trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98" trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;user32;gdi32;advapi32;kernel32" 0009:Call KERNEL32.__wine_kernel_init() ret=7bc48e48 Warning: could not find DOS drive for current working directory '/home/cubranic/Documents/Job apps/Triumf - Sys admin 2009', starting in the Windows directory. trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98" trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;user32;gdi32;advapi32;kernel32" 000b:Call KERNEL32.__wine_kernel_init() ret=7bc48e48 000b:Call PE DLL (proc=0x7bc77ca0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) 000b:Ret PE DLL (proc=0x7bc77ca0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 000b:Call PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) 000b:Ret PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 000b:Call PE DLL (proc=0x7ee47b00,module=0x7ee10000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) 000b:Ret PE DLL (proc=0x7ee47b00,module=0x7ee10000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 000b:Starting process L"c:\\windows\\system32\\wineboot.exe" (entryproc=0x7ee6b630) 000b:Call KERNEL32.GetWindowsDirectoryW(7ee718c0,00000104) ret=7ee69bab 000b:Ret KERNEL32.GetWindowsDirectoryW() retval=0000000a ret=7ee69bab 000b:Call KERNEL32.SetCurrentDirectoryW(7ee718c0 L"c:\\windows") ret=7ee69bbc 000b:Ret KERNEL32.SetCurrentDirectoryW() retval=00000001 ret=7ee69bbc 000b:Call KERNEL32.CreateEventW(0033fd94,00000001,00000000,7ee6c2c0 L"__wineboot_event") ret=7ee69eb3 000b:Ret KERNEL32.CreateEventW() retval=00000014 ret=7ee69eb3 000b:Call KERNEL32.ResetEvent(00000014) ret=7ee69ec4 000b:Ret KERNEL32.ResetEvent() retval=00000001 ret=7ee69ec4 000b:Call KERNEL32.GetPrivateProfileSectionW(7ee6c31a L"rename",0033ef7c,00000400,7ee6c302 L"wininit.ini") ret=7ee69f11 000b:Ret KERNEL32.GetPrivateProfileSectionW() retval=00000000 ret=7ee69f11 000b:Call advapi32.RegOpenKeyExW(80000002,7ee6c340 L"System\\CurrentControlSet\\Control\\Session Manager",00000000,000f003f,0033fdb0) ret=7ee69fc5 000b:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ee69fc5 000b:Call advapi32.RegQueryValueExW(0000001c,7ee6c3c0 L"PendingFileRenameOperations",00000000,00000000,00000000,0033fdb4) ret=7ee6a481 000b:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6a481 000b:Call KERNEL32.GetProcessHeap() ret=7ee6a4b1 000b:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee6a4b1 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ee6a4cb 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee6a4cb 000b:Call advapi32.RegCloseKey(0000001c) ret=7ee6a4e4 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ee6a4e4 000b:Call advapi32.RegOpenKeyW(80000002,7ee6c460 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",0033fdb0) ret=7ee69ffd 000b:Ret advapi32.RegOpenKeyW() retval=00000002 ret=7ee69ffd 000b:Call advapi32.RegCloseKey(00000000) ret=7ee6a067 000b:Ret advapi32.RegCloseKey() retval=00000006 ret=7ee6a067 000b:Call KERNEL32.GetSystemDirectoryW(00000000,00000000) ret=7ee6a07e 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000014 ret=7ee6a07e 000b:Call KERNEL32.GetProcessHeap() ret=7ee6a088 000b:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee6a088 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7ee6a0a0 000b:Ret ntdll.RtlAllocateHeap() retval=00115e88 ret=7ee6a0a0 000b:Call KERNEL32.GetSystemDirectoryW(00115e88,00000014) ret=7ee6a0b5 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7ee6a0b5 000b:Call KERNEL32.FindFirstFileW(00115e88 L"c:\\windows\\system32\\dllcache\\*",0033ef7c) ret=7ee6a10f 000b:Ret KERNEL32.FindFirstFileW() retval=ffffffff ret=7ee6a10f 000b:Call KERNEL32.FindClose(ffffffff) ret=7ee6a224 000b:Ret KERNEL32.FindClose() retval=00000000 ret=7ee6a224 000b:Call KERNEL32.GetProcessHeap() ret=7ee6a22c 000b:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee6a22c 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00115e88) ret=7ee6a246 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee6a246 000b:Call