[DUMP] Memory World of Warcraft Classic [1.14.4.51535]

[empathe]

Hello, does anyone have a method for dumping the memory of WoW Classic and retrieving the offsets of the Object Manager?

[aeo]

start the game, use res mon to suspend it and dump it with scylla.

[scizzydo]

There's plenty of tools out there. Here's a link to mine: GitHub - scizzydo/memdump: Windows x64 PE process memory dumper to disk


It's just the exe, so you'd do:

memdump.exe Path\to\WowClassic.exe

[empathe]

There's plenty of tools out there. Here's a link to mine: GitHub - scizzydo/memdump: Windows x64 PE process memory dumper to disk


It's just the exe, so you'd do:

memdump.exe Path\to\WowClassic.exe

Oh, thank you for the GitHub link. If I understand correctly, with this I can retrieve the offsets of the object manager. This software is not just for WoW Classic, but it is generic for all programs. I'll test it right away, thank you

[empathe]

Okay, I went to the GitHub and cloned the repository. Then I compiled it with Visual Studio 2012. After that, I ran the memdump.exe on WowClassic.exe, and this is what I got:

32m[17:20:12.000953]: Started WowClassic.exe [0x5e0]
32m[17:20:12.000953]: Allocated remote buffer at 0x7ff6d6fb0000
36m[17:20:12.000958]: Process base: 0x7ff75b6e0000
36m[17:20:12.000958]: TLS callbacks: 0x7ff75b6e3ec0
32m[17:20:12.000958]: NtCreateSection hooked
32m[17:20:12.000958]: NtMapViewOfSection hooked
36m[17:20:12.000958]: Executing TLS Callback 1: 0x7ff75b6e3ec0
36m[17:20:12.000958]: Executing TLS Callback 2: 0x7ff75b6ea1e0
36m[17:20:12.000985]: NtCreateSection - Set SectionPageProtection to PAGE_EXECUTE_READWRITE
36m[17:20:12.000985]: NtCreateSection - Page Protection: 0x40 - Allocation Attributes: 0x8400000
36m[17:20:12.000985]: NtCreateSection - Removed SEC_NO_CHANGE from call
36m[17:20:13.000028]: NtMapViewOfSection: Called on base 0x7ff75b6e0000 with 0x20 (2920000 bytes)
36m[17:20:13.000028]: NtMapViewOfSection: Set to PAGE_EXECUTE_WRITECOPY as section is SEC_COMMIT (SEC_IMAGE: false)
36m[17:20:13.000028]: NtMapViewOfSection: Called on base 0x7ff75e000000 with 0x4 (1b00000 bytes)
36m[17:20:13.000028]: NtMapViewOfSection: Called on base 0x7ff75fb00000 with 0x2 (0 bytes)
36m[17:20:13.000241]: Executing TLS Callback 3: 0x7ff75b9904f0
36m[17:20:13.000247]: Executing TLS Callback 4: 0x7ff75b94dc08
36m[17:20:13.000247]: Executing TLS Callback 5: 0x7ff75d7e1288
36m[17:20:13.000314]: New section .import added. Virtual Address: 0x4669000
36m[17:20:13.000317]: 0x007ff75d9d6000 -> ADVAPI32.dll!RegCloseKey (ord: 1607 hint: 25E)
36m[17:20:13.000320]: 0x007ff75d9d6008 -> ADVAPI32.dll!RegCreateKeyExA (ord: 1615 hint: 266)
36m[17:20:13.000322]: 0x007ff75d9d6010 -> ADVAPI32.dll!RegOpenKeyExA (ord: 1655 hint: 28E)
36m[17:20:13.000325]: 0x007ff75d9d6018 -> ADVAPI32.dll!RegQueryValueExA (ord: 1668 hint: 29B)
36m[17:20:13.000328]: 0x007ff75d9d6020 -> ADVAPI32.dll!RegSetValueExA (ord: 1684 hint: 2AB)
36m[17:20:13.000331]: 0x007ff75d9d6028 -> ADVAPI32.dll!RegCreateKeyExW (ord: 1616 hint: 267)
36m[17:20:13.000334]: 0x007ff75d9d6030 -> ADVAPI32.dll!RegDeleteKeyExA (ord: 1621 hint: 26C)
36m[17:20:13.000337]: 0x007ff75d9d6038 -> ADVAPI32.dll!RegDeleteValueA (ord: 1630 hint: 275)
36m[17:20:13.000339]: 0x007ff75d9d6040 -> ADVAPI32.dll!RegEnumKeyExA (ord: 1637 hint: 27C)
36m[17:20:13.000342]: 0x007ff75d9d6048 -> ADVAPI32.dll!RegEnumValueA (ord: 1640 hint: 27F)
36m[17:20:13.000345]: 0x007ff75d9d6050 -> ADVAPI32.dll!RegFlushKey (ord: 1642 hint: 281)
36m[17:20:13.000348]: 0x007ff75d9d6058 -> ADVAPI32.dll!RegOpenKeyExW (ord: 1656 hint: 28F)
36m[17:20:13.000350]: 0x007ff75d9d6060 -> ADVAPI32.dll!RegQueryInfoKeyA (ord: 1662 hint: 295)
36m[17:20:13.000353]: 0x007ff75d9d6068 -> ADVAPI32.dll!RegQueryValueExW (ord: 1669 hint: 29C)
36m[17:20:13.000356]: 0x007ff75d9d6070 -> ADVAPI32.dll!RegSetValueExW (ord: 1685 hint: 2AC)
36m[17:20:13.000359]: 0x007ff75d9d6078 -> ADVAPI32.dll!RegGetValueW (ord: 1645 hint: 284)
36m[17:20:13.000361]: 0x007ff75d9d6080 -> ADVAPI32.dll!GetUserNameW (ord: 1381 hint: 17B)
36m[17:20:13.000361]: 0x007ff75d9d6088 -> ADVAPI32.dll!AllocateLocallyUniqueId (ord: 1035 hint: 21)
36m[17:20:13.000364]: 0x007ff75d9d6090 -> ADVAPI32.dll!RegEnumKeyA (ord: 1636 hint: 27B)
36m[17:20:13.000367]: 0x007ff75d9d6098 -> ADVAPI32.dll!RegOpenKeyA (ord: 1654 hint: 28D)
36m[17:20:13.000367]: 0x007ff75d9d60a0 -> ADVAPI32.dll!CryptAcquireContextW (ord: 1196 hint: C2)
36m[17:20:13.000368]: 0x007ff75d9d60a8 -> ADVAPI32.dll!CryptReleaseContext (ord: 1222 hint: DC)
36m[17:20:13.000369]: 0x007ff75d9d60b0 -> ADVAPI32.dll!CryptGenRandom (ord: 1212 hint: D2)
36m[17:20:13.000370]: 0x007ff75d9d60b8 -> ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW (ord: 1131 hint: 81)
36m[17:20:13.000371]: 0x007ff75d9d60c0 -> ADVAPI32.dll!CryptGetHashParam (ord: 1215 hint: D5)
36m[17:20:13.000371]: 0x007ff75d9d60c8 -> ADVAPI32.dll!CryptCreateHash (ord: 1198 hint: C4)
36m[17:20:13.000372]: 0x007ff75d9d60d0 -> ADVAPI32.dll!CryptHashData (ord: 1219 hint: D9)
36m[17:20:13.000373]: 0x007ff75d9d60d8 -> ADVAPI32.dll!CryptDestroyHash (ord: 1201 hint: C7)
36m[17:20:13.000374]: 0x007ff75d9d60e0 -> ADVAPI32.dll!CryptDestroyKey (ord: 1202 hint: C8)
36m[17:20:13.000375]: 0x007ff75d9d60e8 -> ADVAPI32.dll!CryptImportKey (ord: 1221 hint: DB)
36m[17:20:13.000376]: 0x007ff75d9d60f0 -> ADVAPI32.dll!CryptEncrypt (ord: 1205 hint: CB)
36m[17:20:13.000377]: 0x007ff75d9d60f8 -> ADVAPI32.dll!EventRegister (ord: 1291 hint: 121) [forwarded]
36m[17:20:13.000378]: 0x007ff75d9d6100 -> ADVAPI32.dll!EventUnregister (ord: 1293 hint: 123) [forwarded]
36m[17:20:13.000380]: 0x007ff75d9d6108 -> ADVAPI32.dll!EventWriteTransfer (ord: 1299 hint: 129) [forwarded]
36m[17:20:13.000380]: 0x007ff75d9d6118 -> COMCTL32.dll!InitCommonControlsEx (ord: 94 hint: 7C)
36m[17:20:13.000381]: 0x007ff75d9d6128 -> CRYPT32.dll!CertGetIssuerCertificateFromStore (ord: 1093 hint: 49)
36m[17:20:13.000381]: 0x007ff75d9d6130 -> CRYPT32.dll!CertFreeCertificateChainEngine (ord: 1082 hint: 3E)
36m[17:20:13.000382]: 0x007ff75d9d6138 -> CRYPT32.dll!CryptUnprotectData (ord: 1238 hint: E1)
36m[17:20:13.000383]: 0x007ff75d9d6140 -> CRYPT32.dll!CryptQueryObject (ord: 1210 hint: C5)
36m[17:20:13.000383]: 0x007ff75d9d6148 -> CRYPT32.dll!CertGetNameStringW (ord: 1095 hint: 4B)
