 00468   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00469   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00470   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2016, 0}, ... 108, ) == 0x0
 00471   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00472   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00473   412   NtClose  (112, ... ) == 0x0
 00474   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00475   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00476   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00477   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00478   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00479   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00480   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00481   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00482   412   NtClose  (108, ... ) == 0x0
 00483   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00484   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00485   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2024, 0}, ... 108, ) == 0x0
 00486   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00487   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00488   412   NtClose  (112, ... ) == 0x0
 00489   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00490   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00491   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00492   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00493   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00494   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00495   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00496   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00497   412   NtClose  (108, ... ) == 0x0
 00498   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00499   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00500   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2032, 0}, ... 108, ) == 0x0
 00501   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00502   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00503   412   NtClose  (112, ... ) == 0x0
 00504   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00505   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00506   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00507   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00508   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00509   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00510   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00511   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00512   412   NtClose  (108, ... ) == 0x0
 00513   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00514   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00515   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2044, 0}, ... 108, ) == 0x0
 00516   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00517   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00518   412   NtClose  (112, ... ) == 0x0
 00519   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00520   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00521   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00522   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00523   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00524   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00525   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00526   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00527   412   NtClose  (108, ... ) == 0x0
 00528   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00529   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00530   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {164, 0}, ... 108, ) == 0x0
 00531   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00532   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00533   412   NtClose  (112, ... ) == 0x0
 00534   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00535   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00536   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00537   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00538   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00539   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00540   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00541   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00542   412   NtClose  (108, ... ) == 0x0
 00543   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00544   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00545   412   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {400, 0}, ... 108, ) == 0x0
 00546   412   NtOpenSection  (0xe, {24, 56, 0x0, 0, 0,  (0xe, {24, 56, 0x0, 0, 0, "W32_Virtu"}, ... 112, ) }, ... 112, ) == 0x0
 00547   412   NtMapViewOfSection  (112, 108, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00548   412   NtClose  (112, ... ) == 0x0
 00549   412   NtProtectVirtualMemory  (108, (0x77f7e603), 5, 64, ... (0x77f7e000), 4096, 32, ) == 0x0
 00550   412   NtWriteVirtualMemory  (108, 0x77f7e603,  (108, 0x77f7e603, "\350\214=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00551   412   NtProtectVirtualMemory  (108, (0x77f7eaf3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00552   412   NtWriteVirtualMemory  (108, 0x77f7eaf3,  (108, 0x77f7eaf3, "\350\3518\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00553   412   NtProtectVirtualMemory  (108, (0x77f7e6a3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00554   412   NtWriteVirtualMemory  (108, 0x77f7e6a3,  (108, 0x77f7e6a3, "\350@=\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00555   412   NtProtectVirtualMemory  (108, (0x77f7e6b3), 5, 64, ... (0x77f7e000), 4096, 64, ) == 0x0
 00556   412   NtWriteVirtualMemory  (108, 0x77f7e6b3,  (108, 0x77f7e6b3, "\350==\2\10", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00557   412   NtClose  (108, ... ) == 0x0
 00558   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xc50000), {0, 0}, 12288, ) == 0x0
 00559   412   NtUnmapViewOfSection  (-1, 0xc50000, ... ) == 0x0
 00560   412   NtClose  (68, ... ) == 0x0
 00561   412   NtClose  (60, ... ) == 0x0
 00562   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00563   412   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00564   412   NtContinue  (1244368, 0, ...
 00565   412   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1244952,  (0x80100080, {24, 0, 0x40, 0, 1244952, "\??\C:\WINDOWS\System32\KERNEL32.dll"}, 0x0, 4, 1, 1, 96, 0, 0, ... 60, {status=0x0, info=1}, ) }, 0x0, 4, 1, 1, 96, 0, 0, ... 60, {status=0x0, info=1}, ) == 0x0
 00566   412   NtQueryInformationFile  (60, 1245004, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00567   412   NtAllocateVirtualMemory  (-1, 0, 0, 926720, 4096, 64, ... 12910592, 929792, ) == 0x0
 00568   412   NtReadFile  (60, 0, 0, 0, 926720, 0x0, 0, ... {status=0x0, info=926720},  (60, 0, 0, 0, 926720, 0x0, 0, ... {status=0x0, info=926720}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\370\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\233\10S\206\337i=\325\337i=\325\337i=\325\337i<\325]h=\325%J$\325\334i=\325\337i=\325\335i=\325%J\2\325\336i=\325HJx\325\336i=\325%J}\325\334i=\325\5J!\325\16i=\325\5J \325\334i=\325%J\0\325\336i=\325Rich\337i=\325\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\16\376};\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\0\0H\7\0\0\336\6\0\0\0\0\0A\242\1\0\0\20\0\0\0\20\7\0\0\0\346w\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0P\16\0\0\4\0\0\222\207\16\0\3\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0@!\2\0\210i\0\0\304-\7\0(\0\0\0\0\220\7\0\330^\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\15\0\20S\0\0 V\7\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250f\7\0@\0\0\0\220\2\0\0\34\0\0\0\0\20\0\0\10\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.tex", ) , ) == 0x0
 00569   412   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1244952,  (0x80100080, {24, 0, 0x40, 0, 1244952, "\??\C:\WINDOWS\System32\USER32.dll"}, 0x0, 4, 1, 1, 96, 0, 0, ... 68, {status=0x0, info=1}, ) }, 0x0, 4, 1, 1, 96, 0, 0, ... 68, {status=0x0, info=1}, ) == 0x0
 00570   412   NtQueryInformationFile  (68, 1245004, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00571   412   NtAllocateVirtualMemory  (-1, 0, 0, 561152, 4096, 64, ... 13893632, 561152, ) == 0x0
 00572   412   NtReadFile  (68, 0, 0, 0, 561152, 0x0, 0, ... {status=0x0, info=561152},  (68, 0, 0, 0, 561152, 0x0, 0, ... {status=0x0, info=561152}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0cf;e'\7U6'\7U6'\7U6'\7T6`\6U6\335$L6 \7U6'\7U6%\7U6\335$j6&\7U6\260$\206&\7U6\335$\256!\7U6\375$I6U\7U6\335$h6&\7U6Rich'\7U6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\16\376};\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\0\0\262\5\0\0\340\2\0\0\0\0\0KQ\0\0\0\20\0\0\0P\5\0\0\0\324w\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\320\10\0\0\4\0\0\35?\11\0\2\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0pk\1\0\251K\0\0\230\244\5\0P\0\0\0\0\360\5\0\210\240\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\240\10\0\270+\0\0\0\300\5\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\2\0\0L\0\0\0\0\20\0\0\324\4\0\0\300\241\5\0\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\08\260\5\0", ) , ) == 0x0
 00573   412   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1244956,  (0x80100080, {24, 0, 0x40, 0, 1244956, "\??\C:\WINDOWS\System32\ADVAPI32.dll"}, 0x0, 4, 1, 1, 96, 0, 0, ... 108, {status=0x0, info=1}, ) }, 0x0, 4, 1, 1, 96, 0, 0, ... 108, {status=0x0, info=1}, ) == 0x0
 00574   412   NtQueryInformationFile  (108, 1245008, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00575   412   NtAllocateVirtualMemory  (-1, 0, 0, 549888, 4096, 64, ... 14483456, 552960, ) == 0x0
 00576   412   NtReadFile  (108, 0, 0, 0, 549888, 0x0, 0, ... {status=0x0, info=549888},  (108, 0, 0, 0, 549888, 0x0, 0, ... {status=0x0, info=549888}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\1\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\375\343\244\227\271\202\312\304\271\202\312\304\271\202\312\304C\241\323\304\276\202\312\304\271\202\312\304\273\202\312\304C\241\212\304\275\202\312\304\364\241\326\304\262\202\312\304p\240\340\304\277\202\312\304\271\202\313\304\37\203\312\304C\241\365\304\270\202\312\304.\241\217\304\270\202\312\304c\241\327\304\255\202\312\304c\241\326\304:\202\312\304C\241\367\304\270\202\312\304Rich\271\202\312\304\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\16\376};\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\0\0B\6\0\02\2\0\0\0\0\0\373\34\0\0\0\20\0\0\0 \6\0\0\0\335w\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\260\10\0\0\4\0\0\305\371\10\0\3\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\224\1\0YQ\0\0\204(\6\0P\0\0\0\0\260\6\0h\251\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\10\0\264D\0\0\330P\6\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\240\2\0\0L\0\0\0\0\20\0\0\\6\0\0\360&\6\0`\0\0\0\0\0\0\0", ) , ) == 0x0
 00577   412   NtClose  (108, ... ) == 0x0
 00578   412   NtClose  (68, ... ) == 0x0
 00579   412   NtClose  (60, ... ) == 0x0
 00580   412   NtAllocateVirtualMemory  (-1, 0, 0, 748, 4096, 4, ... 15073280, 4096, ) == 0x0
 00581   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "winmm.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00582   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\winmm.dll"}, 1243024, ... ) }, 1243024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00583   412   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "winmm.dll"}, 1243024, ... ) }, 1243024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00584   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winmm.dll"}, 1243024, ... ) }, 1243024, ... ) == 0x0
 00585   412   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winmm.dll"}, 5, 96, ... 60, {status=0x0, info=1}, ) }, 5, 96, ... 60, {status=0x0, info=1}, ) == 0x0
 00586   412   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 60, ... 68, ) == 0x0
 00587   412   NtQuerySection  (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00588   412   NtOpenProcessToken  (-1, 0x8, ... 108, ) == 0x0
 00589   412   NtQueryInformationToken  (108, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00590   412   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00591   412   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 112, ) }, ... 112, ) == 0x0
 00592   412   NtQueryValueKey  (112,  (112, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (112, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00593   412   NtClose  (112, ... ) == 0x0
 00594   412   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00595   412   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 112, ) == 0x0
 00596   412   NtQueryInformationToken  (112, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00597   412   NtClose  (112, ... ) == 0x0
 00598   412   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00599   412   NtClose  (108, ... ) == 0x0
 00600   412   NtClose  (60, ... ) == 0x0
 00601   412   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76b40000), 0x0, 180224, ) == 0x0
 00602   412   NtClose  (68, ... ) == 0x0
 00603   412   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 68, ) == 0x0
 00604   412   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 60, ) == 0x0
 00605   412   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 108, ) == 0x0
 00606   412   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32"}, ... 112, ) }, ... 112, ) == 0x0
 00607   412   NtQueryValueKey  (112,  (112, "wave", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00608   412   NtQueryValueKey  (112,  (112, "wave1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00609   412   NtQueryValueKey  (112,  (112, "wave2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00610   412   NtQueryValueKey  (112,  (112, "wave3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00611   412   NtQueryValueKey  (112,  (112, "wave4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00612   412   NtQueryValueKey  (112,  (112, "wave5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00613   412   NtQueryValueKey  (112,  (112, "wave6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00614   412   NtQueryValueKey  (112,  (112, "wave7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00615   412   NtQueryValueKey  (112,  (112, "wave8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00616   412   NtQueryValueKey  (112,  (112, "wave9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00617   412   NtQueryValueKey  (112,  (112, "midi", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00618   412   NtQueryValueKey  (112,  (112, "midi1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00619   412   NtQueryValueKey  (112,  (112, "midi2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00620   412   NtQueryValueKey  (112,  (112, "midi3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00621   412   NtQueryValueKey  (112,  (112, "midi4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00622   412   NtQueryValueKey  (112,  (112, "midi5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00623   412   NtQueryValueKey  (112,  (112, "midi6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00624   412   NtQueryValueKey  (112,  (112, "midi7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00625   412   NtQueryValueKey  (112,  (112, "midi8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00626   412   NtQueryValueKey  (112,  (112, "midi9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00627   412   NtQueryTimerResolution  (... 156250, 10000, 156250, ) == 0x0
 00628   412   NtQueryValueKey  (112,  (112, "aux", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00629   412   NtQueryValueKey  (112,  (112, "aux1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00630   412   NtQueryValueKey  (112,  (112, "aux2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00631   412   NtQueryValueKey  (112,  (112, "aux3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00632   412   NtQueryValueKey  (112,  (112, "aux4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00633   412   NtQueryValueKey  (112,  (112, "aux5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00634   412   NtQueryValueKey  (112,  (112, "aux6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00635   412   NtQueryValueKey  (112,  (112, "aux7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00636   412   NtQueryValueKey  (112,  (112, "aux8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00637   412   NtQueryValueKey  (112,  (112, "aux9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00638   412   NtUserRegisterWindowMessage  ( ("MSJSTICK_VJOYD_MSGSTR", ... ) , ... ) == 0xc07c
 00639   412   NtOpenKey  (0xf003f, {24, 48, 0x40, 0, 0,  (0xf003f, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm"}, ... 116, ) }, ... 116, ) == 0x0
 00640   412   NtQueryValueKey  (116,  (116, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00641   412   NtClose  (116, ... ) == 0x0
 00642   412   NtCreateEvent  (0x1f0003, {24, 56, 0x80, 0, 0,  (0x1f0003, {24, 56, 0x80, 0, 0, "DINPUTWINMM"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 00643   412   NtQueryValueKey  (112,  (112, "mixer", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00644   412   NtQueryValueKey  (112,  (112, "mixer1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00645   412   NtQueryValueKey  (112,  (112, "mixer2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00646   412   NtQueryValueKey  (112,  (112, "mixer3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00647   412   NtQueryValueKey  (112,  (112, "mixer4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00648   412   NtQueryValueKey  (112,  (112, "mixer5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00649   412   NtQueryValueKey  (112,  (112, "mixer6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00650   412   NtQueryValueKey  (112,  (112, "mixer7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00651   412   NtQueryValueKey  (112,  (112, "mixer8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00652   412   NtQueryValueKey  (112,  (112, "mixer9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00653   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 15138816, 1048576, ) == 0x0
 00654   412   NtAllocateVirtualMemory  (-1, 16179200, 0, 8192, 4096, 4, ... 16179200, 8192, ) == 0x0
 00655   412   NtProtectVirtualMemory  (-1, (0xf6e000), 4096, 260, ... (0xf6e000), 4096, 4, ) == 0x0
 00656   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 116, {400, 576}, ) == 0x0
 00657   412   NtQueryInformationThread  (116, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=400,Tid=576,}, 0x0, ) == 0x0
 00658   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 3014732, 4980804, 76, 2012555319}  (24, {28, 56, new_msg, 0, 3014732, 4980804, 76, 2012555319} "\0\0\0\0\1\0\1\0~F\365w\0\0\0\0t\0\0\0\220\1\0\0@\2\0\0" ... {28, 56, reply, 0, 400, 412, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\0\0\0\220\1\0\0@\2\0\0" )  ... {28, 56, reply, 0, 400, 412, 1511, 0}  (24, {28, 56, new_msg, 0, 3014732, 4980804, 76, 2012555319} "\0\0\0\0\1\0\1\0~F\365w\0\0\0\0t\0\0\0\220\1\0\0@\2\0\0" ... {28, 56, reply, 0, 400, 412, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\0\0\0\220\1\0\0@\2\0\0" )  ) == 0x0
 00659   412   NtResumeThread  (116, ... 1, ) == 0x0
 00660   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 16187392, 1048576, ) == 0x0
 00661   412   NtAllocateVirtualMemory  (-1, 17227776, 0, 8192, 4096, 4, ... 17227776, 8192, ) == 0x0
 00662   576   NtTestAlert  (... ) == 0x0
 00663   576   NtContinue  (16186672, 1, ...