advapi32.RegOpenKeyExW(80000002,7ee6c5a0 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00020019,0033eeb8) ret=7ee69455 000b:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ee69455 000b:Call advapi32.RegOpenKeyExW(0000001c,7ee6c274 L"RunServicesOnce",00000000,000f003f,0033eeb4) ret=7ee69491 000b:Ret advapi32.RegOpenKeyExW() retval=00000002 ret=7ee69491 000b:Call advapi32.RegCloseKey(0000001c) ret=7ee694a3 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ee694a3 000b:Call advapi32.RegOpenKeyExW(80000002,7ee6c5a0 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00020019,0033eeb8) ret=7ee69455 000b:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ee69455 000b:Call advapi32.RegOpenKeyExW(0000001c,7ee6c238 L"RunServices",00000000,00020019,0033eeb4) ret=7ee69491 000b:Ret advapi32.RegOpenKeyExW() retval=00000002 ret=7ee69491 000b:Call advapi32.RegCloseKey(0000001c) ret=7ee694a3 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ee694a3 000b:Call KERNEL32.GetSystemDirectoryW(0033ef7c,000000f7) ret=7ee6a2d5 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7ee6a2d5 000b:Call KERNEL32.CreateProcessW(0033ef7c L"c:\\windows\\system32\\services.exe",0033ef7c L"c:\\windows\\system32\\services.exe",00000000,00000000,00000001,00000000,00000000,00000000,0033fb8c,0033f984) ret=7ee6a398 trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98" trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;user32;gdi32;advapi32;kernel32" 000d:Call KERNEL32.__wine_kernel_init() ret=7bc48e48 000b:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7ee6a398 000b:Call KERNEL32.CloseHandle(00000024) ret=7ee6aeaa 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee6aeaa 000b:Call KERNEL32.CreateEventW(00000000,00000001,00000000,7ee6c500 L"__wine_SvcctlStarted") ret=7ee6aed3 000b:Ret KERNEL32.CreateEventW() retval=0000001c ret=7ee6aed3 000b:Call KERNEL32.WaitForMultipleObjects(00000002,0033f77c,00000000,ffffffff) ret=7ee6af0e 000d:Call PE DLL (proc=0x7bc77ca0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) 000d:Ret PE DLL (proc=0x7bc77ca0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 000d:Call PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) 000d:Ret PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 000d:Call PE DLL (proc=0x7edb3b00,module=0x7ed80000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) 000d:Ret PE DLL (proc=0x7edb3b00,module=0x7ed80000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 000d:Call PE DLL (proc=0x7edef300,module=0x7ede0000 L"iphlpapi.dll",reason=PROCESS_ATTACH,res=0x1) 000d:Call KERNEL32.DisableThreadLibraryCalls(7ede0000) ret=7edeb697 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7edeb697 000d:Ret PE DLL (proc=0x7edef300,module=0x7ede0000 L"iphlpapi.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 000d:Call PE DLL (proc=0x7ee41470,module=0x7ee00000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) 000d:Call KERNEL32.CreateMutexA(00000000,00000000,7ee49ba4 "RPCSSMasterMutex0x0000") ret=7ee3fe2f 000d:Ret KERNEL32.CreateMutexA() retval=00000018 ret=7ee3fe2f 000d:Ret PE DLL (proc=0x7ee41470,module=0x7ee00000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 000d:Starting process L"c:\\windows\\system32\\services.exe" (entryproc=0x7ee6fa40) 000d:Call KERNEL32.CreateEventW(00000000,00000001,00000000,7ee706e0 L"__wine_SvcctlStarted") ret=7ee6aea8 000d:Ret KERNEL32.CreateEventW() retval=0000001c ret=7ee6aea8 000d:Call KERNEL32.GetProcessHeap() ret=7ee6aeb8 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee6aeb8 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ee6aed0 000d:Ret ntdll.RtlAllocateHeap() retval=00117358 ret=7ee6aed0 000d:Call KERNEL32.InitializeCriticalSection(00117368) ret=7ee6af0d 000d:Ret KERNEL32.InitializeCriticalSection() retval=00000000 ret=7ee6af0d 000d:Call advapi32.RegCreateKeyExW(80000002,7ee70720 L"System\\CurrentControlSet\\Services",00000000,00000000,00000000,000f003f,00000000,00117358,00000000) ret=7ee6af62 000d:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ee6af62 