36m[17:20:13.000384]: 0x007ff75d9d6150 -> CRYPT32.dll!PFXImportCertStore (ord: 1304 hint: 124)
36m[17:20:13.000385]: 0x007ff75d9d6158 -> CRYPT32.dll!CryptStringToBinaryW (ord: 1236 hint: DF)
36m[17:20:13.000385]: 0x007ff75d9d6160 -> CRYPT32.dll!CertEnumCertificatesInStore (ord: 1064 hint: 2C)
36m[17:20:13.000386]: 0x007ff75d9d6168 -> CRYPT32.dll!CryptStringToBinaryA (ord: 1235 hint: DE)
36m[17:20:13.000387]: 0x007ff75d9d6170 -> CRYPT32.dll!CertVerifyCertificateChainPolicy (ord: 1138 hint: 76)
36m[17:20:13.000387]: 0x007ff75d9d6178 -> CRYPT32.dll!CertGetCertificateChain (ord: 1089 hint: 45)
36m[17:20:13.000388]: 0x007ff75d9d6180 -> CRYPT32.dll!CryptMemFree (ord: 1191 hint: AB)
36m[17:20:13.000388]: 0x007ff75d9d6188 -> CRYPT32.dll!CertGetNameStringA (ord: 1094 hint: 4A)
36m[17:20:13.000389]: 0x007ff75d9d6190 -> CRYPT32.dll!CertNameToStrA (ord: 1105 hint: 55)
36m[17:20:13.000389]: 0x007ff75d9d6198 -> CRYPT32.dll!CertFindExtension (ord: 1075 hint: 37)
36m[17:20:13.000389]: 0x007ff75d9d61a0 -> CRYPT32.dll!CertVerifyTimeValidity (ord: 1141 hint: 79)
36m[17:20:13.000389]: 0x007ff75d9d61a8 -> CRYPT32.dll!CertAddCertificateContextToStore (ord: 1024 hint: 4)
36m[17:20:13.000390]: 0x007ff75d9d61b0 -> CRYPT32.dll!CertGetCRLContextProperty (ord: 1086 hint: 42)
36m[17:20:13.000390]: 0x007ff75d9d61b8 -> CRYPT32.dll!CertCreateCertificateContext (ord: 1048 hint: 1C)
36m[17:20:13.000390]: 0x007ff75d9d61c0 -> CRYPT32.dll!CertFindCertificateInStore (ord: 1073 hint: 35)
36m[17:20:13.000390]: 0x007ff75d9d61c8 -> CRYPT32.dll!CertOpenStore (ord: 1109 hint: 59)
36m[17:20:13.000391]: 0x007ff75d9d61d0 -> CRYPT32.dll!CryptDecodeObjectEx (ord: 1151 hint: 83)
36m[17:20:13.000391]: 0x007ff75d9d61d8 -> CRYPT32.dll!CertFreeCertificateChain (ord: 1081 hint: 3D)
36m[17:20:13.000392]: 0x007ff75d9d61e0 -> CRYPT32.dll!CertFreeCertificateContext (ord: 1084 hint: 40)
36m[17:20:13.000392]: 0x007ff75d9d61e8 -> CRYPT32.dll!CertCreateCertificateChainEngine (ord: 1047 hint: 1B)
36m[17:20:13.000392]: 0x007ff75d9d61f0 -> CRYPT32.dll!CertCloseStore (ord: 1038 hint: 12)
36m[17:20:13.000392]: 0x007ff75d9d6200 -> GDI32.dll!CreateDCW (ord: 1066 hint: 34)
36m[17:20:13.000395]: 0x007ff75d9d6208 -> GDI32.dll!DeleteDC (ord: 1398 hint: 180)
36m[17:20:13.000399]: 0x007ff75d9d6210 -> GDI32.dll!GetICMProfileW (ord: 1681 hint: 29C)
36m[17:20:13.000402]: 0x007ff75d9d6218 -> GDI32.dll!GetDeviceGammaRamp (ord: 1652 hint: 27F)
36m[17:20:13.000407]: 0x007ff75d9d6220 -> GDI32.dll!SetDeviceGammaRamp (ord: 1903 hint: 37A)
36m[17:20:13.000408]: 0x007ff75d9d6228 -> GDI32.dll!CreateCompatibleDC (ord: 1064 hint: 31)
36m[17:20:13.000408]: 0x007ff75d9d6230 -> GDI32.dll!CreateFontIndirectW (ord: 1081 hint: 43)
36m[17:20:13.000412]: 0x007ff75d9d6238 -> GDI32.dll!GetTextExtentPoint32A (ord: 1734 hint: 2D1)
36m[17:20:13.000417]: 0x007ff75d9d6240 -> GDI32.dll!SelectObject (ord: 1884 hint: 367)
36m[17:20:13.000421]: 0x007ff75d9d6248 -> GDI32.dll!GetTextMetricsW (ord: 1743 hint: 2DA)
36m[17:20:13.000421]: 0x007ff75d9d6250 -> GDI32.dll!CreateSolidBrush (ord: 1104 hint: 5A)
36m[17:20:13.000422]: 0x007ff75d9d6258 -> GDI32.dll!CreateCompatibleBitmap (ord: 1063 hint: 30)
36m[17:20:13.000425]: 0x007ff75d9d6260 -> GDI32.dll!GetDIBits (ord: 1650 hint: 27D)
36m[17:20:13.000426]: 0x007ff75d9d6268 -> GDI32.dll!BitBlt (ord: 1034 hint: 13)
36m[17:20:13.000429]: 0x007ff75d9d6270 -> GDI32.dll!GetDeviceCaps (ord: 1651 hint: 27E)
36m[17:20:13.000429]: 0x007ff75d9d6278 -> GDI32.dll!CreateBitmap (ord: 1056 hint: 29)
36m[17:20:13.000430]: 0x007ff75d9d6280 -> GDI32.dll!CombineRgn (ord: 1049 hint: 22)
36m[17:20:13.000430]: 0x007ff75d9d6288 -> GDI32.dll!CreateRectRgn (ord: 1097 hint: 53)
36m[17:20:13.000433]: 0x007ff75d9d6290 -> GDI32.dll!DeleteObject (ord: 1401 hint: 183)
36m[17:20:13.000433]: 0x007ff75d9d6298 -> GDI32.dll!CreateDIBSection (ord: 1069 hint: 37)
36m[17:20:13.000434]: 0x007ff75d9d62a8 -> IMM32.dll!ImmSetCompositionWindow (ord: 120 hint: 77)
36m[17:20:13.000434]: 0x007ff75d9d62b0 -> IMM32.dll!ImmSetCompositionStringW (ord: 119 hint: 76)
36m[17:20:13.000434]: 0x007ff75d9d62b8 -> IMM32.dll!ImmGetIMEFileNameA (ord: 73 hint: 48)
36m[17:20:13.000435]: 0x007ff75d9d62c0 -> IMM32.dll!ImmNotifyIME (ord: 101 hint: 64)
36m[17:20:13.000435]: 0x007ff75d9d62c8 -> IMM32.dll!ImmSetConversionStatus (ord: 121 hint: 78)
36m[17:20:13.000436]: 0x007ff75d9d62d0 -> IMM32.dll!ImmGetConversionStatus (ord: 63 hint: 3E)
36m[17:20:13.000436]: 0x007ff75d9d62d8 -> IMM32.dll!ImmGetCandidateListW (ord: 53 hint: 34)
36m[17:20:13.000436]: 0x007ff75d9d62e0 -> IMM32.dll!ImmGetCompositionStringW (ord: 58 hint: 39)
36m[17:20:13.000436]: 0x007ff75d9d62e8 -> IMM32.dll!ImmAssociateContextEx (ord: 28 hint: 1B)
36m[17:20:13.000436]: 0x007ff75d9d62f0 -> IMM32.dll!ImmAssociateContext (ord: 27 hint: 1A)
36m[17:20:13.000437]: 0x007ff75d9d62f8 -> IMM32.dll!ImmReleaseContext (ord: 108 hint: 6B)
36m[17:20:13.000437]: 0x007ff75d9d6300 -> IMM32.dll!ImmGetContext (ord: 60 hint: 3B)
36m[17:20:13.000438]: 0x007ff75d9d6308 -> IMM32.dll!ImmGetIMEFileNameW (ord: 74 hint: 49)
36m[17:20:13.000438]: 0x007ff75d9d6310 -> IMM32.dll!ImmSetCandidateWindow (ord: 115 hint: 72)
36m[17:20:13.000438]: 0x007ff75d9d6320 -> IPHLPAPI.DLL!GetAdaptersInfo (ord: 69 hint: 44)
36m[17:20:13.000439]: 0x007ff75d9d6330 -> KERNEL32.dll!CreateFileA (ord: 199 hint: C6)
36m[17:20:13.000443]: 0x007ff75d9d6338 -> KERNEL32.dll!HeapAlloc (ord: 850 hint: 351) [forwarded]
36m[17:20:13.000447]: 0x007ff75d9d6340 -> KERNEL32.dll!HeapFree (ord: 854 hint: 355)
36m[17:20:13.000450]: 0x007ff75d9d6348 -> KERNEL32.dll!GetProcessHeap (ord: 703 hint: 2BE)
36m[17:20:13.000452]: 0x007ff75d9d6350 -> KERNEL32.dll!ExitThread (ord: 361 hint: 168) [forwarded]
36m[17:20:13.000457]: 0x007ff75d9d6358 -> KERNEL32.dll!LocalAlloc (ord: 978 hint: 3D1)
36m[17:20:13.000457]: 0x007ff75d9d6360 -> KERNEL32.dll!ConvertThreadToFiberEx (ord: 169 hint: A8)
36m[17:20:13.000459]: 0x007ff75d9d6368 -> KERNEL32.dll!FormatMessageA (ord: 432 hint: 1AF)
36m[17:20:13.000466]: 0x007ff75d9d6370 -> KERNEL32.dll!TryEnterCriticalSection (ord: 1467 hint: 5BA) [forwarded]
36m[17:20:13.000472]: 0x007ff75d9d6378 -> KERNEL32.dll!ResetEvent (ord: 1230 hint: 4CD)
36m[17:20:13.000477]: 0x007ff75d9d6380 -> KERNEL32.dll!ReleaseSemaphore (ord: 1212 hint: 4BB)
36m[17:20:13.000483]: 0x007ff75d9d6388 -> KERNEL32.dll!ReleaseMutex (ord: 1208 hint: 4B7)