 00664   576   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00665   576   NtDelayExecution  (0, {-150000, -1}, ...
 00666   412   NtProtectVirtualMemory  (-1, (0x106e000), 4096, 260, ... (0x106e000), 4096, 4, ) == 0x0
 00667   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 120, {400, 596}, ) == 0x0
 00668   412   NtQueryInformationThread  (120, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=400,Tid=596,}, 0x0, ) == 0x0
 00669   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1511, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0x\0\0\0\220\1\0\0T\2\0\0" ... {28, 56, reply, 0, 400, 412, 1512, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0x\0\0\0\220\1\0\0T\2\0\0" )  ... {28, 56, reply, 0, 400, 412, 1512, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0x\0\0\0\220\1\0\0T\2\0\0" ... {28, 56, reply, 0, 400, 412, 1512, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0x\0\0\0\220\1\0\0T\2\0\0" )  ) == 0x0
 00670   412   NtResumeThread  (120, ... 1, ) == 0x0
 00671   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00672   596   NtTestAlert  (... ) == 0x0
 00673   596   NtContinue  (17235248, 1, ...
 00674   596   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00675   596   NtDelayExecution  (0, {-150000, -1}, ...
 00671   412   NtAllocateVirtualMemory  ... 17235968, 1048576, ) == 0x0
 00676   412   NtAllocateVirtualMemory  (-1, 18276352, 0, 8192, 4096, 4, ... 18276352, 8192, ) == 0x0
 00677   412   NtProtectVirtualMemory  (-1, (0x116e000), 4096, 260, ... (0x116e000), 4096, 4, ) == 0x0
 00678   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 124, {400, 636}, ) == 0x0
 00679   412   NtQueryInformationThread  (124, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=400,Tid=636,}, 0x0, ) == 0x0
 00680   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1512, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1512, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\0\0\0\220\1\0\0|\2\0\0" ... {28, 56, reply, 0, 400, 412, 1513, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\0\0\0\220\1\0\0|\2\0\0" )  ... {28, 56, reply, 0, 400, 412, 1513, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1512, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\0\0\0\220\1\0\0|\2\0\0" ... {28, 56, reply, 0, 400, 412, 1513, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\0\0\0\220\1\0\0|\2\0\0" )  ) == 0x0
 00681   412   NtResumeThread  (124, ... 1, ) == 0x0
 00682   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 18284544, 1048576, ) == 0x0
 00683   412   NtAllocateVirtualMemory  (-1, 19324928, 0, 8192, 4096, 4, ... 19324928, 8192, ) == 0x0
 00684   636   NtTestAlert  (... ) == 0x0
 00685   636   NtContinue  (18283824, 1, ...
 00686   636   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00687   636   NtDelayExecution  (0, {-150000, -1}, ...
 00688   412   NtProtectVirtualMemory  (-1, (0x126e000), 4096, 260, ... (0x126e000), 4096, 4, ) == 0x0
 00689   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 128, {400, 732}, ) == 0x0
 00690   412   NtQueryInformationThread  (128, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=400,Tid=732,}, 0x0, ) == 0x0
 00691   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1513, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1513, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\0\0\0\220\1\0\0\334\2\0\0" ... {28, 56, reply, 0, 400, 412, 1514, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\0\0\0\220\1\0\0\334\2\0\0" )  ... {28, 56, reply, 0, 400, 412, 1514, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1513, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\0\0\0\220\1\0\0\334\2\0\0" ... {28, 56, reply, 0, 400, 412, 1514, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\0\0\0\220\1\0\0\334\2\0\0" )  ) == 0x0
 00692   412   NtResumeThread  (128, ... 1, ) == 0x0
 00693   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00694   732   NtTestAlert  (... ) == 0x0
 00695   732   NtContinue  (19332400, 1, ...
 00696   732   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00697   732   NtDelayExecution  (0, {-150000, -1}, ...
 00693   412   NtAllocateVirtualMemory  ... 19333120, 1048576, ) == 0x0
 00698   412   NtAllocateVirtualMemory  (-1, 20373504, 0, 8192, 4096, 4, ... 20373504, 8192, ) == 0x0
 00699   412   NtProtectVirtualMemory  (-1, (0x136e000), 4096, 260, ... (0x136e000), 4096, 4, ) == 0x0
 00700   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 132, {400, 744}, ) == 0x0
 00701   412   NtQueryInformationThread  (132, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=400,Tid=744,}, 0x0, ) == 0x0
 00702   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1514, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1514, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\204\0\0\0\220\1\0\0\350\2\0\0" ... {28, 56, reply, 0, 400, 412, 1515, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\204\0\0\0\220\1\0\0\350\2\0\0" )  ... {28, 56, reply, 0, 400, 412, 1515, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1514, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\204\0\0\0\220\1\0\0\350\2\0\0" ... {28, 56, reply, 0, 400, 412, 1515, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\204\0\0\0\220\1\0\0\350\2\0\0" )  ) == 0x0
 00703   412   NtResumeThread  (132, ... 1, ) == 0x0
 00704   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 20381696, 1048576, ) == 0x0
 00705   412   NtAllocateVirtualMemory  (-1, 21422080, 0, 8192, 4096, 4, ... 21422080, 8192, ) == 0x0
 00706   744   NtTestAlert  (... ) == 0x0
 00707   744   NtContinue  (20380976, 1, ...
 00708   744   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00709   744   NtDelayExecution  (0, {-150000, -1}, ...
 00710   412   NtProtectVirtualMemory  (-1, (0x146e000), 4096, 260, ... (0x146e000), 4096, 4, ) == 0x0
 00711   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ...
 00665   576   NtDelayExecution  ... ) == 0x0
 00712   576   NtDelayExecution  (0, {-150000, -1}, ...
 00675   596   NtDelayExecution  ... ) == 0x0
 00713   596   NtDelayExecution  (0, {-150000, -1}, ...
 00687   636   NtDelayExecution  ... ) == 0x0
 00714   636   NtDelayExecution  (0, {-150000, -1}, ...
 00697   732   NtDelayExecution  ... ) == 0x0
 00715   732   NtDelayExecution  (0, {-150000, -1}, ...
 00709   744   NtDelayExecution  ... ) == 0x0
 00716   744   NtDelayExecution  (0, {-150000, -1}, ...
 00711   412   NtCreateThread  ... 136, {400, 676}, ) == 0x0
 00717   412   NtQueryInformationThread  (136, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=400,Tid=676,}, 0x0, ) == 0x0
 00718   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1515, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1515, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\210\0\0\0\220\1\0\0\244\2\0\0" ... {28, 56, reply, 0, 400, 412, 1516, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\210\0\0\0\220\1\0\0\244\2\0\0" )  ... {28, 56, reply, 0, 400, 412, 1516, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1515, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\210\0\0\0\220\1\0\0\244\2\0\0" ... {28, 56, reply, 0, 400, 412, 1516, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\210\0\0\0\220\1\0\0\244\2\0\0" )  ) == 0x0
 00719   412   NtResumeThread  (136, ... 1, ) == 0x0
 00720   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 21430272, 1048576, ) == 0x0
 00721   412   NtAllocateVirtualMemory  (-1, 22470656, 0, 8192, 4096, 4, ... 22470656, 8192, ) == 0x0
 00722   676   NtTestAlert  (... ) == 0x0
 00723   676   NtContinue  (21429552, 1, ...
 00724   676   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00725   676   NtDelayExecution  (0, {-150000, -1}, ...
 00726   412   NtProtectVirtualMemory  (-1, (0x156e000), 4096, 260, ... (0x156e000), 4096, 4, ) == 0x0
 00727   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 140, {400, 788}, ) == 0x0
 00728   412   NtQueryInformationThread  (140, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=400,Tid=788,}, 0x0, ) == 0x0
 00729   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1516, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1516, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\214\0\0\0\220\1\0\0\24\3\0\0" ... {28, 56, reply, 0, 400, 412, 1517, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\214\0\0\0\220\1\0\0\24\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1517, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1516, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\214\0\0\0\220\1\0\0\24\3\0\0" ... {28, 56, reply, 0, 400, 412, 1517, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\214\0\0\0\220\1\0\0\24\3\0\0" )  ) == 0x0
 00730   412   NtResumeThread  (140, ... 1, ) == 0x0
 00731   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00732   788   NtTestAlert  (... ) == 0x0
 00733   788   NtContinue  (22478128, 1, ...
 00734   788   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00735   788   NtDelayExecution  (0, {-150000, -1}, ...
 00731   412   NtAllocateVirtualMemory  ... 22478848, 1048576, ) == 0x0
 00736   412   NtAllocateVirtualMemory  (-1, 23519232, 0, 8192, 4096, 4, ... 23519232, 8192, ) == 0x0
 00737   412   NtProtectVirtualMemory  (-1, (0x166e000), 4096, 260, ... (0x166e000), 4096, 4, ) == 0x0
 00738   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 144, {400, 784}, ) == 0x0
 00739   412   NtQueryInformationThread  (144, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=400,Tid=784,}, 0x0, ) == 0x0
 00740   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1517, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1517, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\220\0\0\0\220\1\0\0\20\3\0\0" ... {28, 56, reply, 0, 400, 412, 1518, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\220\0\0\0\220\1\0\0\20\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1518, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1517, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\220\0\0\0\220\1\0\0\20\3\0\0" ... {28, 56, reply, 0, 400, 412, 1518, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\220\0\0\0\220\1\0\0\20\3\0\0" )  ) == 0x0
 00741   412   NtResumeThread  (144, ... 1, ) == 0x0
 00742   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 148, ) == 0x0
 00743   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 152, ) == 0x0
 00744   784   NtTestAlert  (... ) == 0x0
 00745   784   NtContinue  (23526704, 1, ...
 00746   784   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00747   784   NtDelayExecution  (0, {-20010000, -1}, ...
 00748   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 156, ) == 0x0
 00749   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 160, ) == 0x0
 00750   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 164, ) == 0x0
 00751   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0
 00752   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 00753   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 176, ) == 0x0
 00754   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 180, ) == 0x0
 00755   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 184, ) == 0x0
 00756   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 188, ) == 0x0
 00757   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 192, ) == 0x0
 00758   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 196, ) == 0x0
 00759   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 200, ) == 0x0
 00760   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 204, ) == 0x0
 00761   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 208, ) == 0x0
 00762   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 23527424, 1048576, ) == 0x0
 00763   412   NtAllocateVirtualMemory  (-1, 24567808, 0, 8192, 4096, 4, ... 24567808, 8192, ) == 0x0
 00764   412   NtProtectVirtualMemory  (-1, (0x176e000), 4096, 260, ... (0x176e000), 4096, 4, ) == 0x0
 00765   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 212, {400, 308}, ) == 0x0
 00766   412   NtQueryInformationThread  (212, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd5000,Pid=400,Tid=308,}, 0x0, ) == 0x0
 00767   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 13017103, 8232475, 2147353348, 8208596}  (24, {28, 56, new_msg, 0, 13017103, 8232475, 2147353348, 8208596} "\0\0\0\0\1\0\1\0\34\08\0\2\0\0\0\324\0\0\0\220\1\0\04\1\0\0" ... {28, 56, reply, 0, 400, 412, 1519, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\324\0\0\0\220\1\0\04\1\0\0" )  ... {28, 56, reply, 0, 400, 412, 1519, 0}  (24, {28, 56, new_msg, 0, 13017103, 8232475, 2147353348, 8208596} "\0\0\0\0\1\0\1\0\34\08\0\2\0\0\0\324\0\0\0\220\1\0\04\1\0\0" ... {28, 56, reply, 0, 400, 412, 1519, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\324\0\0\0\220\1\0\04\1\0\0" )  ) == 0x0
 00768   412   NtResumeThread  (212, ... 1, ) == 0x0
 00769   412   NtSetInformationThread  (212, BasePriority, {thread info, class 3, size 4}, 4, ...
 00770   308   NtTestAlert  (... ) == 0x0
 00771   308   NtContinue  (24575280, 1, ...
 00772   308   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00773   308   NtWaitForSingleObject  (148, 0, 0x0, ...
 00769   412   NtSetInformationThread  ... ) == 0x0
 00774   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 24576000, 1048576, ) == 0x0
 00775   412   NtAllocateVirtualMemory  (-1, 25616384, 0, 8192, 4096, 4, ... 25616384, 8192, ) == 0x0
 00776   412   NtProtectVirtualMemory  (-1, (0x186e000), 4096, 260, ... (0x186e000), 4096, 4, ) == 0x0
 00777   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 216, {400, 828}, ) == 0x0
 00778   412   NtQueryInformationThread  (216, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=400,Tid=828,}, 0x0, ) == 0x0
 00779   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1519, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1519, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\220\1\0\0<\3\0\0" ... {28, 56, reply, 0, 400, 412, 1520, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\220\1\0\0<\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1520, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1519, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\220\1\0\0<\3\0\0" ... {28, 56, reply, 0, 400, 412, 1520, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\220\1\0\0<\3\0\0" )  ) == 0x0
 00780   412   NtResumeThread  (216, ... 1, ) == 0x0
 00781   828   NtTestAlert  (... ) == 0x0
 00782   828   NtContinue  (25623856, 1, ...
 00783   828   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00784   828   NtWaitForSingleObject  (152, 0, 0x0, ...
 00785   412   NtSetInformationThread  (216, BasePriority, {thread info, class 3, size 4}, 4, ... ) == 0x0
 00786   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 25624576, 1048576, ) == 0x0
 00787   412   NtAllocateVirtualMemory  (-1, 26664960, 0, 8192, 4096, 4, ... 26664960, 8192, ) == 0x0
 00788   412   NtProtectVirtualMemory  (-1, (0x196e000), 4096, 260, ... (0x196e000), 4096, 4, ) == 0x0
 00789   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 220, {400, 824}, ) == 0x0
 00790   412   NtQueryInformationThread  (220, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=400,Tid=824,}, 0x0, ) == 0x0
 00791   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1520, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1520, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\220\1\0\08\3\0\0" ... {28, 56, reply, 0, 400, 412, 1521, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\220\1\0\08\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1521, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1520, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\220\1\0\08\3\0\0" ... {28, 56, reply, 0, 400, 412, 1521, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\220\1\0\08\3\0\0" )  ) == 0x0
 00792   412   NtResumeThread  (220, ... 1, ) == 0x0
 00793   412   NtSetInformationThread  (220, BasePriority, {thread info, class 3, size 4}, 4, ...