000d:Call advapi32.RegEnumKeyW(00000024,00000000,0033fcb8,00000104) ret=7ee6afda 000d:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ee6afda 000d:Call KERNEL32.GetProcessHeap() ret=7ee69d72 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee69d72 000d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000074) ret=7ee69d8a 000d:Ret ntdll.RtlAllocateHeap() retval=00117388 ret=7ee69d8a 000d:Call KERNEL32.GetProcessHeap() ret=7ee6ba7d 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee6ba7d 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ee6ba91 000d:Ret ntdll.RtlAllocateHeap() retval=00114f90 ret=7ee6ba91 000d:Call advapi32.RegOpenKeyExW(00000024,0033fcb8 L"VxD",00000000,0002001f,0033fec0) ret=7ee6b039 000d:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ee6b039 000d:Call advapi32.RegQueryValueExW(00000028,7ee7077e L"ImagePath",00000000,0033fc34,00000000,0033fc38) ret=7ee6bcd3 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6bcd3 000d:Call advapi32.RegQueryValueExW(00000028,7ee70792 L"Group",00000000,0033fc34,00000000,0033fc38) ret=7ee6bcd3 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6bcd3 000d:Call advapi32.RegQueryValueExW(00000028,7ee7079e L"ObjectName",00000000,0033fc34,00000000,0033fc38) ret=7ee6bcd3 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6bcd3 000d:Call advapi32.RegQueryValueExW(00000028,7ee707b4 L"DisplayName",00000000,0033fc34,00000000,0033fc38) ret=7ee6bcd3 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6bcd3 000d:Call advapi32.RegQueryValueExW(00000028,7ee707cc L"Description",00000000,0033fc34,00000000,0033fc38) ret=7ee6bcd3 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6bcd3 000d:Call advapi32.RegQueryValueExW(00000028,7ee70800 L"DependOnService",00000000,0033fc34,00000000,0033fc38) ret=7ee6bb19 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6bb19 000d:Call KERNEL32.GetProcessHeap() ret=7ee6bc50 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee6bc50 000d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ee6bc6b 000d:Ret ntdll.RtlAllocateHeap() retval=00117408 ret=7ee6bc6b 000d:Call advapi32.RegQueryValueExW(00000028,7ee70820 L"DependOnGroup",00000000,0033fc34,00000000,0033fc38) ret=7ee6bb19 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6bb19 000d:Call KERNEL32.GetProcessHeap() ret=7ee6bc50 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee6bc50 000d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ee6bc6b 000d:Ret ntdll.RtlAllocateHeap() retval=00117420 ret=7ee6bc6b 000d:Call advapi32.RegQueryValueExW(00000028,7ee7083c L"Type",00000000,0033fc34,001173c0,0033fc38) ret=7ee6bf06 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6bf06 000d:Call advapi32.RegQueryValueExW(00000028,7ee70846 L"Start",00000000,0033fc34,001173c4,0033fc38) ret=7ee6bf06 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6bf06 000d:Call advapi32.RegQueryValueExW(00000028,7ee70852 L"ErrorControl",00000000,0033fc34,001173c8,0033fc38) ret=7ee6bf06 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6bf06 000d:Call advapi32.RegQueryValueExW(00000028,7ee7086c L"Tag",00000000,0033fc34,001173d4,0033fc38) ret=7ee6bf06 000d:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ee6bf06 000d:Call advapi32.RegCloseKey(00000028) ret=7ee6b72b 000d:Ret advapi32.RegCloseKey() retval=00000000 ret=7ee6b72b 000d:Call KERNEL32.GetProcessHeap() ret=7ee699a3 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee699a3 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00114f90) ret=7ee699b7 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee699b7 000d:Call KERNEL32.GetProcessHeap() ret=7ee699c2 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee699c2 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ee699d6 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee699d6 000d:Call KERNEL32.GetProcessHeap() ret=7ee699e1 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee699e1 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ee699f5 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee699f5 