36m[17:20:13.000484]: 0x007ff75d9d6390 -> KERNEL32.dll!CreateMutexW (ord: 222 hint: DD)
36m[17:20:13.000489]: 0x007ff75d9d6398 -> KERNEL32.dll!OpenMutexW (ord: 1039 hint: 40E)
36m[17:20:13.000490]: 0x007ff75d9d63a0 -> KERNEL32.dll!CreateEventA (ord: 192 hint: BF)
36m[17:20:13.000491]: 0x007ff75d9d63a8 -> KERNEL32.dll!CreateSemaphoreA (ord: 237 hint: EC)
36m[17:20:13.000495]: 0x007ff75d9d63b0 -> KERNEL32.dll!IsValidLanguageGroup (ord: 916 hint: 393)
36m[17:20:13.000499]: 0x007ff75d9d63b8 -> KERNEL32.dll!MultiByteToWideChar (ord: 1015 hint: 3F6)
36m[17:20:13.000504]: 0x007ff75d9d63c0 -> KERNEL32.dll!MoveFileW (ord: 1011 hint: 3F2)
36m[17:20:13.000508]: 0x007ff75d9d63c8 -> KERNEL32.dll!InitOnceInitialize (ord: 871 hint: 366) [forwarded]
36m[17:20:13.000514]: 0x007ff75d9d63d0 -> KERNEL32.dll!ReleaseSRWLockExclusive (ord: 1210 hint: 4B9) [forwarded]
36m[17:20:13.000514]: 0x007ff75d9d63d8 -> KERNEL32.dll!AcquireSRWLockExclusive (ord: 1 hint: 0) [forwarded]
36m[17:20:13.000520]: 0x007ff75d9d63e0 -> KERNEL32.dll!TryAcquireSRWLockExclusive (ord: 1465 hint: 5B8) [forwarded]
36m[17:20:13.000524]: 0x007ff75d9d63e8 -> KERNEL32.dll!GetStdHandle (ord: 733 hint: 2DC)
36m[17:20:13.000530]: 0x007ff75d9d63f0 -> KERNEL32.dll!SetHandleInformation (ord: 1343 hint: 53E)
36m[17:20:13.000531]: 0x007ff75d9d63f8 -> KERNEL32.dll!CreatePipe (ord: 225 hint: E0)
36m[17:20:13.000537]: 0x007ff75d9d6400 -> KERNEL32.dll!SetNamedPipeHandleState (ord: 1356 hint: 54B)
36m[17:20:13.000540]: 0x007ff75d9d6408 -> KERNEL32.dll!GetProcessId (ord: 705 hint: 2C0)
36m[17:20:13.000544]: 0x007ff75d9d6410 -> KERNEL32.dll!OpenProcess (ord: 1043 hint: 412)
36m[17:20:13.000545]: 0x007ff75d9d6418 -> KERNEL32.dll!CreateJobObjectW (ord: 214 hint: D5)
36m[17:20:13.000546]: 0x007ff75d9d6420 -> KERNEL32.dll!AssignProcessToJobObject (ord: 37 hint: 24)
36m[17:20:13.000552]: 0x007ff75d9d6428 -> KERNEL32.dll!SetInformationJobObject (ord: 1344 hint: 53F)
36m[17:20:13.000558]: 0x007ff75d9d6430 -> KERNEL32.dll!Sleep (ord: 1425 hint: 590)
36m[17:20:13.000561]: 0x007ff75d9d6438 -> KERNEL32.dll!GetThreadId (ord: 775 hint: 306)
36m[17:20:13.000565]: 0x007ff75d9d6440 -> KERNEL32.dll!GetProcessAffinityMask (ord: 698 hint: 2B9)
36m[17:20:13.000571]: 0x007ff75d9d6448 -> KERNEL32.dll!VirtualFree (ord: 1502 hint: 5DD)
36m[17:20:13.000576]: 0x007ff75d9d6450 -> KERNEL32.dll!OutputDebugStringW (ord: 1055 hint: 41E)
36m[17:20:13.000583]: 0x007ff75d9d6458 -> KERNEL32.dll!VirtualProtect (ord: 1505 hint: 5E0)
36m[17:20:13.000584]: 0x007ff75d9d6460 -> KERNEL32.dll!CreateFileMappingW (ord: 204 hint: CB)
36m[17:20:13.000588]: 0x007ff75d9d6468 -> KERNEL32.dll!OpenFileMappingW (ord: 1035 hint: 40A)
36m[17:20:13.000593]: 0x007ff75d9d6470 -> KERNEL32.dll!MapViewOfFile (ord: 998 hint: 3E5)
36m[17:20:13.000600]: 0x007ff75d9d6478 -> KERNEL32.dll!UnmapViewOfFile (ord: 1477 hint: 5C4)
36m[17:20:13.000601]: 0x007ff75d9d6480 -> KERNEL32.dll!CreateActCtxW (ord: 180 hint: B3)
36m[17:20:13.000601]: 0x007ff75d9d6488 -> KERNEL32.dll!ActivateActCtx (ord: 3 hint: 2)
36m[17:20:13.000602]: 0x007ff75d9d6490 -> KERNEL32.dll!DeactivateActCtx (ord: 263 hint: 106)
36m[17:20:13.000605]: 0x007ff75d9d6498 -> KERNEL32.dll!GetSystemInfo (ord: 750 hint: 2ED)
36m[17:20:13.000608]: 0x007ff75d9d64a0 -> KERNEL32.dll!GetLogicalProcessorInformationEx (ord: 628 hint: 273) [forwarded]
36m[17:20:13.000611]: 0x007ff75d9d64a8 -> KERNEL32.dll!GetNativeSystemInfo (ord: 655 hint: 28E)
36m[17:20:13.000614]: 0x007ff75d9d64b0 -> KERNEL32.dll!GetFinalPathNameByHandleW (ord: 603 hint: 25A)
36m[17:20:13.000620]: 0x007ff75d9d64b8 -> KERNEL32.dll!SetFilePointerEx (ord: 1333 hint: 534)
36m[17:20:13.000625]: 0x007ff75d9d64c0 -> KERNEL32.dll!QueryPerformanceCounter (ord: 1107 hint: 452)
36m[17:20:13.000629]: 0x007ff75d9d64c8 -> KERNEL32.dll!QueryPerformanceFrequency (ord: 1108 hint: 453)
36m[17:20:13.000632]: 0x007ff75d9d64d0 -> KERNEL32.dll!GetProcessTimes (ord: 713 hint: 2C8)
36m[17:20:13.000636]: 0x007ff75d9d64d8 -> KERNEL32.dll!GetSystemTimeAsFileTime (ord: 756 hint: 2F3)
36m[17:20:13.000639]: 0x007ff75d9d64e0 -> KERNEL32.dll!GetTickCount64 (ord: 787 hint: 312)
36m[17:20:13.000643]: 0x007ff75d9d64e8 -> KERNEL32.dll!GetTimeZoneInformation (ord: 793 hint: 318)
36m[17:20:13.000645]: 0x007ff75d9d64f0 -> KERNEL32.dll!GetEnvironmentVariableW (ord: 580 hint: 243)
36m[17:20:13.000651]: 0x007ff75d9d64f8 -> KERNEL32.dll!SetEnvironmentVariableW (ord: 1318 hint: 525)
36m[17:20:13.000654]: 0x007ff75d9d6500 -> KERNEL32.dll!GetVersionExW (ord: 808 hint: 327)
36m[17:20:13.000660]: 0x007ff75d9d6508 -> KERNEL32.dll!SetThreadExecutionState (ord: 1386 hint: 569)
36m[17:20:13.000663]: 0x007ff75d9d6510 -> KERNEL32.dll!GetComputerNameW (ord: 489 hint: 1E8)
36m[17:20:13.000666]: 0x007ff75d9d6518 -> KERNEL32.dll!GetSystemPowerStatus (ord: 751 hint: 2EE)
36m[17:20:13.000673]: 0x007ff75d9d6520 -> KERNEL32.dll!WakeConditionVariable (ord: 1525 hint: 5F4) [forwarded]
36m[17:20:13.000680]: 0x007ff75d9d6528 -> KERNEL32.dll!SleepConditionVariableSRW (ord: 1427 hint: 592) [forwarded]
36m[17:20:13.000685]: 0x007ff75d9d6530 -> KERNEL32.dll!LoadLibraryExW (ord: 971 hint: 3CA)
36m[17:20:13.000691]: 0x007ff75d9d6538 -> KERNEL32.dll!SystemTimeToTzSpecificLocalTime (ord: 1437 hint: 59C)
36m[17:20:13.000695]: 0x007ff75d9d6540 -> KERNEL32.dll!PeekNamedPipe (ord: 1064 hint: 427)
36m[17:20:13.000699]: 0x007ff75d9d6548 -> KERNEL32.dll!InitOnceComplete (ord: 869 hint: 364) [forwarded]
36m[17:20:13.000704]: 0x007ff75d9d6550 -> KERNEL32.dll!InitOnceBeginInitialize (ord: 868 hint: 363) [forwarded]
36m[17:20:13.000710]: 0x007ff75d9d6558 -> KERNEL32.dll!SetThreadAffinityMask (ord: 1382 hint: 565)
36m[17:20:13.000717]: 0x007ff75d9d6560 -> KERNEL32.dll!VirtualAlloc (ord: 1499 hint: 5DA)
36m[17:20:13.000719]: 0x007ff75d9d6568 -> KERNEL32.dll!FlushProcessWriteBuffers (ord: 427 hint: 1AA) [forwarded]
36m[17:20:13.000720]: 0x007ff75d9d6570 -> KERNEL32.dll!CreateSemaphoreExW (ord: 239 hint: EE)
36m[17:20:13.000720]: 0x007ff75d9d6578 -> KERNEL32.dll!AcquireSRWLockShared (ord: 2 hint: 1) [forwarded]
36m[17:20:13.000726]: 0x007ff75d9d6580 -> KERNEL32.dll!ReleaseSRWLockShared (ord: 1211 hint: 4BA) [forwarded]
36m[17:20:13.000733]: 0x007ff75d9d6588 -> KERNEL32.dll!WakeAllConditionVariable (ord: 1524 hint: 5F3) [forwarded]
36m[17:20:13.000737]: 0x007ff75d9d6590 -> KERNEL32.dll!InitOnceInitialize (ord: 871 hint: 366) [forwarded]