 00794   824   NtTestAlert  (... ) == 0x0
 00795   824   NtContinue  (26672432, 1, ...
 00796   824   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00797   824   NtWaitForSingleObject  (156, 0, 0x0, ...
 00793   412   NtSetInformationThread  ... ) == 0x0
 00798   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 26673152, 1048576, ) == 0x0
 00799   412   NtAllocateVirtualMemory  (-1, 27713536, 0, 8192, 4096, 4, ... 27713536, 8192, ) == 0x0
 00800   412   NtProtectVirtualMemory  (-1, (0x1a6e000), 4096, 260, ... (0x1a6e000), 4096, 4, ) == 0x0
 00801   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 224, {400, 844}, ) == 0x0
 00802   412   NtQueryInformationThread  (224, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=400,Tid=844,}, 0x0, ) == 0x0
 00803   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1521, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1521, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\220\1\0\0L\3\0\0" ... {28, 56, reply, 0, 400, 412, 1522, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\220\1\0\0L\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1522, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1521, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\220\1\0\0L\3\0\0" ... {28, 56, reply, 0, 400, 412, 1522, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\220\1\0\0L\3\0\0" )  ) == 0x0
 00804   412   NtResumeThread  (224, ... 1, ) == 0x0
 00805   412   NtSetInformationThread  (224, BasePriority, {thread info, class 3, size 4}, 4, ...
 00806   844   NtTestAlert  (... ) == 0x0
 00807   844   NtContinue  (27721008, 1, ...
 00808   844   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00809   844   NtWaitForSingleObject  (160, 0, 0x0, ...
 00805   412   NtSetInformationThread  ... ) == 0x0
 00810   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 27721728, 1048576, ) == 0x0
 00811   412   NtAllocateVirtualMemory  (-1, 28762112, 0, 8192, 4096, 4, ... 28762112, 8192, ) == 0x0
 00812   412   NtProtectVirtualMemory  (-1, (0x1b6e000), 4096, 260, ... (0x1b6e000), 4096, 4, ) == 0x0
 00813   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 228, {400, 864}, ) == 0x0
 00814   412   NtQueryInformationThread  (228, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=400,Tid=864,}, 0x0, ) == 0x0
 00815   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1522, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1522, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\220\1\0\0`\3\0\0" ... {28, 56, reply, 0, 400, 412, 1523, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\220\1\0\0`\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1523, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1522, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\220\1\0\0`\3\0\0" ... {28, 56, reply, 0, 400, 412, 1523, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\220\1\0\0`\3\0\0" )  ) == 0x0
 00816   412   NtResumeThread  (228, ... 1, ) == 0x0
 00817   412   NtSetInformationThread  (228, BasePriority, {thread info, class 3, size 4}, 4, ...
 00818   864   NtTestAlert  (... ) == 0x0
 00819   864   NtContinue  (28769584, 1, ...
 00820   864   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00821   864   NtWaitForSingleObject  (164, 0, 0x0, ...
 00817   412   NtSetInformationThread  ... ) == 0x0
 00822   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 28770304, 1048576, ) == 0x0
 00823   412   NtAllocateVirtualMemory  (-1, 29810688, 0, 8192, 4096, 4, ... 29810688, 8192, ) == 0x0
 00824   412   NtProtectVirtualMemory  (-1, (0x1c6e000), 4096, 260, ... (0x1c6e000), 4096, 4, ) == 0x0
 00825   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 232, {400, 868}, ) == 0x0
 00826   412   NtQueryInformationThread  (232, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=400,Tid=868,}, 0x0, ) == 0x0
 00827   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1523, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1523, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\220\1\0\0d\3\0\0" ... {28, 56, reply, 0, 400, 412, 1524, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\220\1\0\0d\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1524, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1523, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\220\1\0\0d\3\0\0" ... {28, 56, reply, 0, 400, 412, 1524, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\220\1\0\0d\3\0\0" )  ) == 0x0
 00828   412   NtResumeThread  (232, ... 1, ) == 0x0
 00829   412   NtSetInformationThread  (232, BasePriority, {thread info, class 3, size 4}, 4, ...
 00830   868   NtTestAlert  (... ) == 0x0
 00831   868   NtContinue  (29818160, 1, ...
 00832   868   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00833   868   NtWaitForSingleObject  (168, 0, 0x0, ...
 00829   412   NtSetInformationThread  ... ) == 0x0
 00834   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 29818880, 1048576, ) == 0x0
 00835   412   NtAllocateVirtualMemory  (-1, 30859264, 0, 8192, 4096, 4, ... 30859264, 8192, ) == 0x0
 00836   412   NtProtectVirtualMemory  (-1, (0x1d6e000), 4096, 260, ... (0x1d6e000), 4096, 4, ) == 0x0
 00837   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 236, {400, 872}, ) == 0x0
 00838   412   NtQueryInformationThread  (236, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=400,Tid=872,}, 0x0, ) == 0x0
 00839   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1524, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1524, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\220\1\0\0h\3\0\0" ... {28, 56, reply, 0, 400, 412, 1525, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\220\1\0\0h\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1525, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1524, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\220\1\0\0h\3\0\0" ... {28, 56, reply, 0, 400, 412, 1525, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\220\1\0\0h\3\0\0" )  ) == 0x0
 00840   412   NtResumeThread  (236, ... 1, ) == 0x0
 00841   412   NtSetInformationThread  (236, BasePriority, {thread info, class 3, size 4}, 4, ...
 00842   872   NtTestAlert  (... ) == 0x0
 00843   872   NtContinue  (30866736, 1, ...
 00844   872   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00845   872   NtWaitForSingleObject  (172, 0, 0x0, ...
 00841   412   NtSetInformationThread  ... ) == 0x0
 00846   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 30867456, 1048576, ) == 0x0
 00847   412   NtAllocateVirtualMemory  (-1, 31907840, 0, 8192, 4096, 4, ... 31907840, 8192, ) == 0x0
 00848   412   NtProtectVirtualMemory  (-1, (0x1e6e000), 4096, 260, ... (0x1e6e000), 4096, 4, ) == 0x0
 00849   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 240, {400, 876}, ) == 0x0
 00850   412   NtQueryInformationThread  (240, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=400,Tid=876,}, 0x0, ) == 0x0
 00851   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1525, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1525, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\360\0\0\0\220\1\0\0l\3\0\0" ... {28, 56, reply, 0, 400, 412, 1526, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\360\0\0\0\220\1\0\0l\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1526, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1525, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\360\0\0\0\220\1\0\0l\3\0\0" ... {28, 56, reply, 0, 400, 412, 1526, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\360\0\0\0\220\1\0\0l\3\0\0" )  ) == 0x0
 00852   412   NtResumeThread  (240, ... 1, ) == 0x0
 00853   876   NtTestAlert  (... ) == 0x0
 00854   876   NtContinue  (31915312, 1, ...
 00855   876   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00856   876   NtWaitForSingleObject  (176, 0, 0x0, ...
 00857   412   NtSetInformationThread  (240, BasePriority, {thread info, class 3, size 4}, 4, ... ) == 0x0
 00858   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 31916032, 1048576, ) == 0x0
 00859   412   NtAllocateVirtualMemory  (-1, 32956416, 0, 8192, 4096, 4, ... 32956416, 8192, ) == 0x0
 00860   412   NtProtectVirtualMemory  (-1, (0x1f6e000), 4096, 260, ... (0x1f6e000), 4096, 4, ) == 0x0
 00861   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 244, {400, 880}, ) == 0x0
 00862   412   NtQueryInformationThread  (244, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=400,Tid=880,}, 0x0, ) == 0x0
 00863   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1526, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1526, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\364\0\0\0\220\1\0\0p\3\0\0" ... {28, 56, reply, 0, 400, 412, 1527, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\364\0\0\0\220\1\0\0p\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1527, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1526, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\364\0\0\0\220\1\0\0p\3\0\0" ... {28, 56, reply, 0, 400, 412, 1527, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\364\0\0\0\220\1\0\0p\3\0\0" )  ) == 0x0
 00864   412   NtResumeThread  (244, ... 1, ) == 0x0
 00865   412   NtSetInformationThread  (244, BasePriority, {thread info, class 3, size 4}, 4, ...
 00866   880   NtTestAlert  (... ) == 0x0
 00867   880   NtContinue  (32963888, 1, ...
 00868   880   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00869   880   NtWaitForSingleObject  (180, 0, 0x0, ...
 00865   412   NtSetInformationThread  ... ) == 0x0
 00870   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 32964608, 1048576, ) == 0x0
 00871   412   NtAllocateVirtualMemory  (-1, 34004992, 0, 8192, 4096, 4, ... 34004992, 8192, ) == 0x0
 00872   412   NtProtectVirtualMemory  (-1, (0x206e000), 4096, 260, ... (0x206e000), 4096, 4, ) == 0x0
 00873   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 248, {400, 884}, ) == 0x0
 00874   412   NtQueryInformationThread  (248, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=400,Tid=884,}, 0x0, ) == 0x0
 00875   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1527, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1527, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\370\0\0\0\220\1\0\0t\3\0\0" ... {28, 56, reply, 0, 400, 412, 1528, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\370\0\0\0\220\1\0\0t\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1528, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1527, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\370\0\0\0\220\1\0\0t\3\0\0" ... {28, 56, reply, 0, 400, 412, 1528, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\370\0\0\0\220\1\0\0t\3\0\0" )  ) == 0x0
 00876   412   NtResumeThread  (248, ... 1, ) == 0x0
 00877   412   NtSetInformationThread  (248, BasePriority, {thread info, class 3, size 4}, 4, ...
 00878   884   NtTestAlert  (... ) == 0x0
 00879   884   NtContinue  (34012464, 1, ...
 00880   884   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00881   884   NtWaitForSingleObject  (184, 0, 0x0, ...
 00877   412   NtSetInformationThread  ... ) == 0x0
 00882   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 34013184, 1048576, ) == 0x0
 00883   412   NtAllocateVirtualMemory  (-1, 35053568, 0, 8192, 4096, 4, ... 35053568, 8192, ) == 0x0
 00884   412   NtProtectVirtualMemory  (-1, (0x216e000), 4096, 260, ... (0x216e000), 4096, 4, ) == 0x0
 00885   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 252, {400, 888}, ) == 0x0
 00886   412   NtQueryInformationThread  (252, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=400,Tid=888,}, 0x0, ) == 0x0
 00887   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1528, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1528, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\374\0\0\0\220\1\0\0x\3\0\0" ... {28, 56, reply, 0, 400, 412, 1529, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\374\0\0\0\220\1\0\0x\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1529, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1528, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\374\0\0\0\220\1\0\0x\3\0\0" ... {28, 56, reply, 0, 400, 412, 1529, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\374\0\0\0\220\1\0\0x\3\0\0" )  ) == 0x0
 00888   412   NtResumeThread  (252, ... 1, ) == 0x0
 00889   412   NtSetInformationThread  (252, BasePriority, {thread info, class 3, size 4}, 4, ...
 00890   888   NtTestAlert  (... ) == 0x0
 00891   888   NtContinue  (35061040, 1, ...
 00892   888   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00893   888   NtWaitForSingleObject  (188, 0, 0x0, ...
 00889   412   NtSetInformationThread  ... ) == 0x0
 00894   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 35061760, 1048576, ) == 0x0
 00895   412   NtAllocateVirtualMemory  (-1, 36102144, 0, 8192, 4096, 4, ... 36102144, 8192, ) == 0x0
 00896   412   NtProtectVirtualMemory  (-1, (0x226e000), 4096, 260, ... (0x226e000), 4096, 4, ) == 0x0
 00897   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 256, {400, 892}, ) == 0x0
 00898   412   NtQueryInformationThread  (256, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9f000,Pid=400,Tid=892,}, 0x0, ) == 0x0
 00899   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1529, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1529, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\0\1\0\0\220\1\0\0|\3\0\0" ... {28, 56, reply, 0, 400, 412, 1530, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\0\1\0\0\220\1\0\0|\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1530, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1529, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\0\1\0\0\220\1\0\0|\3\0\0" ... {28, 56, reply, 0, 400, 412, 1530, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\0\1\0\0\220\1\0\0|\3\0\0" )  ) == 0x0
 00900   412   NtResumeThread  (256, ... 1, ) == 0x0
 00901   412   NtSetInformationThread  (256, BasePriority, {thread info, class 3, size 4}, 4, ...
 00902   892   NtTestAlert  (... ) == 0x0
 00903   892   NtContinue  (36109616, 1, ...
 00904   892   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00905   892   NtWaitForSingleObject  (192, 0, 0x0, ...
 00901   412   NtSetInformationThread  ... ) == 0x0
 00906   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 36110336, 1048576, ) == 0x0
 00907   412   NtAllocateVirtualMemory  (-1, 37150720, 0, 8192, 4096, 4, ... 37150720, 8192, ) == 0x0
 00908   412   NtProtectVirtualMemory  (-1, (0x236e000), 4096, 260, ... (0x236e000), 4096, 4, ) == 0x0
 00909   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 260, {400, 896}, ) == 0x0
 00910   412   NtQueryInformationThread  (260, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9e000,Pid=400,Tid=896,}, 0x0, ) == 0x0
 00911   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1530, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1530, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\4\1\0\0\220\1\0\0\200\3\0\0" ... {28, 56, reply, 0, 400, 412, 1531, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\4\1\0\0\220\1\0\0\200\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1531, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1530, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\4\1\0\0\220\1\0\0\200\3\0\0" ... {28, 56, reply, 0, 400, 412, 1531, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\4\1\0\0\220\1\0\0\200\3\0\0" )  ) == 0x0
 00912   412   NtResumeThread  (260, ... 1, ) == 0x0
 00913   412   NtSetInformationThread  (260, BasePriority, {thread info, class 3, size 4}, 4, ...
 00914   896   NtTestAlert  (... ) == 0x0
 00915   896   NtContinue  (37158192, 1, ...
 00916   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00917   896   NtWaitForSingleObject  (196, 0, 0x0, ...