000d:Call KERNEL32.GetProcessHeap() ret=7ee69a00 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee69a00 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ee69a14 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee69a14 000d:Call KERNEL32.GetProcessHeap() ret=7ee69a1f 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee69a1f 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ee69a33 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee69a33 000d:Call KERNEL32.GetProcessHeap() ret=7ee69a3e 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee69a3e 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ee69a52 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee69a52 000d:Call KERNEL32.GetProcessHeap() ret=7ee69a5d 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee69a5d 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ee69a71 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee69a71 000d:Call KERNEL32.GetProcessHeap() ret=7ee69a7c 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee69a7c 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00117408) ret=7ee69a90 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee69a90 000d:Call KERNEL32.GetProcessHeap() ret=7ee69a9b 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee69a9b 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00117420) ret=7ee69aaf 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee69aaf 000d:Call KERNEL32.CloseHandle(00000000) ret=7ee69abd 000d:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ee69abd 000d:Call KERNEL32.CloseHandle(ffffffff) ret=7ee69acb 000d:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ee69acb 000d:Call KERNEL32.CloseHandle(00000000) ret=7ee69ad9 000d:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ee69ad9 000d:Call KERNEL32.GetProcessHeap() ret=7ee69ae1 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee69ae1 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00117388) ret=7ee69af5 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee69af5 000d:Call advapi32.RegEnumKeyW(00000024,00000001,0033fcb8,00000104) ret=7ee6afda 000d:Ret advapi32.RegEnumKeyW() retval=00000103 ret=7ee6afda 000d:Call rpcrt4.RpcServerUseProtseqEpW(0033fc2e L"ncacn_np",00000000,0033fc14 L"\\pipe\\svcctl",00000000) ret=7ee67f29 000d:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fc2e L"ncacn_np",ffffffff,00000000,00000000,00000000,00000000) ret=7ee2fad8 000d:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7ee2fad8 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ee2fafa 000d:Ret ntdll.RtlAllocateHeap() retval=00114f90 ret=7ee2fafa 000d:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fc2e L"ncacn_np",ffffffff,00114f90,00000009,00000000,00000000) ret=7ee2fb3a 000d:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7ee2fb3a 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7ee3d6d8 000d:Ret ntdll.RtlAllocateHeap() retval=00117388 ret=7ee3d6d8 000d:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ee3d705 000d:Ret KERNEL32.CreateEventW() retval=00000028 ret=7ee3d705 000d:Call KERNEL32.InitializeCriticalSection(001173a0) ret=7ee3825d 000d:Ret KERNEL32.InitializeCriticalSection() retval=00000000 ret=7ee3825d 000d:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fc14 L"\\pipe\\svcctl",ffffffff,00000000,00000000,00000000,00000000) ret=7ee2fad8 000d:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7ee2fad8 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ee2fafa 000d:Ret ntdll.RtlAllocateHeap() retval=001173f8 ret=7ee2fafa 000d:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fc14 L"\\pipe\\svcctl",ffffffff,001173f8,0000000d,00000000,00000000) ret=7ee2fb3a 000d:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7ee2fb3a 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000088) ret=7ee3d667 000d:Ret ntdll.RtlAllocateHeap() retval=00117410 ret=7ee3d667 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ee2f92b 000d:Ret ntdll.RtlAllocateHeap() retval=001174a0 ret=7ee2f92b 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ee400e7 000d:Ret ntdll.RtlAllocateHeap() retval=001174b8 ret=7ee400e7 000d:Call KERNEL32.CreateNamedPipeA(001174b8 "\\\\.