36m[17:20:13.000738]: 0x007ff75d9d6598 -> KERNEL32.dll!CreateFileMappingA (ord: 200 hint: C7)
36m[17:20:13.000740]: 0x007ff75d9d65a0 -> KERNEL32.dll!FlushViewOfFile (ord: 428 hint: 1AB)
36m[17:20:13.000741]: 0x007ff75d9d65a8 -> KERNEL32.dll!CreateMutexA (ord: 219 hint: DA)
36m[17:20:13.000744]: 0x007ff75d9d65b0 -> KERNEL32.dll!GetLocaleInfoA (ord: 621 hint: 26C)
36m[17:20:13.000750]: 0x007ff75d9d65b8 -> KERNEL32.dll!SleepEx (ord: 1428 hint: 593)
36m[17:20:13.000751]: 0x007ff75d9d65c0 -> KERNEL32.dll!CancelIoEx (ord: 117 hint: 74)
36m[17:20:13.000756]: 0x007ff75d9d65c8 -> KERNEL32.dll!PostQueuedCompletionStatus (ord: 1065 hint: 428)
36m[17:20:13.000759]: 0x007ff75d9d65d0 -> KERNEL32.dll!GetQueuedCompletionStatusEx (ord: 726 hint: 2D5)
36m[17:20:13.000760]: 0x007ff75d9d65d8 -> KERNEL32.dll!CreateIoCompletionPort (ord: 212 hint: D3)
36m[17:20:13.000764]: 0x007ff75d9d65e0 -> KERNEL32.dll!GetVolumePathNameW (ord: 815 hint: 32E)
36m[17:20:13.000766]: 0x007ff75d9d65e8 -> KERNEL32.dll!GetDriveTypeW (ord: 570 hint: 239)
36m[17:20:13.000772]: 0x007ff75d9d65f0 -> KERNEL32.dll!SetDllDirectoryW (ord: 1312 hint: 51F)
36m[17:20:13.000775]: 0x007ff75d9d65f8 -> KERNEL32.dll!GetCurrentProcessorNumberEx (ord: 548 hint: 223) [forwarded]
36m[17:20:13.000776]: 0x007ff75d9d6600 -> KERNEL32.dll!CompareStringA (ord: 156 hint: 9B)
36m[17:20:13.000780]: 0x007ff75d9d6608 -> KERNEL32.dll!GlobalLock (ord: 837 hint: 344)
36m[17:20:13.000783]: 0x007ff75d9d6610 -> KERNEL32.dll!GlobalUnlock (ord: 844 hint: 34B)
36m[17:20:13.000787]: 0x007ff75d9d6618 -> KERNEL32.dll!GlobalAlloc (ord: 826 hint: 339)
36m[17:20:13.000788]: 0x007ff75d9d6620 -> KERNEL32.dll!CreateSemaphoreW (ord: 240 hint: EF)
36m[17:20:13.000793]: 0x007ff75d9d6628 -> KERNEL32.dll!MulDiv (ord: 1014 hint: 3F5)
36m[17:20:13.000795]: 0x007ff75d9d6630 -> KERNEL32.dll!GetEnvironmentVariableA (ord: 579 hint: 242)
36m[17:20:13.000801]: 0x007ff75d9d6638 -> KERNEL32.dll!SetErrorMode (ord: 1319 hint: 526)
36m[17:20:13.000805]: 0x007ff75d9d6640 -> KERNEL32.dll!GetSystemDirectoryW (ord: 747 hint: 2EA)
36m[17:20:13.000809]: 0x007ff75d9d6648 -> KERNEL32.dll!GlobalFree (ord: 833 hint: 340)
36m[17:20:13.000812]: 0x007ff75d9d6650 -> KERNEL32.dll!GetSystemDefaultLangID (ord: 743 hint: 2E6)
36m[17:20:13.000814]: 0x007ff75d9d6658 -> KERNEL32.dll!FlushInstructionCache (ord: 426 hint: 1A9)
36m[17:20:13.000818]: 0x007ff75d9d6660 -> KERNEL32.dll!IsDebuggerPresent (ord: 902 hint: 385)
36m[17:20:13.000822]: 0x007ff75d9d6668 -> KERNEL32.dll!K32GetProcessMemoryInfo (ord: 944 hint: 3AF)
36m[17:20:13.000827]: 0x007ff75d9d6670 -> KERNEL32.dll!Module32Next (ord: 1004 hint: 3EB)
36m[17:20:13.000832]: 0x007ff75d9d6678 -> KERNEL32.dll!Module32First (ord: 1002 hint: 3E9)
36m[17:20:13.000838]: 0x007ff75d9d6680 -> KERNEL32.dll!Thread32Next (ord: 1457 hint: 5B0)
36m[17:20:13.000842]: 0x007ff75d9d6688 -> KERNEL32.dll!GetTickCount (ord: 786 hint: 311)
36m[17:20:13.000843]: 0x007ff75d9d6690 -> KERNEL32.dll!CreateToolhelp32Snapshot (ord: 255 hint: FE)
36m[17:20:13.000846]: 0x007ff75d9d6698 -> KERNEL32.dll!GetModuleFileNameA (ord: 637 hint: 27C)
36m[17:20:13.000848]: 0x007ff75d9d66a0 -> KERNEL32.dll!FreeLibrary (ord: 437 hint: 1B4)
36m[17:20:13.000852]: 0x007ff75d9d66a8 -> KERNEL32.dll!GlobalMemoryStatusEx (ord: 839 hint: 346)
36m[17:20:13.000855]: 0x007ff75d9d66b0 -> KERNEL32.dll!GetThreadContext (ord: 770 hint: 301)
36m[17:20:13.000861]: 0x007ff75d9d66b8 -> KERNEL32.dll!ResumeThread (ord: 1237 hint: 4D4)
36m[17:20:13.000868]: 0x007ff75d9d66c0 -> KERNEL32.dll!SuspendThread (ord: 1433 hint: 598)
36m[17:20:13.000873]: 0x007ff75d9d66c8 -> KERNEL32.dll!OpenThread (ord: 1050 hint: 419)
36m[17:20:13.000878]: 0x007ff75d9d66d0 -> KERNEL32.dll!RtlCaptureContext (ord: 1239 hint: 4D6)
36m[17:20:13.000885]: 0x007ff75d9d66d8 -> KERNEL32.dll!WideCharToMultiByte (ord: 1555 hint: 612)
36m[17:20:13.000892]: 0x007ff75d9d66e0 -> KERNEL32.dll!VerifyVersionInfoW (ord: 1498 hint: 5D9)
36m[17:20:13.000897]: 0x007ff75d9d66e8 -> KERNEL32.dll!MoveFileExW (ord: 1008 hint: 3EF)
36m[17:20:13.000897]: 0x007ff75d9d66f0 -> KERNEL32.dll!CopyFileW (ord: 177 hint: B0)
36m[17:20:13.000898]: 0x007ff75d9d66f8 -> KERNEL32.dll!CancelIo (ord: 116 hint: 73)
36m[17:20:13.000901]: 0x007ff75d9d6700 -> KERNEL32.dll!GetOverlappedResult (ord: 675 hint: 2A2)
36m[17:20:13.000902]: 0x007ff75d9d6708 -> KERNEL32.dll!DeviceIoControl (ord: 293 hint: 124)
36m[17:20:13.000909]: 0x007ff75d9d6710 -> KERNEL32.dll!WriteFile (ord: 1575 hint: 626)
36m[17:20:13.000916]: 0x007ff75d9d6718 -> KERNEL32.dll!SetThreadContext (ord: 1383 hint: 566)
36m[17:20:13.000920]: 0x007ff75d9d6720 -> KERNEL32.dll!HeapCreate (ord: 852 hint: 353)
36m[17:20:13.000926]: 0x007ff75d9d6728 -> KERNEL32.dll!TerminateThread (ord: 1441 hint: 5A0)
36m[17:20:13.000933]: 0x007ff75d9d6730 -> KERNEL32.dll!WaitForMultipleObjectsEx (ord: 1515 hint: 5EA)
36m[17:20:13.000940]: 0x007ff75d9d6738 -> KERNEL32.dll!WriteFileEx (ord: 1576 hint: 627)
36m[17:20:13.000945]: 0x007ff75d9d6740 -> KERNEL32.dll!ReadFileEx (ord: 1148 hint: 47B)
36m[17:20:13.000952]: 0x007ff75d9d6748 -> KERNEL32.dll!WerRegisterRuntimeExceptionModule (ord: 1536 hint: 5FF)
36m[17:20:13.000956]: 0x007ff75d9d6750 -> KERNEL32.dll!GetUserDefaultUILanguage (ord: 802 hint: 321)
36m[17:20:13.000959]: 0x007ff75d9d6758 -> KERNEL32.dll!GetVersionExA (ord: 807 hint: 326)
36m[17:20:13.000963]: 0x007ff75d9d6760 -> KERNEL32.dll!InitializeCriticalSectionEx (ord: 877 hint: 36C)
36m[17:20:13.000968]: 0x007ff75d9d6768 -> KERNEL32.dll!OpenFile (ord: 1032 hint: 407)
36m[17:20:13.000971]: 0x007ff75d9d6770 -> KERNEL32.dll!GetSystemDirectoryA (ord: 746 hint: 2E9)
36m[17:20:13.000972]: 0x007ff75d9d6778 -> KERNEL32.dll!CreateWaitableTimerA (ord: 258 hint: 101)
36m[17:20:13.000979]: 0x007ff75d9d6780 -> KERNEL32.dll!SetWaitableTimer (ord: 1418 hint: 589)
36m[17:20:13.000982]: 0x007ff75d9d6788 -> KERNEL32.dll!GetUserDefaultLocaleName (ord: 801 hint: 320)
36m[17:20:13.000985]: 0x007ff75d9d6790 -> KERNEL32.dll!GetUserDefaultLangID (ord: 800 hint: 31F)
36m[17:20:13.000988]: 0x007ff75d9d6798 -> KERNEL32.dll!GetPriorityClass (ord: 686 hint: 2AD)
36m[17:20:13.000995]: 0x007ff75d9d67a0 -> KERNEL32.dll!SetPriorityClass (ord: 1357 hint: 54C)
36m[17:20:14.000000]: 0x007ff75d9d67a8 -> KERNEL32.dll!Process32NextW (ord: 1076 hint: 433)