 00913   412   NtSetInformationThread  ... ) == 0x0
 00918   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 37158912, 1048576, ) == 0x0
 00919   412   NtAllocateVirtualMemory  (-1, 38199296, 0, 8192, 4096, 4, ... 38199296, 8192, ) == 0x0
 00920   412   NtProtectVirtualMemory  (-1, (0x246e000), 4096, 260, ... (0x246e000), 4096, 4, ) == 0x0
 00921   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 264, {400, 900}, ) == 0x0
 00922   412   NtQueryInformationThread  (264, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9d000,Pid=400,Tid=900,}, 0x0, ) == 0x0
 00923   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1531, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1531, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\10\1\0\0\220\1\0\0\204\3\0\0" ... {28, 56, reply, 0, 400, 412, 1532, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\10\1\0\0\220\1\0\0\204\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1532, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1531, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\10\1\0\0\220\1\0\0\204\3\0\0" ... {28, 56, reply, 0, 400, 412, 1532, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\10\1\0\0\220\1\0\0\204\3\0\0" )  ) == 0x0
 00924   412   NtResumeThread  (264, ... 1, ) == 0x0
 00925   900   NtTestAlert  (... ) == 0x0
 00926   900   NtContinue  (38206768, 1, ...
 00927   900   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00928   900   NtWaitForSingleObject  (200, 0, 0x0, ...
 00929   412   NtSetInformationThread  (264, BasePriority, {thread info, class 3, size 4}, 4, ... ) == 0x0
 00930   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 38207488, 1048576, ) == 0x0
 00931   412   NtAllocateVirtualMemory  (-1, 39247872, 0, 8192, 4096, 4, ... 39247872, 8192, ) == 0x0
 00932   412   NtProtectVirtualMemory  (-1, (0x256e000), 4096, 260, ... (0x256e000), 4096, 4, ) == 0x0
 00933   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 268, {400, 916}, ) == 0x0
 00934   412   NtQueryInformationThread  (268, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9c000,Pid=400,Tid=916,}, 0x0, ) == 0x0
 00935   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1532, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1532, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\14\1\0\0\220\1\0\0\224\3\0\0" ... {28, 56, reply, 0, 400, 412, 1533, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\14\1\0\0\220\1\0\0\224\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1533, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1532, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\14\1\0\0\220\1\0\0\224\3\0\0" ... {28, 56, reply, 0, 400, 412, 1533, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\14\1\0\0\220\1\0\0\224\3\0\0" )  ) == 0x0
 00936   412   NtResumeThread  (268, ... 1, ) == 0x0
 00937   412   NtSetInformationThread  (268, BasePriority, {thread info, class 3, size 4}, 4, ...
 00938   916   NtTestAlert  (... ) == 0x0
 00939   916   NtContinue  (39255344, 1, ...
 00940   916   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00941   916   NtWaitForSingleObject  (204, 0, 0x0, ...
 00937   412   NtSetInformationThread  ... ) == 0x0
 00942   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 39256064, 1048576, ) == 0x0
 00943   412   NtAllocateVirtualMemory  (-1, 40296448, 0, 8192, 4096, 4, ... 40296448, 8192, ) == 0x0
 00944   412   NtProtectVirtualMemory  (-1, (0x266e000), 4096, 260, ... (0x266e000), 4096, 4, ) == 0x0
 00945   412   NtCreateThread  (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 272, {400, 920}, ) == 0x0
 00946   412   NtQueryInformationThread  (272, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9b000,Pid=400,Tid=920,}, 0x0, ) == 0x0
 00947   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 400, 412, 1533, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1533, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\20\1\0\0\220\1\0\0\230\3\0\0" ... {28, 56, reply, 0, 400, 412, 1534, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\20\1\0\0\220\1\0\0\230\3\0\0" )  ... {28, 56, reply, 0, 400, 412, 1534, 0}  (24, {28, 56, new_msg, 0, 400, 412, 1533, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\20\1\0\0\220\1\0\0\230\3\0\0" ... {28, 56, reply, 0, 400, 412, 1534, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\20\1\0\0\220\1\0\0\230\3\0\0" )  ) == 0x0
 00948   412   NtResumeThread  (272, ... 1, ) == 0x0
 00949   412   NtSetInformationThread  (272, BasePriority, {thread info, class 3, size 4}, 4, ...
 00950   920   NtTestAlert  (... ) == 0x0
 00951   920   NtContinue  (40303920, 1, ...
 00952   920   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00953   920   NtWaitForSingleObject  (208, 0, 0x0, ...
 00949   412   NtSetInformationThread  ... ) == 0x0
 00954   412   NtSetEvent  (184, ...
 00881   884   NtWaitForSingleObject  ... ) == 0x0
 00955   884   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 00956   884   NtWaitForSingleObject  (184, 0, 0x0, ...
 00954   412   NtSetEvent  ... 0x0, ) == 0x0
 00957   412   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 00958   412   NtSetEvent  (188, ...
 00893   888   NtWaitForSingleObject  ... ) == 0x0
 00959   888   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 00960   888   NtWaitForSingleObject  (188, 0, 0x0, ...
 00958   412   NtSetEvent  ... 0x0, ) == 0x0
 00961   412   NtDelayExecution  (0, {0, 0}, ... ) == 0x0
 00962   412   NtUserModifyUserStartupInfoFlags  (1, 0, ... ) == 0x810ceb30
 00963   412   NtUserGetDCEx  (0, 0, 3, ... ) == 0x1010051
 00964   412   NtGdiSetupPublicCFONT  (16842833, 0, 0, ... ) == 0x100
 00965   412   NtGdiGetTextExtent  (16842833, 1334984, 7, 1244388, 1, ... ) == 0x1
 00966   412   NtUserGetForegroundWindow  (... ) == 0x20064
 00967   412   NtUserQueryWindow  (131172, 0, ... ) == 0x7fc
 00968   412   NtUserQueryWindow  (131172, 1, ... ) == 0x70
 00969   412   NtGdiSetupPublicCFONT  (16842833, 0, 0, ... ) == 0x100
 00970   412   NtGdiGetTextMetricsW  (16842833, 1243308, 68, ... ) == 0x1
 00971   412   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00972   412   NtGdiGetTextCharsetInfo  (16842833, 0, 0, ... ) == 0x0
 00973   412   NtGdiCreateRectRgn  (0, 0, 1, 1, ... ) == 0x1604040b
 00974   412   NtGdiGetRandomRgn  (16842833, 369361931, 1, ... ) == 0x0
 00975   412   NtGdiIntersectClipRect  (16842833, 0, 0, 565, 738, ... ) == 0x3
 00976   412   NtGdiExtSelectClipRgn  (16842833, 0, 5, ... ) == 0x2
 00977   412   NtGdiSetupPublicCFONT  (0, 50987263, 6, ... ) == 0x3
 00978   412   NtGdiGetTextCharsetInfo  (16842833, 0, 0, ... ) == 0x0
 00979   412   NtGdiGetRandomRgn  (16842833, 386139147, 1, ... ) == 0x0
 00980   412   NtGdiIntersectClipRect  (16842833, 0, 0, 274, 738, ... ) == 0x3
 00981   412   NtGdiExtSelectClipRgn  (16842833, 0, 5, ... ) == 0x2
 00982   412   NtUserCallOneParam  (16842833, 56, ... ) == 0x1
 00983   412   NtUserFindExistingCursorIcon  (1243176, 1243192, 1243760, ... ) == 0x10011
 00984   412   NtUserSetCursor  (65553, ... ) == 0x10015
 00985   412   NtUserCallOneParam  (1, 49, ... ) == 0x1
 00986   412   NtUserFindExistingCursorIcon  (1243128, 1243144, 1243712, ... ) == 0x10015
 00712   576   NtDelayExecution  ... ) == 0x0
 00713   596   NtDelayExecution  ... ) == 0x0
 00714   636   NtDelayExecution  ... ) == 0x0
 00715   732   NtDelayExecution  ... ) == 0x0
 00716   744   NtDelayExecution  ... ) == 0x0
 00725   676   NtDelayExecution  ... ) == 0x0
 00735   788   NtDelayExecution  ... ) == 0x0
 00987   412   NtUserSetCursor  (65557, ...
 00988   576   NtDelayExecution  (0, {-20010000, -1}, ...
 00989   596   NtDelayExecution  (0, {-20010000, -1}, ...
 00990   636   NtDelayExecution  (0, {-20010000, -1}, ...
 00991   732   NtDelayExecution  (0, {-20010000, -1}, ...
 00992   676   NtDelayExecution  (0, {-20010000, -1}, ...
 00993   788   NtDelayExecution  (0, {-20010000, -1}, ...
 00987   412   NtUserSetCursor  ... ) == 0x10011
 00994   412   NtGdiCreateCompatibleDC  (0, ... ) == 0xf0103cc
 00995   412   NtGdiExtGetObjectW  (50987263, 92, 1243456, ... ) == 0x5c
 00996   412   NtGdiHfontCreate  (1242892, 356, 0, 0, 1336368, ... ) == 0x60a03d7
 00997   412   NtGdiGetTextMetricsW  (251724748, 1243396, 68, ... ) == 0x1
 00998   412   NtGdiGetWidthTable  (251724748, 52, 1337072, 308, 1337688, 1336440, 1336456, ... ) == 0x1
 00999   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01000   412   NtGdiDeleteObjectApp  (251724748, ... ) == 0x1
 01001   412   NtUserGetForegroundWindow  (... ) == 0x20064
 01002   412   NtUserQueryWindow  (131172, 0, ... ) == 0x7fc
 01003   412   NtUserQueryWindow  (131172, 1, ... ) == 0x70
 01004   412   NtUserGetAtomName  (32770, 1242332, ... ) == 0x6
 01005   412   NtUserCreateWindowEx  (65793, 32770, 32770,  (65793, 32770, 32770, "Themida", -2134375995, 341, 335, 350, 126, 0, 0, 2010382336, 0, 1073742848, 0, ... , -2134375995, 341, 335, 350, 126, 0, 0, 2010382336, 0, 1073742848, 0, ...
 01006   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1239856, ... ) }, 1239856, ... ) == 0x0
 01007   412   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 276, {status=0x0, info=1}, ) }, 5, 96, ... 276, {status=0x0, info=1}, ) == 0x0
 01008   412   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 276, ... 280, ) == 0x0
 01009   412   NtClose  (276, ... ) == 0x0
 01010   412   NtMapViewOfSection  (280, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2670000), 0x0, 204800, ) == 0x0
 01011   412   NtClose  (280, ... ) == 0x0
 01012   412   NtUnmapViewOfSection  (-1, 0x2670000, ... ) == 0x0
 01013   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1240172, ... ) }, 1240172, ... ) == 0x0
 01014   412   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 280, {status=0x0, info=1}, ) }, 5, 96, ... 280, {status=0x0, info=1}, ) == 0x0
 01015   412   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 280, ... 276, ) == 0x0
 01016   412   NtQuerySection  (276, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01017   412   NtClose  (280, ... ) == 0x0
 01018   412   NtMapViewOfSection  (276, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 212992, ) == 0x0
 01019   412   NtClose  (276, ... ) == 0x0
 01020   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 276, ) }, ... 276, ) == 0x0
 01021   412   NtMapViewOfSection  (276, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 339968, ) == 0x0
 01022   412   NtClose  (276, ... ) == 0x0
 01023   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01024   412   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40304640, 65536, ) == 0x0
 01025   412   NtAllocateVirtualMemory  (-1, 40304640, 0, 4096, 4096, 4, ... 40304640, 4096, ) == 0x0
 01026   412   NtAllocateVirtualMemory  (-1, 40308736, 0, 8192, 4096, 4, ... 40308736, 8192, ) == 0x0
 01027   412   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 276, ) }, ... 276, ) == 0x0
 01028   412   NtMapViewOfSection  (276, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2680000), 0x0, 12288, ) == 0x0
 01029   412   NtClose  (276, ... ) == 0x0
 01030   412   NtAllocateVirtualMemory  (-1, 40316928, 0, 4096, 4096, 4, ... 40316928, 4096, ) == 0x0
 01031   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01032   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01033   412   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01034   412   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 276, ) == 0x0
 01035   412   NtQueryInformationToken  (276, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01036   412   NtClose  (276, ... ) == 0x0
 01037   412   NtOpenKey  (0x2001f, {24, 0, 0x640, 0, 0,  (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 276, ) }, ... 276, ) == 0x0
 01038   412   NtOpenKey  (0x1, {24, 276, 0x40, 0, 0,  (0x1, {24, 276, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 280, ) }, ... 280, ) == 0x0
 01039   412   NtQueryValueKey  (280,  (280, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01040   412   NtClose  (280, ... ) == 0x0
 01041   412   NtClose  (276, ... ) == 0x0
 01042   412   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01043   412   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 276, ) == 0x0
 01044   412   NtQueryInformationToken  (276, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01045   412   NtClose  (276, ... ) == 0x0
 01046   412   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 276, ) }, ... 276, ) == 0x0
 01047   412   NtOpenKey  (0x1, {24, 276, 0x40, 0, 0,  (0x1, {24, 276, 0x40, 0, 0, "Control Panel\Desktop"}, ... 280, ) }, ... 280, ) == 0x0
 01048   412   NtQueryValueKey  (280,  (280, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01049   412   NtClose  (280, ... ) == 0x0
 01050   412   NtClose  (276, ... ) == 0x0
 01051   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\UxTheme.dll"}, 1239672, ... ) }, 1239672, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01052   412   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "UxTheme.dll"}, 1239672, ... ) }, 1239672, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01053   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\UxTheme.dll"}, 1239672, ... ) }, 1239672, ... ) == 0x0
 01054   412   NtUserGetProcessWindowStation  (... ) == 0x24
 01055   412   NtUserGetObjectInformation  (36, 2, 0, 0, 1241968, ... ) == 0x0
 01056   412   NtUserGetObjectInformation  (36, 2, 1338488, 16, 1241968, ... ) == 0x1
 01057   412   NtUserGetGUIThreadInfo  (412, 1241924, ... ) == 0x1
 01058   412   NtConnectPort  ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1241744, 64, ... 276, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1241744, 64, ... 276, 0x0, 0x0, 0x0, 64, ) == 0x0
 01059   412   NtRequestWaitReplyPort  (276, {32, 56, new_msg, 0, 0, 0, 0, 0}  (276, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 400, 412, 1539, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 400, 412, 1539, 0}  (276, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 400, 412, 1539, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01060   412   NtRequestWaitReplyPort  (276, {32, 56, new_msg, 0, 0, 0, 0, 0}  (276, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 400, 412, 1540, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 400, 412, 1540, 0}  (276, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 400, 412, 1540, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01061   412   NtUserCallNoParam  (29, ...