\\pipe\\svcctl",00000003,00000006,000000ff,000016d0,000016d0,00001388,00000000) ret=7ee3c367 000d:Ret KERNEL32.CreateNamedPipeA() retval=0000002c ret=7ee3c367 000d:Call KERNEL32.CreateEventW(00000000,00000001,00000000,00000000) ret=7ee3c463 000d:Ret KERNEL32.CreateEventW() retval=00000030 ret=7ee3c463 000d:Call ntdll.RtlFreeHeap(00110000,00000000,001174b8) ret=7ee40116 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee40116 000d:Call ntdll.RtlFreeHeap(00110000,00000000,001173f8) ret=7ee2fc26 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee2fc26 000d:Ret rpcrt4.RpcServerUseProtseqEpW() retval=00000000 ret=7ee67f29 000d:Call rpcrt4.RpcServerRegisterIf(7ee71080,00000000,00000000) ret=7ee67fa0 000d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000038) ret=7ee3972f 000d:Ret ntdll.RtlAllocateHeap() retval=001174b8 ret=7ee3972f 000d:Ret rpcrt4.RpcServerRegisterIf() retval=00000000 ret=7ee67fa0 000d:Call rpcrt4.RpcServerListen(00000001,000004d2,00000001) ret=7ee67fdc 000d:Call KERNEL32.CreateMutexW(00000000,00000000,00000000) ret=7ee37d47 000d:Ret KERNEL32.CreateMutexW() retval=00000034 ret=7ee37d47 000d:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ee37d76 000d:Ret KERNEL32.CreateEventW() retval=00000038 ret=7ee37d76 000d:Call KERNEL32.CreateThread(00000000,00000000,7ee37fe0,00117388,00000000,00000000) ret=7ee37cf2 000e:Call PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=THREAD_ATTACH,res=(nil)) 000e:Ret PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 000e:Call PE DLL (proc=0x7ee41470,module=0x7ee00000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) 000e:Ret PE DLL (proc=0x7ee41470,module=0x7ee00000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 000e:Starting thread proc 0x7ee37fe0 (arg=0x117388) 000e:Call KERNEL32.ConnectNamedPipe(0000002c,00117480) ret=7ee3d7d5 000e:Ret KERNEL32.ConnectNamedPipe() retval=00000000 ret=7ee3d7d5 000e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ee3d8fb 000e:Ret ntdll.RtlAllocateHeap() retval=001173f8 ret=7ee3d8fb 000e:Call KERNEL32.WaitForMultipleObjectsEx(00000002,001173f8,00000000,ffffffff,00000001) ret=7ee3d4f6 000d:Ret KERNEL32.CreateThread() retval=0000003c ret=7ee37cf2 000d:Call KERNEL32.CloseHandle(0000003c) ret=7ee37d0b 000d:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee37d0b 000d:Call KERNEL32.WaitForSingleObject(00000034,ffffffff) ret=7ee37acc 000d:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7ee37acc 000d:Call KERNEL32.SetEvent(00000028) ret=7ee3d634 000e:Ret KERNEL32.WaitForMultipleObjectsEx() retval=00000000 ret=7ee3d4f6 000e:Call ntdll.RtlReAllocateHeap(00110000,00000000,001173f8,00000008) ret=7ee3d847 000e:Ret ntdll.RtlReAllocateHeap() retval=001173f8 ret=7ee3d847 000e:Call KERNEL32.SetEvent(00000038) ret=7ee38070 000e:Ret KERNEL32.SetEvent() retval=00000001 ret=7ee38070 000e:Call KERNEL32.WaitForMultipleObjectsEx(00000002,001173f8,00000000,ffffffff,00000001) ret=7ee3d4f6 000d:Ret KERNEL32.SetEvent() retval=00000001 ret=7ee3d634 000d:Call KERNEL32.WaitForSingleObject(00000038,ffffffff) ret=7ee37aea 000d:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7ee37aea 000d:Call KERNEL32.ReleaseMutex(00000034) ret=7ee37af8 000d:Ret KERNEL32.ReleaseMutex() retval=00000001 ret=7ee37af8 000d:Ret rpcrt4.RpcServerListen() retval=00000000 ret=7ee67fdc 000d:Call KERNEL32.GetProcessHeap() ret=7ee6b4d7 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee6b4d7 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7ee6b4ef 000d:Ret ntdll.RtlAllocateHeap() retval=00117678 ret=7ee6b4ef 000d:Call KERNEL32.GetProcessHeap() ret=7ee6b60c 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee6b60c 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00117678) ret=7ee6b626 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee6b626 000d:Call ntdll.__wine_make_process_system() ret=7ee67d69 000d:Ret ntdll.