36m[17:20:14.000005]: 0x007ff75d9d67b0 -> KERNEL32.dll!Process32FirstW (ord: 1074 hint: 431)
36m[17:20:14.000010]: 0x007ff75d9d67b8 -> KERNEL32.dll!QueryFullProcessImageNameW (ord: 1101 hint: 44C)
36m[17:20:14.000013]: 0x007ff75d9d67c0 -> KERNEL32.dll!GetTempPathA (ord: 768 hint: 2FF)
36m[17:20:14.000015]: 0x007ff75d9d67c8 -> KERNEL32.dll!DeleteFileA (ord: 279 hint: 116)
36m[17:20:14.000016]: 0x007ff75d9d67d0 -> KERNEL32.dll!FileTimeToSystemTime (ord: 372 hint: 173)
36m[17:20:14.000023]: 0x007ff75d9d67d8 -> KERNEL32.dll!WriteConsoleW (ord: 1574 hint: 625)
36m[17:20:14.000027]: 0x007ff75d9d67e0 -> KERNEL32.dll!HeapSize (ord: 859 hint: 35A) [forwarded]
36m[17:20:14.000033]: 0x007ff75d9d67e8 -> KERNEL32.dll!SetStdHandle (ord: 1373 hint: 55C)
36m[17:20:14.000035]: 0x007ff75d9d67f0 -> KERNEL32.dll!FreeEnvironmentStringsW (ord: 436 hint: 1B3)
36m[17:20:14.000038]: 0x007ff75d9d67f8 -> KERNEL32.dll!GetEnvironmentStringsW (ord: 578 hint: 241)
36m[17:20:14.000039]: 0x007ff75d9d6800 -> KERNEL32.dll!FindFirstFileExW (ord: 389 hint: 184)
36m[17:20:14.000044]: 0x007ff75d9d6808 -> KERNEL32.dll!ReadConsoleW (ord: 1144 hint: 477)
36m[17:20:14.000047]: 0x007ff75d9d6810 -> KERNEL32.dll!GetConsoleMode (ord: 518 hint: 205)
36m[17:20:14.000049]: 0x007ff75d9d6818 -> KERNEL32.dll!GetConsoleOutputCP (ord: 522 hint: 209)
36m[17:20:14.000052]: 0x007ff75d9d6820 -> KERNEL32.dll!GetOEMCP (ord: 674 hint: 2A1)
36m[17:20:14.000054]: 0x007ff75d9d6828 -> KERNEL32.dll!GetACP (ord: 444 hint: 1BB)
36m[17:20:14.000058]: 0x007ff75d9d6830 -> KERNEL32.dll!IsValidCodePage (ord: 915 hint: 392)
36m[17:20:14.000061]: 0x007ff75d9d6838 -> KERNEL32.dll!GetStringTypeW (ord: 738 hint: 2E1)
36m[17:20:14.000063]: 0x007ff75d9d6840 -> KERNEL32.dll!GetCPInfo (ord: 459 hint: 1CA)
36m[17:20:14.000069]: 0x007ff75d9d6848 -> KERNEL32.dll!SetFilePointer (ord: 1332 hint: 533)
36m[17:20:14.000075]: 0x007ff75d9d6850 -> KERNEL32.dll!SetFileAttributesW (ord: 1327 hint: 52E)
36m[17:20:14.000081]: 0x007ff75d9d6858 -> KERNEL32.dll!SetEndOfFile (ord: 1314 hint: 521)
36m[17:20:14.000087]: 0x007ff75d9d6860 -> KERNEL32.dll!RemoveDirectoryW (ord: 1217 hint: 4C0)
36m[17:20:14.000092]: 0x007ff75d9d6868 -> KERNEL32.dll!ReadFile (ord: 1147 hint: 47A)
36m[17:20:14.000095]: 0x007ff75d9d6870 -> KERNEL32.dll!GetVolumeInformationW (ord: 811 hint: 32A)
36m[17:20:14.000098]: 0x007ff75d9d6878 -> KERNEL32.dll!GetFileSizeEx (ord: 599 hint: 256)
36m[17:20:14.000100]: 0x007ff75d9d6880 -> KERNEL32.dll!GetFileSize (ord: 598 hint: 255)
36m[17:20:14.000103]: 0x007ff75d9d6888 -> KERNEL32.dll!GetFileInformationByHandle (ord: 594 hint: 251)
36m[17:20:14.000105]: 0x007ff75d9d6890 -> KERNEL32.dll!GetFileAttributesExW (ord: 589 hint: 24C)
36m[17:20:14.000108]: 0x007ff75d9d6898 -> KERNEL32.dll!GetFileAttributesW (ord: 592 hint: 24F)
36m[17:20:14.000110]: 0x007ff75d9d68a0 -> KERNEL32.dll!GetDiskFreeSpaceExW (ord: 563 hint: 232)
36m[17:20:14.000112]: 0x007ff75d9d68a8 -> KERNEL32.dll!FlushFileBuffers (ord: 425 hint: 1A8)
36m[17:20:14.000114]: 0x007ff75d9d68b0 -> KERNEL32.dll!FindNextFileW (ord: 406 hint: 195)
36m[17:20:14.000116]: 0x007ff75d9d68b8 -> KERNEL32.dll!FindFirstFileW (ord: 394 hint: 189)
36m[17:20:14.000118]: 0x007ff75d9d68c0 -> KERNEL32.dll!FindClose (ord: 383 hint: 17E)
36m[17:20:14.000119]: 0x007ff75d9d68c8 -> KERNEL32.dll!DeleteFileW (ord: 282 hint: 119)
36m[17:20:14.000120]: 0x007ff75d9d68d0 -> KERNEL32.dll!CreateDirectoryW (ord: 190 hint: BD)
36m[17:20:14.000122]: 0x007ff75d9d68d8 -> KERNEL32.dll!GetCurrentDirectoryW (ord: 539 hint: 21A)
36m[17:20:14.000128]: 0x007ff75d9d68e0 -> KERNEL32.dll!SetCurrentDirectoryW (ord: 1307 hint: 51A)
36m[17:20:14.000135]: 0x007ff75d9d68e8 -> KERNEL32.dll!VerSetConditionMask (ord: 1494 hint: 5D5) [forwarded]
36m[17:20:14.000137]: 0x007ff75d9d68f0 -> KERNEL32.dll!FormatMessageW (ord: 433 hint: 1B0)
36m[17:20:14.000141]: 0x007ff75d9d68f8 -> KERNEL32.dll!LocalFree (ord: 983 hint: 3D6)
36m[17:20:14.000144]: 0x007ff75d9d6900 -> KERNEL32.dll!GetLastError (ord: 619 hint: 26A)
36m[17:20:14.000150]: 0x007ff75d9d6908 -> KERNEL32.dll!SetLastError (ord: 1347 hint: 542)
36m[17:20:14.000152]: 0x007ff75d9d6910 -> KERNEL32.dll!GetFullPathNameW (ord: 612 hint: 263)
36m[17:20:14.000153]: 0x007ff75d9d6918 -> KERNEL32.dll!ConvertThreadToFiber (ord: 168 hint: A7)
36m[17:20:14.000154]: 0x007ff75d9d6920 -> KERNEL32.dll!CreateFiber (ord: 196 hint: C3)
36m[17:20:14.000155]: 0x007ff75d9d6928 -> KERNEL32.dll!CreateFiberEx (ord: 197 hint: C4)
36m[17:20:14.000156]: 0x007ff75d9d6930 -> KERNEL32.dll!DeleteFiber (ord: 278 hint: 115)
36m[17:20:14.000163]: 0x007ff75d9d6938 -> KERNEL32.dll!SwitchToFiber (ord: 1434 hint: 599)
36m[17:20:14.000167]: 0x007ff75d9d6940 -> KERNEL32.dll!LoadLibraryW (ord: 972 hint: 3CB)
36m[17:20:14.000171]: 0x007ff75d9d6948 -> KERNEL32.dll!LoadLibraryA (ord: 969 hint: 3C8)
36m[17:20:14.000174]: 0x007ff75d9d6950 -> KERNEL32.dll!GetModuleHandleA (ord: 639 hint: 27E)
36m[17:20:14.000177]: 0x007ff75d9d6958 -> KERNEL32.dll!GetModuleFileNameW (ord: 638 hint: 27D)
36m[17:20:14.000184]: 0x007ff75d9d6960 -> KERNEL32.dll!VirtualQuery (ord: 1507 hint: 5E2)
36m[17:20:14.000187]: 0x007ff75d9d6968 -> KERNEL32.dll!GetCurrentThreadId (ord: 550 hint: 225)
36m[17:20:14.000188]: 0x007ff75d9d6970 -> KERNEL32.dll!CreateThread (ord: 246 hint: F5)
36m[17:20:14.000190]: 0x007ff75d9d6978 -> KERNEL32.dll!GetCurrentProcessId (ord: 546 hint: 221)
36m[17:20:14.000193]: 0x007ff75d9d6980 -> KERNEL32.dll!GetCurrentProcess (ord: 545 hint: 220)
36m[17:20:14.000194]: 0x007ff75d9d6988 -> KERNEL32.dll!CreateEventW (ord: 195 hint: C2)
36m[17:20:14.000201]: 0x007ff75d9d6990 -> KERNEL32.dll!WaitForSingleObject (ord: 1516 hint: 5EB)
36m[17:20:14.000207]: 0x007ff75d9d6998 -> KERNEL32.dll!SetEvent (ord: 1320 hint: 527)
36m[17:20:14.000208]: 0x007ff75d9d69a0 -> KERNEL32.dll!CloseHandle (ord: 138 hint: 89)
36m[17:20:14.000209]: 0x007ff75d9d69a8 -> KERNEL32.dll!CreateFileW (ord: 207 hint: CE)
36m[17:20:14.000214]: 0x007ff75d9d69b0 -> KERNEL32.dll!RtlVirtualUnwind (ord: 1253 hint: 4E4)
36m[17:20:14.000220]: 0x007ff75d9d69b8 -> KERNEL32.dll!RtlLookupFunctionEntry (ord: 1246 hint: 4DD)
36m[17:20:14.000226]: 0x007ff75d9d69c0 -> KERNEL32.dll!RtlCaptureStackBackTrace (ord: 1240 hint: 4D7)
36m[17:20:14.000228]: 0x007ff75d9d69c8 -> KERNEL32.dll!GetCommandLineW (ord: 481 hint: 1E0)