 01062   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1239216, ... ) }, 1239216, ... ) == 0x0
 01061   412   NtUserCallNoParam  ... ) == 0x0
 01063   412   NtUserSystemParametersInfo  (41, 0, 1524225160, 0, ... ) == 0x1
 01064   412   NtGdiHfontCreate  (1241296, 356, 0, 0, 1336360, ... ) == 0x110a03cc
 01065   412   NtGdiHfontCreate  (1241296, 356, 0, 0, 1336352, ... ) == 0x2b0a040d
 01066   412   NtRequestWaitReplyPort  (276, {32, 56, new_msg, 0, 0, 0, 0, 0}  (276, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 400, 412, 1541, 0} "\0\0\0\0\0\0\0\0\30\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 400, 412, 1541, 0}  (276, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 400, 412, 1541, 0} "\0\0\0\0\0\0\0\0\30\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01067   412   NtMapViewOfSection  (280, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x2690000), {0, 0}, 331776, ) == 0x0
 01068   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01069   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01070   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01071   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01072   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01073   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01074   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01075   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01076   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01077   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01078   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01079   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01080   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01081   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01082   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01083   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01084   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01085   412   NtGdiCreatePatternBrushInternal  (59048369, 0, 0, ... ) == 0x19100404
 01086   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01087   412   NtUserCallNoParam  (29, ...
 01088   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1238660, ... ) }, 1238660, ... ) == 0x0
 01089   412   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 01087   412   NtUserCallNoParam  ... ) == 0x0
 01090   412   NtUserCallNoParam  (29, ...
 01091   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1238656, ... ) }, 1238656, ... ) == 0x0
 01090   412   NtUserCallNoParam  ... ) == 0x0
 01092   412   NtUserSetWindowFNID  (131250, 676, ... ) == 0x1
 01093   412   NtUserCallHwndParam  (131250, 1338556, 78, ... ) == 0x146cbc
 01094   412   NtUserMessageCall  (0x200b2, WM_NCCREATE, 0x0, 0x12f488, 0, 670, 0, ... ) == 0x1
 01095   412   NtUserMessageCall  (0x200b2, WM_NCCALCSIZE, 0x0, 0x12f4b0, 0, 670, 0, ... ) == 0x0
 01096   412   NtUserGetClassName  (131250, 0, 1241464, ... ) == 0x6
 01097   412   NtUserRemoveProp  (131250, 43282, ... ) == 0x0
 01098   412   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 3801155, 5701724, 5111881, 5177412}  (24, {24, 52, new_msg, 0, 3801155, 5701724, 5111881, 5177412} "\0\0\0\0\5\4\3\0y\0s\0t\0e\0\234\1\0\0\0\0\0\0" ... {24, 52, reply, 0, 400, 412, 1542, 0} "\0\0\0\0\5\4\3\0\0\0\0\0t\0e\0\234\1\0\0\0\0\0\0" )  ... {24, 52, reply, 0, 400, 412, 1542, 0}  (24, {24, 52, new_msg, 0, 3801155, 5701724, 5111881, 5177412} "\0\0\0\0\5\4\3\0y\0s\0t\0e\0\234\1\0\0\0\0\0\0" ... {24, 52, reply, 0, 400, 412, 1542, 0} "\0\0\0\0\5\4\3\0\0\0\0\0t\0e\0\234\1\0\0\0\0\0\0" )  ) == 0x0
 01099   412   NtUserGetThreadDesktop  (412, 0, ... ) == 0x28
 01100   412   NtUserGetObjectInformation  (40, 2, 1241140, 520, 0, ... ) == 0x1
 01101   412   NtGdiDeleteObjectApp  (420480004, ... ) == 0x1
 01102   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01103   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01104   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01105   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01106   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01107   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01108   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01109   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01110   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01111   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01112   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01113   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01114   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01115   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01116   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01117   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01118   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01119   412   NtGdiCreatePatternBrushInternal  (59048369, 0, 0, ... ) == 0x1a100404
 01120   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01121   412   NtAllocateVirtualMemory  (-1, 40321024, 0, 4096, 4096, 4, ... 40321024, 4096, ) == 0x0
 01122   412   NtUserSetProp  (131250, 43288, 40320344, ... ) == 0x1
 01005   412   NtUserCreateWindowEx  ... ) == 0x200b2
 01123   412   NtUserCallHwndLock  (131250, 89, ...
 01124   412   NtQueryDefaultUILanguage  (2013024600, ...
 01125   412   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01126   412   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482032, ) == 0x0
 01127   412   NtQueryInformationToken  (-2147482032, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01128   412   NtClose  (-2147482032, ... ) == 0x0
 01129   412   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 01130   412   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01131   412   NtOpenKey  (0x80000000, {24, -2147482032, 0x640, 0, 0,  (0x80000000, {24, -2147482032, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482044, ) }, ... -2147482044, ) == 0x0
 01132   412   NtQueryValueKey  (-2147482044,  (-2147482044, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01133   412   NtClose  (-2147482044, ... ) == 0x0
 01134   412   NtClose  (-2147482032, ... ) == 0x0
 01124   412   NtQueryDefaultUILanguage  ... ) == 0x0
 01135   412   NtQueryInstallUILanguage  (2013024602, ... ) == 0x0
 01136   412   NtQueryDefaultLocale  (1, 1243232, ... ) == 0x0
 01137   412   NtUserCallNoParam  (0, ... ) == 0x20091
 01138   412   NtUserCallNoParam  (0, ... ) == 0x2006b
 01139   412   NtUserThunkedMenuItemInfo  (131179, -1, 1, 1, 1243272, 1243320, ...
 01140   412   NtAllocateVirtualMemory  (-1, 9732096, 0, 4096, 4096, 32, ... 9732096, 4096, ) == 0x0
 01139   412   NtUserThunkedMenuItemInfo  ... ) == 0x1
 01141   412   NtUserThunkedMenuItemInfo  (131179, -1, 1, 1, 1243272, 1243320, ... ) == 0x1
 01142   412   NtUserThunkedMenuItemInfo  (131217, -1, 1, 1, 1243368, 1243416, ... ) == 0x1
 01123   412   NtUserCallHwndLock  ... ) == 0x1
 01143   412   NtUserGetAtomName  (49175, 1242332, ... ) == 0x6
 01144   412   NtUserCreateWindowEx  (4, 49175, 49175,  (4, 49175, 49175, "OK", 1342373889, 134, 60, 75, 23, 131250, 1, 2010382336, 0, 1073742848, 0, ... , 1342373889, 134, 60, 75, 23, 131250, 1, 2010382336, 0, 1073742848, 0, ...
 01145   412   NtUserSetWindowFNID  (65734, 673, ... ) == 0x1
 01146   412   NtUserSetWindowLong  (65734, 0, 1338788, 0, ... ) == 0x0
 01147   412   NtUserMessageCall  (0x100c6, WM_NCCREATE, 0x0, 0x12f488, 0, 670, 0, ... ) == 0x1
 01148   412   NtUserMessageCall  (0x100c6, WM_NCCALCSIZE, 0x0, 0x12f4b0, 0, 670, 0, ... ) == 0x0
 01149   412   NtUserSetProp  (65734, 43288, -1, ... ) == 0x1
 01144   412   NtUserCreateWindowEx  ... ) == 0x100c6
 01150   412   NtUserGetAtomName  (49177, 1242332, ... ) == 0x6
 01151   412   NtUserCreateWindowEx  (4, 49177, 49177, "1342308355, 11, 11, 0, 0, 131250, 20, 2010382336, 0, 1073742848, 0, ...
 01152   412   NtUserSetWindowFNID  (65736, 680, ... ) == 0x1
 01153   412   NtUserSetWindowLong  (65736, 0, 1338992, 0, ... ) == 0x0
 01154   412   NtUserMessageCall  (0x100c8, WM_NCCREATE, 0x0, 0x12f488, 0, 670, 0, ... ) == 0x1
 01155   412   NtUserMessageCall  (0x100c8, WM_NCCALCSIZE, 0x0, 0x12f4b0, 0, 670, 0, ... ) == 0x0
 01156   412   NtUserSetProp  (65736, 43288, -1, ... ) == 0x1
 01157   412   NtUserFindExistingCursorIcon  (1241120, 1241136, 1241704, ... ) == 0x0
 01158   412   NtUserFindExistingCursorIcon  (1241120, 1241136, 1241704, ... ) == 0x0
 01159   412   NtUserFindExistingCursorIcon  (1241120, 1241136, 1241704, ... ) == 0x10009
 01160   412   NtUserGetIconSize  (65545, 0, 1241724, 1241728, ... ) == 0x1
 01161   412   NtUserGetCursorFrameInfo  (65545, 0, 1241760, 1241736, ... ) == 0x10009
 01162   412   NtUserSetWindowPos  (65736, 0, 0, 0, 32, 32, 22, ...
 01163   412   NtUserMessageCall  (0x100c8, WM_WINDOWPOSCHANGING, 0x0, 0x12f1f8, 0, 670, 0, ... ) == 0x0
 01164   412   NtUserMessageCall  (0x100c8, WM_NCCALCSIZE, 0x1, 0x12f1cc, 0, 670, 0, ... ) == 0x0
 01162   412   NtUserSetWindowPos  ... ) == 0x1
 01151   412   NtUserCreateWindowEx  ... ) == 0x100c8
 01165   412   NtUserGetAtomName  (49177, 1242332, ... ) == 0x6
 01166   412   NtUserCreateWindowEx  (4, 49177, 49177,  (4, 49177, 49177, "Sorry, this application cannot run under a Virtual Machine", 1342316672, 62, 20, 276, 15, 131250, 65535, 2010382336, 0, 1073742848, 0, ... , 1342316672, 62, 20, 276, 15, 131250, 65535, 2010382336, 0, 1073742848, 0, ...
 01167   412   NtUserSetWindowFNID  (65738, 680, ... ) == 0x1
 01168   412   NtUserSetWindowLong  (65738, 0, 1338968, 0, ... ) == 0x0
 01169   412   NtUserMessageCall  (0x100ca, WM_NCCREATE, 0x0, 0x12f488, 0, 670, 0, ... ) == 0x1
 01170   412   NtUserMessageCall  (0x100ca, WM_NCCALCSIZE, 0x0, 0x12f4b0, 0, 670, 0, ... ) == 0x0
 01171   412   NtUserSetProp  (65738, 43288, -1, ... ) == 0x1
 01166   412   NtUserCreateWindowEx  ... ) == 0x100ca
 01172   412   NtUserSetWindowLong  (131250, -21, 1244832, 0, ... ) == 0x0
 01173   412   NtUserCallHwnd  (131250, 72, ... ) == 0xbc645e40
 01174   412   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 01175   412   NtAllocateVirtualMemory  (-1, 0, 0, 131064, 8192, 4, ... 40828928, 131072, ) == 0x0
 01176   412   NtAllocateVirtualMemory  (-1, 40828928, 0, 4096, 4096, 4, ... 40828928, 4096, ) == 0x0
 01177   412   NtUserSetFocus  (65734, ...
 01178   412   NtUserMessageCall  (0x200b2, WM_NCACTIVATE, 0x1, 0xffffffff, 0, 670, 0, ... ) == 0x1
 01179   412   NtUserInternalGetWindowText  (0x200b2, 260, ...  (0x200b2, 260, ... "Themida", ) , ) == 0x7
 01180   412   NtUserGetWindowDC  (131250, ... ) == 0x1010052
 01181   412   NtGdiGetTextMetricsW  (16842834, 1241392, 68, ... ) == 0x1
 01182   412   NtGdiGetRandomRgn  (16842834, 402916363, 1, ... ) == 0x0
 01183   412   NtGdiIntersectClipRect  (16842834, 0, 0, 0, 0, ... ) == 0x3
 01184   412   NtGdiGetWidthTable  (16842834, 7, 1340440, 263, 1340966, 1339808, 1339824, ... ) == 0x1
 01185   412   NtGdiExtSelectClipRgn  (16842834, 0, 5, ... ) == 0x1
 01186   412   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 01187   412   NtUserCalcMenuBar  (131250, 3, 3, 29, 40320528, ... ) == 0x0
 01188   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x2, 0x0, 1241360, 690, 0, ...
 01189   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x2, 0x0, 0, 670, 0, ... ) == 0x0
 01188   412   NtUserMessageCall  ... ) == 0x0
 01190   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x0, 0x0, 1241360, 690, 0, ...
 01191   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x0, 0x0, 0, 670, 0, ... ) == 0x0
 01190   412   NtUserMessageCall  ... ) == 0x0
 01192   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x1, 0x0, 1241360, 690, 0, ...
 01193   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x1, 0x0, 0, 670, 0, ... ) == 0x0
 01192   412   NtUserMessageCall  ... ) == 0x0
 01194   412   NtUserGetTitleBarInfo  (131250, 1241988, ... ) == 0x1
 01195   412   NtUserGetDCEx  (131250, 0, 66561, ... ) == 0x1010054
 01196   412   NtGdiExcludeClipRect  (16842836, 3, 29, 347, 123, ... ) == 0x3
 01197   412   NtGdiDrawStream  (16842836, 96, 1241392, ... ) == 0x1
 01198   412   NtGdiDrawStream  (16842836, 96, 1241392, ... ) == 0x1
 01199   412   NtGdiDrawStream  (16842836, 96, 1241392, ... ) == 0x1
 01200   412   NtGdiCreateCompatibleBitmap  (16842836, 350, 29, ... ) == 0x100503ff
 01201   412   NtGdiCreateCompatibleDC  (16842836, ... ) == 0x8010407
 01202   412   NtGdiSelectBitmap  (134284295, 268764159, ... ) == 0x185000f
 01203   412   NtGdiDrawStream  (134284295, 96, 1241284, ... ) == 0x1
 01204   412   NtGdiDrawStream  (134284295, 96, 1241240, ... ) == 0x1
 01205   412   NtGdiDrawStream  (134284295, 96, 1241240, ... ) == 0x1
 01206   412   NtUserInternalGetWindowText  (0x200b2, 260, ...  (0x200b2, 260, ... "Themida", ) , ) == 0x7
 01207   412   NtGdiGetRandomRgn  (134284295, 419693579, 1, ... ) == 0x0
 01208   412   NtGdiIntersectClipRect  (134284295, 8, 8, 322, 25, ... ) == 0x3
 01209   412   NtGdiExtSelectClipRgn  (134284295, 0, 5, ... ) == 0x2
 01210   412   NtGdiGetRandomRgn  (134284295, 436470795, 1, ... ) == 0x0
 01211   412   NtGdiIntersectClipRect  (134284295, 7, 7, 321, 25, ... ) == 0x3
 01212   412   NtGdiExtSelectClipRgn  (134284295, 0, 5, ... ) == 0x2
 01213   412   NtGdiBitBlt  (16842836, 0, 0, 350, 29, 134284295, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01214   412   NtGdiSelectBitmap  (134284295, 25493519, ... ) == 0x100503ff
 01215   412   NtGdiDeleteObjectApp  (134284295, ... ) == 0x1
 01216   412   NtGdiDeleteObjectApp  (268764159, ... ) == 0x1
 01217   412   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 01177   412   NtUserSetFocus  ... ) == 0x0
 01218   412   NtUserSetWindowLong  (65734, -12, 2, 0, ... ) == 0x1
 01219   412   NtUserGetClassName  (65734, 0, 1242876, ... ) == 0x6
 01220   412   NtUserGetClassName  (65736, 0, 1242876, ... ) == 0x6
 01221   412   NtUserGetClassName  (65738, 0, 1242876, ... ) == 0x6
 01222   412   NtUserGetAncestor  (131250, 1, ... ) == 0x10014
 01223   412   NtUserSetWindowPos  (131250, 0, 341, 335, 350, 126, 1047, ... ) == 0x1
 01224   412   NtUserMessageCall  (0x200b2, 0x128, 0x30001, 0x0, 0, 670, 0, ...