__wine_make_process_system() retval=0000003c ret=7ee67d69 000d:Call KERNEL32.SetEvent(0000001c) ret=7ee67d7b 000b:Ret KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7ee6af0e 000b:Call KERNEL32.CloseHandle(00000020) ret=7ee6af28 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee6af28 000b:Call KERNEL32.CloseHandle(0000001c) ret=7ee6af39 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee6af39 000b:Call KERNEL32.GetProcessHeap() ret=7ee68dc2 000b:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee68dc2 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000029) ret=7ee68dd6 000b:Ret ntdll.RtlAllocateHeap() retval=00115e88 ret=7ee68dd6 000b:Call KERNEL32.GetProcessHeap() ret=7ee68e65 000b:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee68e65 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000027) ret=7ee68e79 000b:Ret ntdll.RtlAllocateHeap() retval=00115ec0 ret=7ee68e79 000d:Ret KERNEL32.SetEvent() retval=00000001 ret=7ee67d7b 000d:Call KERNEL32.WaitForSingleObjectEx(0000003c,ffffffff,00000001) ret=7ee67db2 000b:Call KERNEL32.GetProcessHeap() ret=7ee68f5d 000b:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee68f5d 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00115ec0) ret=7ee68f77 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee68f77 000b:Call KERNEL32.GetProcessHeap() ret=7ee68f85 000b:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee68f85 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00115e88) ret=7ee68f9f 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee68f9f 000b:Call advapi32.RegOpenKeyExW(80000002,7ee6c5a0 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00020019,0033eeb8) ret=7ee69455 000b:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ee69455 000b:Call advapi32.RegOpenKeyExW(0000001c,7ee6c1fc L"RunOnce",00000000,000f003f,0033eeb4) ret=7ee69491 000b:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ee69491 000b:Call advapi32.RegCloseKey(0000001c) ret=7ee694bb 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ee694bb 000b:Call advapi32.RegQueryInfoKeyW(00000020,00000000,00000000,00000000,00000000,00000000,00000000,0033eeb0,0033eea8,0033eeac,00000000,00000000) ret=7ee6951e 000b:Ret advapi32.RegQueryInfoKeyW() retval=00000000 ret=7ee6951e 000b:Call KERNEL32.GetProcessHeap() ret=7ee6955f 000b:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee6955f 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ee69579 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee69579 000b:Call KERNEL32.GetProcessHeap() ret=7ee69581 000b:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee69581 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ee6959b 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee6959b 000b:Call advapi32.RegCloseKey(00000020) ret=7ee695ad 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ee695ad 000b:Call KERNEL32.SetEvent(00000014) ret=7ee6a408 000b:Ret KERNEL32.SetEvent() retval=00000001 ret=7ee6a408 000b:Call KERNEL32.ExitProcess(00000000) ret=7ee6b69a 000b:Call PE DLL (proc=0x7ee47b00,module=0x7ee10000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) 000b:Ret PE DLL (proc=0x7ee47b00,module=0x7ee10000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 000b:Call PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1) 000b:Ret PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 000b:Call PE DLL (proc=0x7bc77ca0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1) 000b:Ret PE DLL (proc=0x7bc77ca0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0009:Call PE DLL (proc=0x7bc77ca0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) 0009:Ret PE DLL (proc=0x7bc77ca0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 0009:Call PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) 0009:Ret PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 0009:Call PE DLL (proc=0x7ea02b00,module=0x7e9d0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) 0009:Ret PE DLL (proc=0x7ea02b00,module=0x7e9d0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 0009:Call PE DLL (proc=0x7ea86710,module=0x7ea20000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) 0009:Ret PE DLL (proc=0x7ea86710,module=0x7ea20000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 0009:Call PE DLL (proc=0x7eb80950,module=0x7ead0000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) 0009:Call PE DLL (proc=0x7e402e20,module=0x7e3f0000 L"imm32.dll",reason=PROCESS_ATTACH,res=(nil)) 0009:Call KERNEL32.