36m[17:20:14.000231]: 0x007ff75d9d69d0 -> KERNEL32.dll!GetProcAddress (ord: 697 hint: 2B8)
36m[17:20:14.000234]: 0x007ff75d9d69d8 -> KERNEL32.dll!GetModuleHandleW (ord: 642 hint: 281)
36m[17:20:14.000238]: 0x007ff75d9d69e0 -> KERNEL32.dll!HeapReAlloc (ord: 857 hint: 358) [forwarded]
36m[17:20:14.000241]: 0x007ff75d9d69e8 -> KERNEL32.dll!GetFileType (ord: 601 hint: 258)
36m[17:20:14.000243]: 0x007ff75d9d69f0 -> KERNEL32.dll!GetLocalTime (ord: 620 hint: 26B)
36m[17:20:14.000245]: 0x007ff75d9d69f8 -> KERNEL32.dll!DeleteCriticalSection (ord: 277 hint: 114) [forwarded]
36m[17:20:14.000249]: 0x007ff75d9d6a00 -> KERNEL32.dll!LeaveCriticalSection (ord: 965 hint: 3C4) [forwarded]
36m[17:20:14.000251]: 0x007ff75d9d6a08 -> KERNEL32.dll!EnterCriticalSection (ord: 313 hint: 138) [forwarded]
36m[17:20:14.000255]: 0x007ff75d9d6a10 -> KERNEL32.dll!InitializeCriticalSection (ord: 875 hint: 36A) [forwarded]
36m[17:20:14.000260]: 0x007ff75d9d6a18 -> KERNEL32.dll!OutputDebugStringA (ord: 1054 hint: 41D)
36m[17:20:14.000261]: 0x007ff75d9d6a20 -> KERNEL32.dll!CreateDirectoryA (ord: 185 hint: B8)
36m[17:20:14.000267]: 0x007ff75d9d6a28 -> KERNEL32.dll!SetProcessAffinityMask (ord: 1358 hint: 54D)
36m[17:20:14.000268]: 0x007ff75d9d6a30 -> KERNEL32.dll!CreateProcessW (ord: 233 hint: E8)
36m[17:20:14.000272]: 0x007ff75d9d6a38 -> KERNEL32.dll!GetThreadPriority (ord: 780 hint: 30B)
36m[17:20:14.000278]: 0x007ff75d9d6a40 -> KERNEL32.dll!SetThreadPriority (ord: 1393 hint: 570)
36m[17:20:14.000280]: 0x007ff75d9d6a48 -> KERNEL32.dll!GetCurrentThread (ord: 549 hint: 224)
36m[17:20:14.000287]: 0x007ff75d9d6a50 -> KERNEL32.dll!TerminateProcess (ord: 1440 hint: 59F)
36m[17:20:14.000292]: 0x007ff75d9d6a58 -> KERNEL32.dll!RaiseException (ord: 1130 hint: 469)
36m[17:20:14.000298]: 0x007ff75d9d6a60 -> KERNEL32.dll!Thread32First (ord: 1456 hint: 5AF)
36m[17:20:14.000299]: 0x007ff75d9d6a68 -> KERNEL32.dll!DuplicateHandle (ord: 307 hint: 132)
36m[17:20:14.000303]: 0x007ff75d9d6a70 -> KERNEL32.dll!InitializeCriticalSectionAndSpinCount (ord: 876 hint: 36B)
36m[17:20:14.000310]: 0x007ff75d9d6a78 -> KERNEL32.dll!WaitForSingleObjectEx (ord: 1517 hint: 5EC)
36m[17:20:14.000314]: 0x007ff75d9d6a80 -> KERNEL32.dll!InitializeSListHead (ord: 880 hint: 36F) [forwarded]
36m[17:20:14.000317]: 0x007ff75d9d6a88 -> KERNEL32.dll!GetStartupInfoW (ord: 731 hint: 2DA)
36m[17:20:14.000323]: 0x007ff75d9d6a90 -> KERNEL32.dll!RtlUnwindEx (ord: 1252 hint: 4E3)
36m[17:20:14.000329]: 0x007ff75d9d6a98 -> KERNEL32.dll!RtlUnwind (ord: 1251 hint: 4E2)
36m[17:20:14.000335]: 0x007ff75d9d6aa0 -> KERNEL32.dll!TlsAlloc (ord: 1458 hint: 5B1)
36m[17:20:14.000342]: 0x007ff75d9d6aa8 -> KERNEL32.dll!TlsGetValue (ord: 1460 hint: 5B3)
36m[17:20:14.000348]: 0x007ff75d9d6ab0 -> KERNEL32.dll!TlsSetValue (ord: 1461 hint: 5B4)
36m[17:20:14.000355]: 0x007ff75d9d6ab8 -> KERNEL32.dll!TlsFree (ord: 1459 hint: 5B2)
36m[17:20:14.000360]: 0x007ff75d9d6ac0 -> KERNEL32.dll!RtlPcToFileHeader (ord: 1248 hint: 4DF)
36m[17:20:14.000362]: 0x007ff75d9d6ac8 -> KERNEL32.dll!ExitProcess (ord: 360 hint: 167)
36m[17:20:14.000365]: 0x007ff75d9d6ad0 -> KERNEL32.dll!GetModuleHandleExW (ord: 641 hint: 280)
36m[17:20:14.000367]: 0x007ff75d9d6ad8 -> KERNEL32.dll!FreeLibraryAndExitThread (ord: 438 hint: 1B5)
36m[17:20:14.000369]: 0x007ff75d9d6ae0 -> KERNEL32.dll!GetCommandLineA (ord: 480 hint: 1DF)
36m[17:20:14.000371]: 0x007ff75d9d6ae8 -> KERNEL32.dll!GetDateFormatW (ord: 556 hint: 22B)
36m[17:20:14.000375]: 0x007ff75d9d6af0 -> KERNEL32.dll!GetTimeFormatW (ord: 791 hint: 316)
36m[17:20:14.000376]: 0x007ff75d9d6af8 -> KERNEL32.dll!CompareStringW (ord: 159 hint: 9E)
36m[17:20:14.000380]: 0x007ff75d9d6b00 -> KERNEL32.dll!LCMapStringW (ord: 953 hint: 3B8)
36m[17:20:14.000383]: 0x007ff75d9d6b08 -> KERNEL32.dll!GetLocaleInfoW (ord: 623 hint: 26E)
36m[17:20:14.000387]: 0x007ff75d9d6b10 -> KERNEL32.dll!IsValidLocale (ord: 917 hint: 394)
36m[17:20:14.000390]: 0x007ff75d9d6b18 -> KERNEL32.dll!GetUserDefaultLCID (ord: 799 hint: 31E)
36m[17:20:14.000392]: 0x007ff75d9d6b20 -> KERNEL32.dll!EnumSystemLocalesW (ord: 349 hint: 15C)
36m[17:20:14.000397]: 0x007ff75d9d6b28 -> KERNEL32.dll!SetConsoleCtrlHandler (ord: 1275 hint: 4FA)
36m[17:20:14.000398]: 0x007ff75d9d6b38 -> MSACM32.dll!acmStreamOpen (ord: 38 hint: 25)
36m[17:20:14.000398]: 0x007ff75d9d6b40 -> MSACM32.dll!acmStreamSize (ord: 41 hint: 28)
36m[17:20:14.000398]: 0x007ff75d9d6b48 -> MSACM32.dll!acmStreamConvert (ord: 36 hint: 23)
36m[17:20:14.000398]: 0x007ff75d9d6b50 -> MSACM32.dll!acmStreamPrepareHeader (ord: 39 hint: 26)
36m[17:20:14.000398]: 0x007ff75d9d6b58 -> MSACM32.dll!acmStreamUnprepareHeader (ord: 42 hint: 29)
36m[17:20:14.000398]: 0x007ff75d9d6b60 -> MSACM32.dll!acmFormatSuggest (ord: 28 hint: 1B)
36m[17:20:14.000401]: 0x007ff75d9d6b70 -> SETUPAPI.dll!SetupDiGetClassDevsA (ord: 338 hint: 151)
36m[17:20:14.000404]: 0x007ff75d9d6b78 -> SETUPAPI.dll!SetupDiGetDeviceRegistryPropertyA (ord: 370 hint: 171)
36m[17:20:14.000405]: 0x007ff75d9d6b80 -> SETUPAPI.dll!CM_Get_Device_IDA (ord: 85 hint: 54) [forwarded]
36m[17:20:14.000406]: 0x007ff75d9d6b88 -> SETUPAPI.dll!CM_Locate_DevNodeA (ord: 151 hint: 96) [forwarded]
36m[17:20:14.000409]: 0x007ff75d9d6b90 -> SETUPAPI.dll!SetupDiEnumDeviceInfo (ord: 321 hint: 140)
36m[17:20:14.000410]: 0x007ff75d9d6b98 -> SETUPAPI.dll!CM_Get_Parent (ord: 129 hint: 80) [forwarded]
36m[17:20:14.000413]: 0x007ff75d9d6ba0 -> SETUPAPI.dll!SetupDiGetDeviceInterfaceDetailA (ord: 364 hint: 16B)
36m[17:20:14.000415]: 0x007ff75d9d6ba8 -> SETUPAPI.dll!SetupDiEnumDeviceInterfaces (ord: 322 hint: 141)
36m[17:20:14.000418]: 0x007ff75d9d6bb0 -> SETUPAPI.dll!SetupDiDestroyDeviceInfoList (ord: 318 hint: 13D)
36m[17:20:14.000420]: 0x007ff75d9d6bc0 -> SHELL32.dll!ShellExecuteW (ord: 576 hint: 1AF)
36m[17:20:14.000421]: 0x007ff75d9d6bc8 -> SHELL32.dll!SHGetKnownFolderPath (ord: 514 hint: 15A)
36m[17:20:14.000423]: 0x007ff75d9d6bd0 -> SHELL32.dll!ShellExecuteA (ord: 572 hint: 1AB)
36m[17:20:14.000423]: 0x007ff75d9d6bd8 -> SHELL32.dll!FindExecutableA (ord: 304 hint: 37)
36m[17:20:14.000423]: 0x007ff75d9d6be0 -> SHELL32.dll!DragAcceptFiles (ord: 287 hint: 25)
36m[17:20:14.000423]: 0x007ff75d9d6be8 -> SHELL32.dll!DragQueryFileW (ord: 292 hint: 2A)
36m[17:20:14.000423]: 0x007ff75d9d6bf0 -> SHELL32.dll!DragFinish (ord: 288 hint: 26)