 01225   412   NtUserMessageCall  (0x100c6, 0x128, 0x30001, 0x0, 0, 670, 0, ... ) == 0x0
 01226   412   NtUserMessageCall  (0x100c8, 0x128, 0x30001, 0x0, 0, 670, 0, ... ) == 0x0
 01227   412   NtUserMessageCall  (0x100ca, 0x128, 0x30001, 0x0, 0, 670, 0, ... ) == 0x0
 01224   412   NtUserMessageCall  ... ) == 0x0
 01228   412   NtUserShowWindow  (131250, 1, ...
 01229   412   NtUserInternalGetWindowText  (0x200b2, 260, ...  (0x200b2, 260, ... "Themida", ) , ) == 0x7
 01230   412   NtUserGetWindowDC  (131250, ... ) == 0x1010054
 01231   412   NtGdiGetRandomRgn  (16842836, 453248011, 1, ... ) == 0x0
 01232   412   NtGdiIntersectClipRect  (16842836, 0, 0, 0, 0, ... ) == 0x3
 01233   412   NtGdiGetCharSet  (16842836, ... ) == 0x4e4
 01234   412   NtGdiExtSelectClipRgn  (16842836, 0, 5, ... ) == 0x2
 01235   412   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 01236   412   NtUserCalcMenuBar  (131250, 3, 3, 29, 40320528, ... ) == 0x0
 01237   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x2, 0x0, 1241976, 690, 0, ...
 01238   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x2, 0x0, 0, 670, 0, ... ) == 0x0
 01237   412   NtUserMessageCall  ... ) == 0x0
 01239   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x0, 0x0, 1241976, 690, 0, ...
 01240   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x0, 0x0, 0, 670, 0, ... ) == 0x0
 01239   412   NtUserMessageCall  ... ) == 0x0
 01241   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x1, 0x0, 1241976, 690, 0, ...
 01242   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x1, 0x0, 0, 670, 0, ... ) == 0x0
 01241   412   NtUserMessageCall  ... ) == 0x0
 01243   412   NtUserGetTitleBarInfo  (131250, 1242604, ... ) == 0x1
 01244   412   NtUserGetDCEx  (131250, 0, 66561, ... ) == 0x1010052
 01245   412   NtGdiExcludeClipRect  (16842834, 3, 29, 347, 123, ... ) == 0x3
 01246   412   NtGdiDrawStream  (16842834, 96, 1242008, ... ) == 0x1
 01247   412   NtGdiDrawStream  (16842834, 96, 1242008, ... ) == 0x1
 01248   412   NtGdiDrawStream  (16842834, 96, 1242008, ... ) == 0x1
 01249   412   NtGdiCreateCompatibleBitmap  (16842834, 350, 29, ... ) == 0x140503ff
 01250   412   NtGdiCreateCompatibleDC  (16842834, ... ) == 0xa010408
 01251   412   NtGdiSelectBitmap  (167838728, 335873023, ... ) == 0x185000f
 01252   412   NtGdiDrawStream  (167838728, 96, 1241900, ... ) == 0x1
 01253   412   NtGdiDrawStream  (167838728, 96, 1241856, ... ) == 0x1
 01254   412   NtGdiDrawStream  (167838728, 96, 1241856, ... ) == 0x1
 01255   412   NtUserInternalGetWindowText  (0x200b2, 260, ...  (0x200b2, 260, ... "Themida", ) , ) == 0x7
 01256   412   NtGdiGetRandomRgn  (167838728, 470025227, 1, ... ) == 0x0
 01257   412   NtGdiIntersectClipRect  (167838728, 8, 8, 322, 25, ... ) == 0x3
 01258   412   NtGdiExtSelectClipRgn  (167838728, 0, 5, ... ) == 0x2
 01259   412   NtGdiGetRandomRgn  (167838728, 486802443, 1, ... ) == 0x0
 01260   412   NtGdiIntersectClipRect  (167838728, 7, 7, 321, 25, ... ) == 0x3
 01261   412   NtGdiExtSelectClipRgn  (167838728, 0, 5, ... ) == 0x2
 01262   412   NtGdiBitBlt  (16842834, 0, 0, 350, 29, 167838728, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01263   412   NtGdiSelectBitmap  (167838728, 25493519, ... ) == 0x140503ff
 01264   412   NtGdiDeleteObjectApp  (167838728, ... ) == 0x1
 01265   412   NtGdiDeleteObjectApp  (335873023, ... ) == 0x1
 01266   412   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 01267   412   NtUserFillWindow  (131250, 131250, 16842832, 4, ...
 01268   412   NtUserGetAncestor  (131250, 1, ... ) == 0x10014
 01269   412   NtUserGetAncestor  (65556, 1, ... ) == 0x0
 01267   412   NtUserFillWindow  ... ) == 0x1
 01270   412   NtUserInternalGetWindowText  (0x200b2, 260, ...  (0x200b2, 260, ... "Themida", ) , ) == 0x7
 01271   412   NtUserGetWindowDC  (131250, ... ) == 0x1010054
 01272   412   NtGdiGetRandomRgn  (16842836, 503579659, 1, ... ) == 0x0
 01273   412   NtGdiIntersectClipRect  (16842836, 0, 0, 0, 0, ... ) == 0x3
 01274   412   NtGdiGetCharSet  (16842836, ... ) == 0x4e4
 01275   412   NtGdiExtSelectClipRgn  (16842836, 0, 5, ... ) == 0x2
 01276   412   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 01277   412   NtUserCalcMenuBar  (131250, 3, 3, 29, 40320528, ... ) == 0x0
 01278   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x2, 0x0, 1242260, 690, 0, ...
 01279   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x2, 0x0, 0, 670, 0, ... ) == 0x0
 01278   412   NtUserMessageCall  ... ) == 0x0
 01280   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x0, 0x0, 1242260, 690, 0, ...
 01281   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x0, 0x0, 0, 670, 0, ... ) == 0x0
 01280   412   NtUserMessageCall  ... ) == 0x0
 01282   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x1, 0x0, 1242260, 690, 0, ...
 01283   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x1, 0x0, 0, 670, 0, ... ) == 0x0
 01282   412   NtUserMessageCall  ... ) == 0x0
 01284   412   NtUserGetTitleBarInfo  (131250, 1242888, ... ) == 0x1
 01285   412   NtUserBuildHwndList  (0, 131250, 1, 0, 64, ... (0x100c6, 0x100c8, 0x100ca, 0x1, ), 4, ) == 0x0
 01286   412   NtUserGetWindowDC  (0, ... ) == 0x1010053
 01287   412   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 01288   412   NtGdiExtCreateRegion  (0, 112, 40322024, ... ) == 0x160403ff
 01289   412   NtGdiOffsetRgn  (369361919, 0, 0, ... ) == 0x3
 01290   412   NtGdiCombineRgn  (520356875, 369361919, 520356875, 5, ... ) == 0x3
 01291   412   NtGdiCreateRectRgn  (0, 0, 1, 1, ... ) == 0xb040408
 01292   412   NtGdiCombineRgn  (520356875, 184812552, 520356875, 2, ... ) == 0x3
 01293   412   NtGdiCreateRectRgn  (0, 0, 1, 1, ... ) == 0x6040405
 01294   412   NtGdiCombineRgn  (520356875, 100926469, 520356875, 2, ... ) == 0x3
 01295   412   NtGdiCreateRectRgn  (0, 0, 1, 1, ... ) == 0x6040406
 01296   412   NtGdiCombineRgn  (520356875, 100926470, 520356875, 2, ... ) == 0x3
 01297   412   NtGdiCreateRectRgn  (0, 0, 1, 1, ... ) == 0xb0403d8
 01298   412   NtGdiCombineRgn  (520356875, 184812504, 520356875, 2, ... ) == 0x3
 01299   412   NtGdiCreateRectRgn  (0, 0, 1, 1, ... ) == 0x80403e3
 01300   412   NtGdiCombineRgn  (134480867, 520356875, 0, 5, ... ) == 0x3
 01301   412   NtUserSetWindowRgn  (131250, 520356875, 1, ...
 01302   412   NtUserMessageCall  (0x200b2, WM_NCCALCSIZE, 0x1, 0x12f64c, 0, 670, 0, ... ) == 0x0
 01303   412   NtUserInternalGetWindowText  (0x200b2, 260, ...  (0x200b2, 260, ... "Themida", ) , ) == 0x7
 01304   412   NtUserGetWindowDC  (131250, ... ) == 0x1010054
 01305   412   NtGdiGetRandomRgn  (16842836, 201589720, 1, ... ) == 0x0
 01306   412   NtGdiIntersectClipRect  (16842836, 0, 0, 0, 0, ... ) == 0x3
 01307   412   NtGdiGetCharSet  (16842836, ... ) == 0x4e4
 01308   412   NtGdiExtSelectClipRgn  (16842836, 0, 5, ... ) == 0x3
 01309   412   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 01310   412   NtUserCalcMenuBar  (131250, 3, 3, 29, 40320528, ... ) == 0x0
 01311   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x2, 0x0, 1241060, 690, 0, ...
 01312   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x2, 0x0, 0, 670, 0, ... ) == 0x0
 01311   412   NtUserMessageCall  ... ) == 0x0
 01313   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x0, 0x0, 1241060, 690, 0, ...
 01314   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x0, 0x0, 0, 670, 0, ... ) == 0x0
 01313   412   NtUserMessageCall  ... ) == 0x0
 01315   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x1, 0x0, 1241060, 690, 0, ...
 01316   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x1, 0x0, 0, 670, 0, ... ) == 0x0
 01315   412   NtUserMessageCall  ... ) == 0x0
 01317   412   NtUserGetTitleBarInfo  (131250, 1241688, ... ) == 0x1
 01318   412   NtUserGetDCEx  (131250, 0, 66561, ... ) == 0x1010050
 01319   412   NtGdiExcludeClipRect  (16842832, 3, 29, 347, 123, ... ) == 0x3
 01320   412   NtGdiDrawStream  (16842832, 96, 1241092, ... ) == 0x1
 01321   412   NtGdiDrawStream  (16842832, 96, 1241092, ... ) == 0x1
 01322   412   NtGdiDrawStream  (16842832, 96, 1241092, ... ) == 0x1
 01323   412   NtGdiCreateCompatibleBitmap  (16842832, 350, 29, ... ) == 0x9050400
 01324   412   NtGdiCreateCompatibleDC  (16842832, ... ) == 0x7010401
 01325   412   NtGdiSelectBitmap  (117507073, 151323648, ... ) == 0x185000f
 01326   412   NtGdiDrawStream  (117507073, 96, 1240984, ... ) == 0x1
 01327   412   NtGdiDrawStream  (117507073, 96, 1240940, ... ) == 0x1
 01328   412   NtGdiDrawStream  (117507073, 96, 1240940, ... ) == 0x1
 01329   412   NtUserInternalGetWindowText  (0x200b2, 260, ...  (0x200b2, 260, ... "Themida", ) , ) == 0x7
 01330   412   NtGdiGetRandomRgn  (117507073, 218366936, 1, ... ) == 0x0
 01331   412   NtGdiIntersectClipRect  (117507073, 8, 8, 322, 25, ... ) == 0x3
 01332   412   NtGdiExtSelectClipRgn  (117507073, 0, 5, ... ) == 0x2
 01333   412   NtGdiGetRandomRgn  (117507073, 235144152, 1, ... ) == 0x0
 01334   412   NtGdiIntersectClipRect  (117507073, 7, 7, 321, 25, ... ) == 0x3
 01335   412   NtGdiExtSelectClipRgn  (117507073, 0, 5, ... ) == 0x2
 01336   412   NtGdiBitBlt  (16842832, 0, 0, 350, 29, 117507073, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01337   412   NtGdiSelectBitmap  (117507073, 25493519, ... ) == 0x9050400
 01338   412   NtGdiDeleteObjectApp  (117507073, ... ) == 0x1
 01339   412   NtGdiDeleteObjectApp  (151323648, ... ) == 0x1
 01340   412   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 01341   412   NtUserFillWindow  (131250, 131250, 16842834, 4, ...
 01342   412   NtUserGetAncestor  (131250, 1, ... ) == 0x10014
 01343   412   NtUserGetAncestor  (65556, 1, ... ) == 0x0
 01341   412   NtUserFillWindow  ... ) == 0x1
 01301   412   NtUserSetWindowRgn  ... ) == 0x1
 01228   412   NtUserShowWindow  ... ) == 0x0
 01344   412   NtUserCallHwndLock  (131250, 93, ...
 01345   412   NtUserMessageCall  (0x200b2, WM_PAINT, 0x0, 0x0, 0, 670, 0, ... ) == 0x0
 01346   412   NtUserBeginPaint  (0x100c6, 1243260, ...
 01347   412   NtUserMessageCall  (0x100c6, WM_NCPAINT, 0x1, 0x0, 0, 670, 0, ... ) == 0x0
 01346   412   NtUserBeginPaint  ... ) == 0x1010052
 01348   412   NtUserGetControlBrush  (0x100c6, 16842834, 309, ... ) == 0x1100056
 01349   412   NtGdiIntersectClipRect  (16842834, 0, 0, 75, 23, ... ) == 0x3
 01350   412   NtGdiIntersectClipRect  (16842834, 3, 3, 72, 20, ... ) == 0x3
 01351   412   NtUserEndPaint  (0x100c6, 1243260, ... ) == 0x1
 01352   412   NtUserBeginPaint  (0x100c8, 1243272, ...