__wine_dll_register_16(7e406668,7e4035d0 "imm.dll") ret=7e3fb183 0009:Ret KERNEL32.__wine_dll_register_16() retval=00000011 ret=7e3fb183 0009:Call user32.RegisterWindowMessageA(7e403e49 "MSIMEService") ret=7e400b4e 0009:Ret user32.RegisterWindowMessageA() retval=0000c000 ret=7e400b4e 0009:Call user32.RegisterWindowMessageA(7e403e56 "MSIMEReconvertOptions") ret=7e400b65 0009:Ret user32.RegisterWindowMessageA() retval=0000c001 ret=7e400b65 0009:Call user32.RegisterWindowMessageA(7e403e6c "MSIMEMouseOperation") ret=7e400b7c 0009:Ret user32.RegisterWindowMessageA() retval=0000c002 ret=7e400b7c 0009:Call user32.RegisterWindowMessageA(7e403e80 "MSIMEReconvertRequest") ret=7e400b93 0009:Ret user32.RegisterWindowMessageA() retval=0000c003 ret=7e400b93 0009:Call user32.RegisterWindowMessageA(7e403e96 "MSIMEReconvert") ret=7e400baa 0009:Ret user32.RegisterWindowMessageA() retval=0000c004 ret=7e400baa 0009:Call user32.RegisterWindowMessageA(7e403ea5 "MSIMEQueryPosition") ret=7e400bc1 0009:Ret user32.RegisterWindowMessageA() retval=0000c005 ret=7e400bc1 0009:Call user32.RegisterWindowMessageA(7e403eb8 "MSIMEDocumentFeed") ret=7e400bd8 0009:Ret user32.RegisterWindowMessageA() retval=0000c006 ret=7e400bd8 0009:Call KERNEL32.TlsAlloc() ret=7e400be6 0009:Ret KERNEL32.TlsAlloc() retval=00000000 ret=7e400be6 0009:Call ntdll.RtlAllocateHeap(00110000,00000008,00000008) ret=7e3fcfb3 0009:Ret ntdll.RtlAllocateHeap() retval=0012ce08 ret=7e3fcfb3 0009:Call KERNEL32.TlsSetValue(00000000,0012ce08) ret=7e3fcfc8 0009:Ret KERNEL32.TlsSetValue() retval=00000001 ret=7e3fcfc8 0009:Ret PE DLL (proc=0x7e402e20,module=0x7e3f0000 L"imm32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 0009:Call PE DLL (proc=0x7e5af640,module=0x7e540000 L"winex11.drv",reason=PROCESS_ATTACH,res=(nil)) 000d:Ret KERNEL32.WaitForSingleObjectEx() retval=00000000 ret=7ee67db2 000d:Call KERNEL32.CloseHandle(0000003c) ret=7ee67e2b 000d:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee67e2b 000d:Call advapi32.RegCloseKey(00000024) ret=7ee6b088 000d:Ret advapi32.RegCloseKey() retval=00000000 ret=7ee6b088 000d:Call ntdll.RtlDeleteCriticalSection(00117368) ret=7ee6b096 000d:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7ee6b096 000d:Call KERNEL32.GetProcessHeap() ret=7ee6b09e 000d:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=7ee6b09e 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00117358) ret=7ee6b0b2 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee6b0b2 000d:Call KERNEL32.ExitProcess(00000000) ret=7ee6faaa 000d:Call PE DLL (proc=0x7ee41470,module=0x7ee00000 L"rpcrt4.dll",reason=PROCESS_DETACH,res=0x1) 000d:Call KERNEL32.CloseHandle(00000018) ret=7ee3fe02 000d:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee3fe02 000d:Ret PE DLL (proc=0x7ee41470,module=0x7ee00000 L"rpcrt4.dll",reason=PROCESS_DETACH,res=0x1) retval=1 000d:Call PE DLL (proc=0x7edef300,module=0x7ede0000 L"iphlpapi.dll",reason=PROCESS_DETACH,res=0x1) 000d:Ret PE DLL (proc=0x7edef300,module=0x7ede0000 L"iphlpapi.dll",reason=PROCESS_DETACH,res=0x1) retval=1 000d:Call PE DLL (proc=0x7edb3b00,module=0x7ed80000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) 000d:Ret PE DLL (proc=0x7edb3b00,module=0x7ed80000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 000d:Call PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1) 000d:Ret PE DLL (proc=0x7b8a3a10,module=0x7b820000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 000d:Call PE DLL (proc=0x7bc77ca0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1) 000d:Ret PE DLL (proc=0x7bc77ca0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1) retval=1