36m[17:20:14.000424]: 0x007ff75d9d6bf8 -> SHELL32.dll!ExtractIconExW (ord: 302 hint: 35)
36m[17:20:14.000424]: 0x007ff75d9d6c00 -> SHELL32.dll!CommandLineToArgvW (ord: 273 hint: 9)
36m[17:20:14.000425]: 0x007ff75d9d6c08 -> SHELL32.dll!SHGetFolderPathW (ord: 505 hint: 150)
36m[17:20:14.000427]: 0x007ff75d9d6c18 -> USER32.dll!IsClipboardFormatAvailable (ord: 2066 hint: 22E)
36m[17:20:14.000428]: 0x007ff75d9d6c20 -> USER32.dll!EmptyClipboard (ord: 1739 hint: E8)
36m[17:20:14.000430]: 0x007ff75d9d6c28 -> USER32.dll!GetClipboardData (ord: 1817 hint: 136)
36m[17:20:14.000433]: 0x007ff75d9d6c30 -> USER32.dll!SetClipboardData (ord: 2310 hint: 324)
36m[17:20:14.000434]: 0x007ff75d9d6c38 -> USER32.dll!GetClipboardSequenceNumber (ord: 1821 hint: 13A)
36m[17:20:14.000435]: 0x007ff75d9d6c40 -> USER32.dll!CloseClipboard (ord: 1588 hint: 4F)
36m[17:20:14.000437]: 0x007ff75d9d6c48 -> USER32.dll!OpenClipboard (ord: 2176 hint: 29D)
36m[17:20:14.000438]: 0x007ff75d9d6c50 -> USER32.dll!EnumDisplayMonitors (ord: 1761 hint: FE)
36m[17:20:14.000441]: 0x007ff75d9d6c58 -> USER32.dll!MonitorFromPoint (ord: 2162 hint: 28F)
36m[17:20:14.000442]: 0x007ff75d9d6c60 -> USER32.dll!EnumDisplayDevicesW (ord: 1760 hint: FD)
36m[17:20:14.000443]: 0x007ff75d9d6c68 -> USER32.dll!EnumDisplaySettingsW (ord: 1765 hint: 102)
36m[17:20:14.000443]: 0x007ff75d9d6c70 -> USER32.dll!ChangeDisplaySettingsExW (ord: 1544 hint: 28)
36m[17:20:14.000446]: 0x007ff75d9d6c78 -> USER32.dll!LoadIconW (ord: 2109 hint: 25A)
36m[17:20:14.000447]: 0x007ff75d9d6c80 -> USER32.dll!FillRect (ord: 1779 hint: 110)
36m[17:20:14.000450]: 0x007ff75d9d6c88 -> USER32.dll!SetCursor (ord: 2313 hint: 328)
36m[17:20:14.000452]: 0x007ff75d9d6c90 -> USER32.dll!GetPropW (ord: 1938 hint: 1B1)
36m[17:20:14.000455]: 0x007ff75d9d6c98 -> USER32.dll!ValidateRect (ord: 2482 hint: 3D2)
36m[17:20:14.000457]: 0x007ff75d9d6ca0 -> USER32.dll!InvalidateRect (ord: 2054 hint: 222)
36m[17:20:14.000460]: 0x007ff75d9d6ca8 -> USER32.dll!IntersectRect (ord: 2053 hint: 221)
36m[17:20:14.000461]: 0x007ff75d9d6cb0 -> USER32.dll!GetWindow (ord: 1980 hint: 1DB)
36m[17:20:14.000462]: 0x007ff75d9d6cb8 -> USER32.dll!EnumThreadWindows (ord: 1770 hint: 107)
36m[17:20:14.000465]: 0x007ff75d9d6cc0 -> USER32.dll!IsDialogMessageW (ord: 2069 hint: 231)
36m[17:20:14.000467]: 0x007ff75d9d6cc8 -> USER32.dll!LoadImageW (ord: 2111 hint: 25C)
36m[17:20:14.000468]: 0x007ff75d9d6cd0 -> USER32.dll!DestroyCursor (ord: 1683 hint: AF)
36m[17:20:14.000469]: 0x007ff75d9d6cd8 -> USER32.dll!GetDesktopWindow (ord: 1832 hint: 145)
36m[17:20:14.000472]: 0x007ff75d9d6ce0 -> USER32.dll!SetWindowLongPtrW (ord: 2393 hint: 378)
36m[17:20:14.000474]: 0x007ff75d9d6ce8 -> USER32.dll!GetSysColor (ord: 1956 hint: 1C3)
36m[17:20:14.000476]: 0x007ff75d9d6cf0 -> USER32.dll!GetWindowRect (ord: 2003 hint: 1F0)
36m[17:20:14.000478]: 0x007ff75d9d6cf8 -> USER32.dll!MapVirtualKeyW (ord: 2145 hint: 27E)
36m[17:20:14.000480]: 0x007ff75d9d6d00 -> USER32.dll!GetWindowTextW (ord: 2012 hint: 1F7)
36m[17:20:14.000484]: 0x007ff75d9d6d08 -> USER32.dll!SetWindowTextW (ord: 2401 hint: 380)
36m[17:20:14.000486]: 0x007ff75d9d6d10 -> USER32.dll!GetSystemMetrics (ord: 1960 hint: 1C7)
36m[17:20:14.000487]: 0x007ff75d9d6d18 -> USER32.dll!EnableWindow (ord: 1746 hint: EF)
36m[17:20:14.000490]: 0x007ff75d9d6d20 -> USER32.dll!SetFocus (ord: 2328 hint: 337)
36m[17:20:14.000493]: 0x007ff75d9d6d28 -> USER32.dll!SetDlgItemTextW (ord: 2325 hint: 334)
36m[17:20:14.000494]: 0x007ff75d9d6d30 -> USER32.dll!GetDlgItem (ord: 1839 hint: 14C)
36m[17:20:14.000495]: 0x007ff75d9d6d38 -> USER32.dll!EndDialog (ord: 1749 hint: F2)
36m[17:20:14.000496]: 0x007ff75d9d6d40 -> USER32.dll!DialogBoxParamW (ord: 1694 hint: BA)
36m[17:20:14.000496]: 0x007ff75d9d6d48 -> USER32.dll!CreateDialogParamW (ord: 1615 hint: 6A)
36m[17:20:14.000499]: 0x007ff75d9d6d50 -> USER32.dll!IsWindowVisible (ord: 2096 hint: 24D)
36m[17:20:14.000502]: 0x007ff75d9d6d58 -> USER32.dll!SetWindowPos (ord: 2396 hint: 37B)
36m[17:20:14.000506]: 0x007ff75d9d6d60 -> USER32.dll!ShowWindow (ord: 2414 hint: 38D)
36m[17:20:14.000506]: 0x007ff75d9d6d68 -> USER32.dll!DestroyWindow (ord: 1689 hint: B5)
36m[17:20:14.000509]: 0x007ff75d9d6d70 -> USER32.dll!IsWindow (ord: 2090 hint: 247)
36m[17:20:14.000511]: 0x007ff75d9d6d78 -> USER32.dll!PostQuitMessage (ord: 2195 hint: 2B0)
36m[17:20:14.000514]: 0x007ff75d9d6d80 -> USER32.dll!PostMessageW (ord: 2194 hint: 2AF)
36m[17:20:14.000517]: 0x007ff75d9d6d88 -> USER32.dll!SendMessageW (ord: 2298 hint: 318)
36m[17:20:14.000520]: 0x007ff75d9d6d90 -> USER32.dll!SendMessageA (ord: 2293 hint: 313)
36m[17:20:14.000523]: 0x007ff75d9d6d98 -> USER32.dll!PeekMessageW (ord: 2190 hint: 2AB)
36m[17:20:14.000523]: 0x007ff75d9d6da0 -> USER32.dll!DispatchMessageW (ord: 1697 hint: BD)
36m[17:20:14.000527]: 0x007ff75d9d6da8 -> USER32.dll!TranslateMessage (ord: 2446 hint: 3AD)
36m[17:20:14.000529]: 0x007ff75d9d6db0 -> USER32.dll!GetMessageW (ord: 1900 hint: 189)
36m[17:20:14.000531]: 0x007ff75d9d6db8 -> USER32.dll!LoadStringW (ord: 2122 hint: 267)
36m[17:20:14.000534]: 0x007ff75d9d6dc0 -> USER32.dll!SetCursorPos (ord: 2315 hint: 32A)
36m[17:20:14.000536]: 0x007ff75d9d6dc8 -> USER32.dll!LoadCursorW (ord: 2107 hint: 258)
36m[17:20:14.000537]: 0x007ff75d9d6dd0 -> USER32.dll!CopyImage (ord: 1599 hint: 5A)
36m[17:20:14.000540]: 0x007ff75d9d6dd8 -> USER32.dll!SetWindowRgn (ord: 2397 hint: 37C)
36m[17:20:14.000543]: 0x007ff75d9d6de0 -> USER32.dll!IsRectEmpty (ord: 2081 hint: 23D)
36m[17:20:14.000545]: 0x007ff75d9d6de8 -> USER32.dll!GetWindowLongW (ord: 1994 hint: 1E9)
36m[17:20:14.000548]: 0x007ff75d9d6df0 -> USER32.dll!SetWindowLongW (ord: 2394 hint: 379)
36m[17:20:14.000550]: 0x007ff75d9d6df8 -> USER32.dll!GetUpdateRect (ord: 1973 hint: 1D4)
36m[17:20:14.000551]: 0x007ff75d9d6e00 -> USER32.dll!GetClassInfoExW (ord: 1805 hint: 12A)
36m[17:20:14.000552]: 0x007ff75d9d6e08 -> USER32.dll!GetMessageExtraInfo (ord: 1897 hint: 186)
36m[17:20:14.000556]: 0x007ff75d9d6e10 -> USER32.dll!TrackMouseEvent (ord: 2439 hint: 3A6)
36m[17:20:14.000560]: 0x007ff75d9d6e18 -> USER32.dll!SystemParametersInfoW (ord: 2430 hint: 39D)
36m[17:20:14.000560]: 0x007ff75d9d6e20 -> USER32.dll!DrawTextW (ord: 1730 hint: DE)
36m[17:20:14.000561]: 0x007ff75d9d6e28 -> USER32.dll!DialogBoxIndirectParamW (ord: 1692 hint: B8)