 01353   412   NtUserMessageCall  (0x100c8, WM_NCPAINT, 0x1, 0x0, 0, 670, 0, ... ) == 0x0
 01352   412   NtUserBeginPaint  ... ) == 0x1010052
 01354   412   NtGdiIntersectClipRect  (16842834, 0, 0, 32, 32, ... ) == 0x3
 01355   412   NtUserGetControlBrush  (0x100c8, 16842834, 312, ... ) == 0x1100056
 01356   412   NtGdiGetDCDword  (16842834, 7, 1242992, ... ) == 0x1
 01357   412   NtUserDrawIconEx  (16842834, 0, 0, 65545, 32, 32, 0, 17825878, 3, 0, 1243036, ... ) == 0x1
 01358   412   NtUserEndPaint  (0x100c8, 1243272, ... ) == 0x1
 01359   412   NtUserBeginPaint  (0x100ca, 1243272, ...
 01360   412   NtUserMessageCall  (0x100ca, WM_NCPAINT, 0x1, 0x0, 0, 670, 0, ... ) == 0x0
 01359   412   NtUserBeginPaint  ... ) == 0x1010052
 01361   412   NtGdiIntersectClipRect  (16842834, 0, 0, 276, 15, ... ) == 0x3
 01362   412   NtUserGetControlBrush  (0x100ca, 16842834, 312, ... ) == 0x1100056
 01363   412   NtGdiGetTextCharsetInfo  (16842834, 0, 0, ... ) == 0x0
 01364   412   NtUserEndPaint  (0x100ca, 1243272, ... ) == 0x1
 01344   412   NtUserCallHwndLock  ... ) == 0x1
 01365   412   NtUserPeekMessage  (0, 0, 0, 1, ...
 01366   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\VMware\VMware Tools\hook.dll"}, 1241124, ... ) }, 1241124, ... ) == 0x0
 01367   412   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\Program Files\VMware\VMware Tools\hook.dll"}, 5, 96, ... 284, {status=0x0, info=1}, ) }, 5, 96, ... 284, {status=0x0, info=1}, ) == 0x0
 01368   412   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 284, ... 288, ) == 0x0
 01369   412   NtClose  (284, ... ) == 0x0
 01370   412   NtMapViewOfSection  (288, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2710000), 0x0, 45056, ) == 0x0
 01371   412   NtClose  (288, ... ) == 0x0
 01372   412   NtUnmapViewOfSection  (-1, 0x2710000, ... ) == 0x0
 01373   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\VMware\VMware Tools\hook.dll"}, 1241440, ... ) }, 1241440, ... ) == 0x0
 01374   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\VMware\VMware Tools\hook.dll"}, 1241440, ... ) }, 1241440, ... ) == 0x0
 01375   412   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\Program Files\VMware\VMware Tools\hook.dll"}, 5, 96, ... 288, {status=0x0, info=1}, ) }, 5, 96, ... 288, {status=0x0, info=1}, ) == 0x0
 01376   412   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 288, ... 284, ) == 0x0
 01377   412   NtQuerySection  (284, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01378   412   NtClose  (288, ... ) == 0x0
 01379   412   NtMapViewOfSection  (284, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x10000000), 0x0, 49152, ) == 0x0
 01380   412   NtClose  (284, ... ) == 0x0
 01381   412   NtProtectVirtualMemory  (-1, (0x10006000), 256, 4, ... (0x10006000), 4096, 2, ) == 0x0
 01382   412   NtProtectVirtualMemory  (-1, (0x10006000), 4096, 2, ... (0x10006000), 4096, 4, ) == 0x0
 01383   412   NtFlushInstructionCache  (-1, 268460032, 256, ... ) == 0x0
 01384   412   NtProtectVirtualMemory  (-1, (0x10006000), 256, 4, ... (0x10006000), 4096, 2, ) == 0x0
 01385   412   NtProtectVirtualMemory  (-1, (0x10006000), 4096, 2, ... (0x10006000), 4096, 4, ) == 0x0
 01386   412   NtFlushInstructionCache  (-1, 268460032, 256, ... ) == 0x0
 01387   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01388   412   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 40960000, 65536, ) == 0x0
 01389   412   NtAllocateVirtualMemory  (-1, 40960000, 0, 4096, 4096, 4, ... 40960000, 4096, ) == 0x0
 01390   412   NtAllocateVirtualMemory  (-1, 40964096, 0, 8192, 4096, 4, ... 40964096, 8192, ) == 0x0
 01391   412   NtQueryPerformanceCounter  (... {113929341, 0}, {3579545, 0}, ) == 0x0
 01392   412   NtUserMessageCall  (0x200b2, WM_SETCURSOR, 0x200b2, 0x2000001, 0, 670, 0, ... ) == 0x0
 01365   412   NtUserPeekMessage  ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7109, {512, 384}}, ) == 0x1
 01393   412   NtOpenProcessToken  (-1, 0x8, ... 284, ) == 0x0
 01394   412   NtQueryInformationToken  (284, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 01395   412   NtClose  (284, ... ) == 0x0
 01396   412   NtUserCallMsgFilter  (1243628, 0, ... ) == 0x0
 01397   412   NtUserPeekMessage  (0, 0, 0, 1, ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7109, {512, 384}}, ) == 0x0
 01398   412   NtUserWaitMessage  (... ) == 0x1
 01399   412   NtUserPeekMessage  (0, 0, 0, 1, ...
 01400   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x2, 0x0, 0, 670, 0, ... ) == 0x0
 01399   412   NtUserPeekMessage  ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7109, {512, 384}}, ) == 0x0
 01401   412   NtUserWaitMessage  (... ) == 0x1
 01402   412   NtUserPeekMessage  (0, 0, 0, 1, ...
 01403   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x0, 0x0, 0, 670, 0, ... ) == 0x0
 01402   412   NtUserPeekMessage  ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7109, {512, 384}}, ) == 0x0
 01404   412   NtUserWaitMessage  (... ) == 0x1
 01405   412   NtUserPeekMessage  (0, 0, 0, 1, ...
 01406   412   NtUserMessageCall  (0x200b2, WM_GETICON, 0x1, 0x0, 0, 670, 0, ... ) == 0x0
 01405   412   NtUserPeekMessage  ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7109, {512, 384}}, ) == 0x0
 01407   412   NtUserWaitMessage  (...
 00747   784   NtDelayExecution  ... ) == 0x0
 01408   784   NtDelayExecution  (0, {-20010000, -1}, ...
 00988   576   NtDelayExecution  ... ) == 0x0
 01409   576   NtDelayExecution  (0, {-20010000, -1}, ...
 00989   596   NtDelayExecution  ... ) == 0x0
 01410   596   NtDelayExecution  (0, {-20010000, -1}, ...
 00990   636   NtDelayExecution  ... ) == 0x0
 01411   636   NtDelayExecution  (0, {-20010000, -1}, ...
 00991   732   NtDelayExecution  ... ) == 0x0
 01412   732   NtDelayExecution  (0, {-20010000, -1}, ...
 00992   676   NtDelayExecution  ... ) == 0x0
 00993   788   NtDelayExecution  ... ) == 0x0
 00999   744   NtDelayExecution  ... ) == 0x0
 01413   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01414   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01415   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01407   412   NtUserWaitMessage  ... ) == 0x1
 01416   412   NtUserPeekMessage  (0, 0, 0, 1, ...
 01417   412   NtUserMessageCall  (0x200b2, WM_SETCURSOR, 0x200b2, 0x2000001, 0, 670, 0, ... ) == 0x0
 01416   412   NtUserPeekMessage  ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x78f8, {512, 384}}, ) == 0x1
 01418   412   NtUserCallMsgFilter  (1243628, 0, ... ) == 0x0
 01419   412   NtUserPeekMessage  (0, 0, 0, 1, ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x78f8, {512, 384}}, ) == 0x0
 01420   412   NtUserWaitMessage  (... ) == 0x1
 01421   412   NtUserPeekMessage  (0, 0, 0, 1, ...
 01422   412   NtUserMessageCall  (0x200b2, WM_SETCURSOR, 0x200b2, 0x2000001, 0, 670, 0, ... ) == 0x0
 01421   412   NtUserPeekMessage  ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7908, {512, 384}}, ) == 0x1
 01423   412   NtUserCallMsgFilter  (1243628, 0, ... ) == 0x0
 01424   412   NtUserPeekMessage  (0, 0, 0, 1, ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7908, {512, 384}}, ) == 0x0
 01425   412   NtUserWaitMessage  (... ) == 0x1
 01426   412   NtUserPeekMessage  (0, 0, 0, 1, ...
 01427   412   NtUserMessageCall  (0x200b2, WM_SETCURSOR, 0x200b2, 0x2000001, 0, 670, 0, ... ) == 0x0
 01426   412   NtUserPeekMessage  ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7908, {512, 384}}, ) == 0x1
 01428   412   NtUserCallMsgFilter  (1243628, 0, ... ) == 0x0
 01429   412   NtUserPeekMessage  (0, 0, 0, 1, ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7908, {512, 384}}, ) == 0x0
 01430   412   NtUserWaitMessage  (... ) == 0x1
 01431   412   NtUserPeekMessage  (0, 0, 0, 1, ...
 01432   412   NtUserMessageCall  (0x200b2, WM_SETCURSOR, 0x200b2, 0x2000001, 0, 670, 0, ... ) == 0x0
 01431   412   NtUserPeekMessage  ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7918, {512, 384}}, ) == 0x1
 01433   412   NtUserCallMsgFilter  (1243628, 0, ... ) == 0x0
 01434   412   NtUserPeekMessage  (0, 0, 0, 1, ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7918, {512, 384}}, ) == 0x0
 01435   412   NtUserWaitMessage  (... ) == 0x1
 01436   412   NtUserPeekMessage  (0, 0, 0, 1, ...
 01437   412   NtUserMessageCall  (0x200b2, WM_SETCURSOR, 0x200b2, 0x2000001, 0, 670, 0, ... ) == 0x0
 01436   412   NtUserPeekMessage  ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7927, {512, 384}}, ) == 0x1
 01438   412   NtUserCallMsgFilter  (1243628, 0, ... ) == 0x0
 01439   412   NtUserPeekMessage  (0, 0, 0, 1, ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7927, {512, 384}}, ) == 0x0
 01440   412   NtUserWaitMessage  (... ) == 0x1
 01441   412   NtUserPeekMessage  (0, 0, 0, 1, ...
 01442   412   NtUserMessageCall  (0x200b2, WM_SETCURSOR, 0x200b2, 0x2000001, 0, 670, 0, ... ) == 0x0
 01441   412   NtUserPeekMessage  ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7927, {512, 384}}, ) == 0x1
 01443   412   NtUserCallMsgFilter  (1243628, 0, ... ) == 0x0
 01444   412   NtUserPeekMessage  (0, 0, 0, 1, ... {0x200b2, WM_MOUSEFIRST, 0x0, 0x1400a8, 0x7927, {512, 384}}, ) == 0x0
 01445   412   NtUserWaitMessage  (...
 01408   784   NtDelayExecution  ... ) == 0x0
 01446   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01413   676   NtDelayExecution  ... ) == 0x0
 01447   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01409   576   NtDelayExecution  ... ) == 0x0
 01410   596   NtDelayExecution  ... ) == 0x0
 01411   636   NtDelayExecution  ... ) == 0x0
 01412   732   NtDelayExecution  ... ) == 0x0
 01414   744   NtDelayExecution  ... ) == 0x0
 01415   788   NtDelayExecution  ... ) == 0x0
 01448   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01449   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01450   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01451   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01452   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01453   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01446   784   NtDelayExecution  ... ) == 0x0
 01454   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01447   676   NtDelayExecution  ... ) == 0x0
 01455   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01448   576   NtDelayExecution  ... ) == 0x0
 01456   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01449   596   NtDelayExecution  ... ) == 0x0
 01457   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01450   636   NtDelayExecution  ... ) == 0x0
 01458   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01451   732   NtDelayExecution  ... ) == 0x0
 01459   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01452   788   NtDelayExecution  ... ) == 0x0
 01460   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01453   744   NtDelayExecution  ... ) == 0x0
 01461   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01454   784   NtDelayExecution  ... ) == 0x0
 01462   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01455   676   NtDelayExecution  ... ) == 0x0
 01463   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01456   576   NtDelayExecution  ... ) == 0x0
 01464   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01457   596   NtDelayExecution  ... ) == 0x0
 01465   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01458   636   NtDelayExecution  ... ) == 0x0
 01466   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01459   732   NtDelayExecution  ... ) == 0x0
 01467   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01460   788   NtDelayExecution  ... ) == 0x0
 01468   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01461   744   NtDelayExecution  ... ) == 0x0
 01469   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01462   784   NtDelayExecution  ... ) == 0x0
 01470   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01463   676   NtDelayExecution  ... ) == 0x0
 01471   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01464   576   NtDelayExecution  ... ) == 0x0
 01472   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01465   596   NtDelayExecution  ... ) == 0x0
 01473   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01466   636   NtDelayExecution  ... ) == 0x0
 01474   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01467   732   NtDelayExecution  ... ) == 0x0
 01475   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01468   788   NtDelayExecution  ... ) == 0x0
 01476   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01469   744   NtDelayExecution  ... ) == 0x0
 01477   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01470   784   NtDelayExecution  ... ) == 0x0
 01478   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01471   676   NtDelayExecution  ... ) == 0x0
 01479   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01472   576   NtDelayExecution  ... ) == 0x0
 01480   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01473   596   NtDelayExecution  ... ) == 0x0
 01481   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01474   636   NtDelayExecution  ... ) == 0x0
 01482   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01475   732   NtDelayExecution  ... ) == 0x0
 01483   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01476   788   NtDelayExecution  ... ) == 0x0
 01484   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01477   744   NtDelayExecution  ... ) == 0x0
 01485   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01478   784   NtDelayExecution  ... ) == 0x0
 01486   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01479   676   NtDelayExecution  ... ) == 0x0
 01480   576   NtDelayExecution  ... ) == 0x0
 01481   596   NtDelayExecution  ... ) == 0x0
 01482   636   NtDelayExecution  ... ) == 0x0
 01483   732   NtDelayExecution  ... ) == 0x0
 01484   788   NtDelayExecution  ... ) == 0x0
 01485   744   NtDelayExecution  ... ) == 0x0
 01487   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01488   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01489   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01490   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01491   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01492   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01493   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01486   784   NtDelayExecution  ... ) == 0x0
 01494   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01487   576   NtDelayExecution  ... ) == 0x0
 01488   596   NtDelayExecution  ... ) == 0x0
 01489   636   NtDelayExecution  ... ) == 0x0
 01490   732   NtDelayExecution  ... ) == 0x0
 01491   676   NtDelayExecution  ... ) == 0x0
 01492   744   NtDelayExecution  ... ) == 0x0
 01493   788   NtDelayExecution  ... ) == 0x0
 01495   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01496   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01497   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01498   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01499   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01500   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01501   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01494   784   NtDelayExecution  ... ) == 0x0
 01502   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01495   576   NtDelayExecution  ... ) == 0x0
 01503   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01496   596   NtDelayExecution  ... ) == 0x0
 01504   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01497   636   NtDelayExecution  ... ) == 0x0
 01505   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01498   676   NtDelayExecution  ... ) == 0x0
 01506   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01499   732   NtDelayExecution  ... ) == 0x0
 01507   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01500   788   NtDelayExecution  ... ) == 0x0
 01508   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01501   744   NtDelayExecution  ... ) == 0x0
 01509   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01502   784   NtDelayExecution  ... ) == 0x0
 01510   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01503   576   NtDelayExecution  ... ) == 0x0
 01511   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01504   596   NtDelayExecution  ... ) == 0x0
 01512   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01505   636   NtDelayExecution  ... ) == 0x0
 01513   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01506   676   NtDelayExecution  ... ) == 0x0
 01514   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01507   732   NtDelayExecution  ... ) == 0x0
 01515   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01508   788   NtDelayExecution  ... ) == 0x0
 01516   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01509   744   NtDelayExecution  ... ) == 0x0
 01517   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01510   784   NtDelayExecution  ... ) == 0x0
 01518   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01511   576   NtDelayExecution  ... ) == 0x0
 01519   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01512   596   NtDelayExecution  ... ) == 0x0
 01520   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01513   636   NtDelayExecution  ... ) == 0x0
 01521   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01514   676   NtDelayExecution  ... ) == 0x0
 01522   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01515   732   NtDelayExecution  ... ) == 0x0
 01523   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01516   788   NtDelayExecution  ... ) == 0x0
 01524   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01517   744   NtDelayExecution  ... ) == 0x0
 01525   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01518   784   NtDelayExecution  ... ) == 0x0
 01526   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01519   576   NtDelayExecution  ... ) == 0x0
 01527   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01520   596   NtDelayExecution  ... ) == 0x0
 01528   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01521   636   NtDelayExecution  ... ) == 0x0
 01529   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01522   676   NtDelayExecution  ... ) == 0x0
 01530   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01523   732   NtDelayExecution  ... ) == 0x0
 01531   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01524   788   NtDelayExecution  ... ) == 0x0
 01532   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01525   744   NtDelayExecution  ... ) == 0x0
 01533   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01526   784   NtDelayExecution  ... ) == 0x0
 01534   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01527   576   NtDelayExecution  ... ) == 0x0
 01535   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01528   596   NtDelayExecution  ... ) == 0x0
 01536   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01529   636   NtDelayExecution  ... ) == 0x0
 01537   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01530   676   NtDelayExecution  ... ) == 0x0
 01531   732   NtDelayExecution  ... ) == 0x0
 01532   788   NtDelayExecution  ... ) == 0x0
 01533   744   NtDelayExecution  ... ) == 0x0
 01538   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01539   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01540   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01541   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01534   784   NtDelayExecution  ... ) == 0x0
 01542   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01535   576   NtDelayExecution  ... ) == 0x0
 01536   596   NtDelayExecution  ... ) == 0x0
 01537   636   NtDelayExecution  ... ) == 0x0
 01538   732   NtDelayExecution  ... ) == 0x0
 01539   676   NtDelayExecution  ... ) == 0x0
 01540   744   NtDelayExecution  ... ) == 0x0
 01541   788   NtDelayExecution  ... ) == 0x0
 01543   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01544   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01545   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01546   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01547   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01548   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01549   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01542   784   NtDelayExecution  ... ) == 0x0
 01550   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01543   576   NtDelayExecution  ... ) == 0x0
 01551   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01544   596   NtDelayExecution  ... ) == 0x0
 01552   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01545   636   NtDelayExecution  ... ) == 0x0
 01553   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01546   676   NtDelayExecution  ... ) == 0x0
 01554   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01547   732   NtDelayExecution  ... ) == 0x0
 01555   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01548   788   NtDelayExecution  ... ) == 0x0
 01556   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01549   744   NtDelayExecution  ... ) == 0x0
 01557   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01550   784   NtDelayExecution  ... ) == 0x0
 01558   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01551   576   NtDelayExecution  ... ) == 0x0
 01559   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01552   596   NtDelayExecution  ... ) == 0x0
 01560   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01553   636   NtDelayExecution  ... ) == 0x0
 01561   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01554   676   NtDelayExecution  ... ) == 0x0
 01562   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01555   732   NtDelayExecution  ... ) == 0x0
 01563   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01556   788   NtDelayExecution  ... ) == 0x0
 01564   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01557   744   NtDelayExecution  ... ) == 0x0
 01565   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01558   784   NtDelayExecution  ... ) == 0x0
 01566   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01559   576   NtDelayExecution  ... ) == 0x0
 01567   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01560   596   NtDelayExecution  ... ) == 0x0
 01568   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01561   636   NtDelayExecution  ... ) == 0x0
 01569   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01562   676   NtDelayExecution  ... ) == 0x0
 01570   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01563   732   NtDelayExecution  ... ) == 0x0
 01571   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01564   788   NtDelayExecution  ... ) == 0x0
 01572   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01565   744   NtDelayExecution  ... ) == 0x0
 01573   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01566   784   NtDelayExecution  ... ) == 0x0
 01574   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01567   576   NtDelayExecution  ... ) == 0x0
 01575   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01568   596   NtDelayExecution  ... ) == 0x0
 01576   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01569   636   NtDelayExecution  ... ) == 0x0
 01577   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01570   676   NtDelayExecution  ... ) == 0x0
 01578   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01571   732   NtDelayExecution  ... ) == 0x0
 01579   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01572   788   NtDelayExecution  ... ) == 0x0
 01580   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01573   744   NtDelayExecution  ... ) == 0x0
 01581   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01574   784   NtDelayExecution  ... ) == 0x0
 01582   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01575   576   NtDelayExecution  ... ) == 0x0
 01583   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01576   596   NtDelayExecution  ... ) == 0x0
 01584   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01577   636   NtDelayExecution  ... ) == 0x0
 01585   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01578   676   NtDelayExecution  ... ) == 0x0
 01579   732   NtDelayExecution  ... ) == 0x0
 01580   788   NtDelayExecution  ... ) == 0x0
 01581   744   NtDelayExecution  ... ) == 0x0
 01586   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01587   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01588   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01589   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01582   784   NtDelayExecution  ... ) == 0x0
 01590   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01583   576   NtDelayExecution  ... ) == 0x0
 01584   596   NtDelayExecution  ... ) == 0x0
 01585   636   NtDelayExecution  ... ) == 0x0
 01586   732   NtDelayExecution  ... ) == 0x0
 01587   676   NtDelayExecution  ... ) == 0x0
 01588   744   NtDelayExecution  ... ) == 0x0
 01589   788   NtDelayExecution  ... ) == 0x0
 01591   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01592   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01593   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01594   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01595   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01596   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01597   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01590   784   NtDelayExecution  ... ) == 0x0
 01598   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01591   576   NtDelayExecution  ... ) == 0x0
 01599   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01592   596   NtDelayExecution  ... ) == 0x0
 01600   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01593   636   NtDelayExecution  ... ) == 0x0
 01601   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01594   676   NtDelayExecution  ... ) == 0x0
 01602   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01595   732   NtDelayExecution  ... ) == 0x0
 01603   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01596   788   NtDelayExecution  ... ) == 0x0
 01604   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01597   744   NtDelayExecution  ... ) == 0x0
 01605   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01598   784   NtDelayExecution  ... ) == 0x0
 01606   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01599   576   NtDelayExecution  ... ) == 0x0
 01607   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01600   596   NtDelayExecution  ... ) == 0x0
 01608   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01601   636   NtDelayExecution  ... ) == 0x0
 01609   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01602   676   NtDelayExecution  ... ) == 0x0
 01610   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01603   732   NtDelayExecution  ... ) == 0x0
 01611   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01604   788   NtDelayExecution  ... ) == 0x0
 01612   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01605   744   NtDelayExecution  ... ) == 0x0
 01613   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01606   784   NtDelayExecution  ... ) == 0x0
 01614   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01607   576   NtDelayExecution  ... ) == 0x0
 01615   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01608   596   NtDelayExecution  ... ) == 0x0
 01616   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01609   636   NtDelayExecution  ... ) == 0x0
 01617   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01610   676   NtDelayExecution  ... ) == 0x0
 01618   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01611   732   NtDelayExecution  ... ) == 0x0
 01619   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01612   788   NtDelayExecution  ... ) == 0x0
 01620   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01613   744   NtDelayExecution  ... ) == 0x0
 01621   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01614   784   NtDelayExecution  ... ) == 0x0
 01622   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01615   576   NtDelayExecution  ... ) == 0x0
 01623   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01616   596   NtDelayExecution  ... ) == 0x0
 01624   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01617   636   NtDelayExecution  ... ) == 0x0
 01625   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01618   676   NtDelayExecution  ... ) == 0x0
 01626   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01619   732   NtDelayExecution  ... ) == 0x0
 01627   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01620   788   NtDelayExecution  ... ) == 0x0
 01628   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01621   744   NtDelayExecution  ... ) == 0x0
 01629   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01622   784   NtDelayExecution  ... ) == 0x0
 01630   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01623   576   NtDelayExecution  ... ) == 0x0
 01631   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01624   596   NtDelayExecution  ... ) == 0x0
 01632   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01625   636   NtDelayExecution  ... ) == 0x0
 01633   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01626   676   NtDelayExecution  ... ) == 0x0
 01627   732   NtDelayExecution  ... ) == 0x0
 01628   788   NtDelayExecution  ... ) == 0x0
 01629   744   NtDelayExecution  ... ) == 0x0
 01634   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01635   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01636   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01637   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01630   784   NtDelayExecution  ... ) == 0x0
 01638   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01631   576   NtDelayExecution  ... ) == 0x0
 01632   596   NtDelayExecution  ... ) == 0x0
 01633   636   NtDelayExecution  ... ) == 0x0
 01634   732   NtDelayExecution  ... ) == 0x0
 01635   676   NtDelayExecution  ... ) == 0x0
 01636   744   NtDelayExecution  ... ) == 0x0
 01637   788   NtDelayExecution  ... ) == 0x0
 01639   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01640   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01641   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01642   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01643   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01644   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01645   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01638   784   NtDelayExecution  ... ) == 0x0
 01646   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01639   576   NtDelayExecution  ... ) == 0x0
 01647   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01640   596   NtDelayExecution  ... ) == 0x0
 01648   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01641   636   NtDelayExecution  ... ) == 0x0
 01649   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01642   676   NtDelayExecution  ... ) == 0x0
 01650   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01643   732   NtDelayExecution  ... ) == 0x0
 01651   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01644   788   NtDelayExecution  ... ) == 0x0
 01652   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01645   744   NtDelayExecution  ... ) == 0x0
 01653   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01646   784   NtDelayExecution  ... ) == 0x0
 01654   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01647   576   NtDelayExecution  ... ) == 0x0
 01655   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01648   596   NtDelayExecution  ... ) == 0x0
 01656   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01649   636   NtDelayExecution  ... ) == 0x0
 01657   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01650   676   NtDelayExecution  ... ) == 0x0
 01658   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01651   732   NtDelayExecution  ... ) == 0x0
 01659   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01652   788   NtDelayExecution  ... ) == 0x0
 01660   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01653   744   NtDelayExecution  ... ) == 0x0
 01661   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01654   784   NtDelayExecution  ... ) == 0x0
 01662   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01655   576   NtDelayExecution  ... ) == 0x0
 01663   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01656   596   NtDelayExecution  ... ) == 0x0
 01664   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01657   636   NtDelayExecution  ... ) == 0x0
 01665   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01658   676   NtDelayExecution  ... ) == 0x0
 01666   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01659   732   NtDelayExecution  ... ) == 0x0
 01667   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01660   788   NtDelayExecution  ... ) == 0x0
 01668   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01661   744   NtDelayExecution  ... ) == 0x0
 01669   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01662   784   NtDelayExecution  ... ) == 0x0
 01670   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01663   576   NtDelayExecution  ... ) == 0x0
 01671   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01664   596   NtDelayExecution  ... ) == 0x0
 01672   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01665   636   NtDelayExecution  ... ) == 0x0
 01673   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01666   676   NtDelayExecution  ... ) == 0x0
 01674   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01667   732   NtDelayExecution  ... ) == 0x0
 01675   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01668   788   NtDelayExecution  ... ) == 0x0
 01676   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01669   744   NtDelayExecution  ... ) == 0x0
 01677   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01670   784   NtDelayExecution  ... ) == 0x0
 01678   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01671   576   NtDelayExecution  ... ) == 0x0
 01679   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01672   596   NtDelayExecution  ... ) == 0x0
 01680   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01673   636   NtDelayExecution  ... ) == 0x0
 01681   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01674   676   NtDelayExecution  ... ) == 0x0
 01675   732   NtDelayExecution  ... ) == 0x0
 01676   788   NtDelayExecution  ... ) == 0x0
 01677   744   NtDelayExecution  ... ) == 0x0
 01682   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01683   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01684   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01685   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01678   784   NtDelayExecution  ... ) == 0x0
 01686   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01679   576   NtDelayExecution  ... ) == 0x0
 01680   596   NtDelayExecution  ... ) == 0x0
 01681   636   NtDelayExecution  ... ) == 0x0
 01682   732   NtDelayExecution  ... ) == 0x0
 01683   676   NtDelayExecution  ... ) == 0x0
 01684   744   NtDelayExecution  ... ) == 0x0
 01685   788   NtDelayExecution  ... ) == 0x0
 01687   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01688   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01689   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01690   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01691   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01692   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01693   744   NtDelayExecution  (0, {-20010000, -1}, ...
 01686   784   NtDelayExecution  ... ) == 0x0
 01694   784   NtDelayExecution  (0, {-20010000, -1}, ...
 01687   576   NtDelayExecution  ... ) == 0x0
 01695   576   NtDelayExecution  (0, {-20010000, -1}, ...
 01688   596   NtDelayExecution  ... ) == 0x0
 01696   596   NtDelayExecution  (0, {-20010000, -1}, ...
 01689   636   NtDelayExecution  ... ) == 0x0
 01697   636   NtDelayExecution  (0, {-20010000, -1}, ...
 01690   676   NtDelayExecution  ... ) == 0x0
 01698   676   NtDelayExecution  (0, {-20010000, -1}, ...
 01691   732   NtDelayExecution  ... ) == 0x0
 01699   732   NtDelayExecution  (0, {-20010000, -1}, ...
 01692   788   NtDelayExecution  ... ) == 0x0
 01700   788   NtDelayExecution  (0, {-20010000, -1}, ...
 01693   744   NtDelayExecution  ... ) == 0x0
 01701   744   NtDelayExecution  (0, {-20010000, -1}, ...