36m[17:20:14.000564]: 0x007ff75d9d6e30 -> USER32.dll!RegisterClipboardFormatA (ord: 2243 hint: 2E0)
36m[17:20:14.000565]: 0x007ff75d9d6e38 -> USER32.dll!CreateWindowExA (ord: 1626 hint: 75)
36m[17:20:14.000567]: 0x007ff75d9d6e40 -> USER32.dll!GetWindowLongPtrW (ord: 1993 hint: 1E8)
36m[17:20:14.000568]: 0x007ff75d9d6e48 -> USER32.dll!GetCursorPos (ord: 1828 hint: 141)
36m[17:20:14.000569]: 0x007ff75d9d6e50 -> USER32.dll!GetParent (ord: 1907 hint: 190)
36m[17:20:14.000572]: 0x007ff75d9d6e58 -> USER32.dll!MessageBoxW (ord: 2159 hint: 28C)
36m[17:20:14.000574]: 0x007ff75d9d6e60 -> USER32.dll!LoadStringA (ord: 2121 hint: 266)
36m[17:20:14.000578]: 0x007ff75d9d6e68 -> USER32.dll!wsprintfA (ord: 2562 hint: 3E9)
36m[17:20:14.000582]: 0x007ff75d9d6e70 -> USER32.dll!ToUnicode (ord: 2437 hint: 3A4)
36m[17:20:14.000583]: 0x007ff75d9d6e78 -> USER32.dll!EnumDisplayDevicesA (ord: 1759 hint: FC)
36m[17:20:14.000587]: 0x007ff75d9d6e80 -> USER32.dll!ShowCursor (ord: 2409 hint: 388)
36m[17:20:14.000589]: 0x007ff75d9d6e88 -> USER32.dll!InflateRect (ord: 2030 hint: 20A)
36m[17:20:14.000592]: 0x007ff75d9d6e90 -> USER32.dll!SetClassLongPtrW (ord: 2307 hint: 321)
36m[17:20:14.000594]: 0x007ff75d9d6e98 -> USER32.dll!GetWindowThreadProcessId (ord: 2013 hint: 1F8)
36m[17:20:14.000597]: 0x007ff75d9d6ea0 -> USER32.dll!SetWindowsHookExW (ord: 2406 hint: 385)
36m[17:20:14.000598]: 0x007ff75d9d6ea8 -> USER32.dll!CreateIconFromResource (ord: 1617 hint: 6C)
36m[17:20:14.000599]: 0x007ff75d9d6eb0 -> USER32.dll!GetMonitorInfoW (ord: 1902 hint: 18B)
36m[17:20:14.000602]: 0x007ff75d9d6eb8 -> USER32.dll!LoadCursorA (ord: 2104 hint: 255)
36m[17:20:14.000603]: 0x007ff75d9d6ec0 -> USER32.dll!GetClientRect (ord: 1814 hint: 133)
36m[17:20:14.000604]: 0x007ff75d9d6ec8 -> USER32.dll!GetActiveWindow (ord: 1789 hint: 11A)
36m[17:20:14.000605]: 0x007ff75d9d6ed0 -> USER32.dll!FlashWindowEx (ord: 1785 hint: 116)
36m[17:20:14.000608]: 0x007ff75d9d6ed8 -> USER32.dll!SetActiveWindow (ord: 2301 hint: 31B)
36m[17:20:14.000609]: 0x007ff75d9d6ee0 -> USER32.dll!GetForegroundWindow (ord: 1851 hint: 158)
36m[17:20:14.000611]: 0x007ff75d9d6ee8 -> USER32.dll!GetDC (ord: 1829 hint: 142)
36m[17:20:14.000613]: 0x007ff75d9d6ef0 -> USER32.dll!ReleaseDC (ord: 2271 hint: 2FC)
36m[17:20:14.000614]: 0x007ff75d9d6ef8 -> USER32.dll!EnumDisplaySettingsA (ord: 1762 hint: FF)
36m[17:20:14.000617]: 0x007ff75d9d6f00 -> USER32.dll!MonitorFromWindow (ord: 2164 hint: 291)
36m[17:20:14.000618]: 0x007ff75d9d6f08 -> USER32.dll!GetMonitorInfoA (ord: 1901 hint: 18A)
36m[17:20:14.000620]: 0x007ff75d9d6f10 -> USER32.dll!GetKeyboardLayout (ord: 1868 hint: 169)
36m[17:20:14.000623]: 0x007ff75d9d6f18 -> USER32.dll!RegisterClipboardFormatW (ord: 2244 hint: 2E1)
36m[17:20:14.000623]: 0x007ff75d9d6f20 -> USER32.dll!DefWindowProcW (ord: 1676 hint: A7) [forwarded]
36m[17:20:14.000626]: 0x007ff75d9d6f28 -> USER32.dll!MoveWindow (ord: 2165 hint: 292)
36m[17:20:14.000628]: 0x007ff75d9d6f30 -> USER32.dll!GetWindowPlacement (ord: 1999 hint: 1EE)
36m[17:20:14.000630]: 0x007ff75d9d6f38 -> USER32.dll!IsIconic (ord: 2073 hint: 235)
36m[17:20:14.000633]: 0x007ff75d9d6f40 -> USER32.dll!IsZoomed (ord: 2098 hint: 24F)
36m[17:20:14.000634]: 0x007ff75d9d6f48 -> USER32.dll!GetKeyState (ord: 1867 hint: 168)
36m[17:20:14.000635]: 0x007ff75d9d6f50 -> USER32.dll!GetAsyncKeyState (ord: 1796 hint: 121)
36m[17:20:14.000639]: 0x007ff75d9d6f58 -> USER32.dll!VkKeyScanA (ord: 2484 hint: 3D4)
36m[17:20:14.000642]: 0x007ff75d9d6f60 -> USER32.dll!SendInput (ord: 2292 hint: 312)
36m[17:20:14.000645]: 0x007ff75d9d6f68 -> USER32.dll!MapVirtualKeyA (ord: 2142 hint: 27B)
36m[17:20:14.000648]: 0x007ff75d9d6f70 -> USER32.dll!SetCapture (ord: 2302 hint: 31C)
36m[17:20:14.000651]: 0x007ff75d9d6f78 -> USER32.dll!ReleaseCapture (ord: 2270 hint: 2FB)
36m[17:20:14.000654]: 0x007ff75d9d6f80 -> USER32.dll!SetTimer (ord: 2380 hint: 36B)
36m[17:20:14.000656]: 0x007ff75d9d6f88 -> USER32.dll!KillTimer (ord: 2099 hint: 250)
36m[17:20:14.000656]: 0x007ff75d9d6f90 -> USER32.dll!AdjustWindowRectEx (ord: 1508 hint: 4)
36m[17:20:14.000658]: 0x007ff75d9d6f98 -> USER32.dll!GetClipCursor (ord: 1815 hint: 134)
36m[17:20:14.000658]: 0x007ff75d9d6fa0 -> USER32.dll!ClientToScreen (ord: 1586 hint: 4D)
36m[17:20:14.000660]: 0x007ff75d9d6fa8 -> USER32.dll!GetWindowLongA (ord: 1991 hint: 1E6)
36m[17:20:14.000663]: 0x007ff75d9d6fb0 -> USER32.dll!SetWindowsHookExA (ord: 2404 hint: 383)
36m[17:20:14.000667]: 0x007ff75d9d6fb8 -> USER32.dll!UnhookWindowsHookEx (ord: 2450 hint: 3B2)
36m[17:20:14.000667]: 0x007ff75d9d6fc0 -> USER32.dll!CallNextHookEx (ord: 1535 hint: 1F)
36m[17:20:14.000671]: 0x007ff75d9d6fc8 -> USER32.dll!SystemParametersInfoA (ord: 2428 hint: 39B)
36m[17:20:14.000673]: 0x007ff75d9d6fd0 -> USER32.dll!MonitorFromRect (ord: 2163 hint: 290)
36m[17:20:14.000675]: 0x007ff75d9d6fd8 -> USER32.dll!GetRawInputData (ord: 1941 hint: 1B4)
36m[17:20:14.000677]: 0x007ff75d9d6fe0 -> USER32.dll!GetRawInputDeviceInfoA (ord: 1942 hint: 1B5)
36m[17:20:14.000680]: 0x007ff75d9d6fe8 -> USER32.dll!RegisterRawInputDevices (ord: 2258 hint: 2EF)
36m[17:20:14.000681]: 0x007ff75d9d6ff0 -> USER32.dll!GetRawInputDeviceList (ord: 1944 hint: 1B7)
36m[17:20:14.000682]: 0x007ff75d9d6ff8 -> USER32.dll!CharNextW (ord: 1561 hint: 34)
36m[17:20:14.000685]: 0x007ff75d9d7000 -> USER32.dll!RegisterPowerSettingNotification (ord: 2257 hint: 2EE)
36m[17:20:14.000688]: 0x007ff75d9d7008 -> USER32.dll!UnregisterPowerSettingNotification (ord: 2462 hint: 3BE)
36m[17:20:14.000691]: 0x007ff75d9d7010 -> USER32.dll!RegisterClassExW (ord: 2241 hint: 2DE)
36m[17:20:14.000692]: 0x007ff75d9d7018 -> USER32.dll!CreateWindowExW (ord: 1627 hint: 76)
36m[17:20:14.000693]: 0x007ff75d9d7020 -> USER32.dll!GetFocus (ord: 1850 hint: 157)
36m[17:20:14.000693]: 0x007ff75d9d7028 -> USER32.dll!BeginPaint (ord: 1521 hint: 11)
36m[17:20:14.000694]: 0x007ff75d9d7030 -> USER32.dll!EndPaint (ord: 1751 hint: F4)
36m[17:20:14.000697]: 0x007ff75d9d7038 -> USER32.dll!ScreenToClient (ord: 2283 hint: 309)
36m[17:20:14.000698]: 0x007ff75d9d7040 -> USER32.dll!ClipCursor (ord: 1587 hint: 4E)
36m[17:20:14.000700]: 0x007ff75d9d7048 -> USER32.dll!PtInRect (ord: 2204 hint: 2B9)
36m[17:20:14.000704]: 0x007ff75d9d7050 -> USER32.dll!SetWindowLongPtrA (ord: 2392 hint: 377)
36m[17:20:14.000706]: 0x007ff75d9d7058 -> USER32.dll!LoadImageA (ord: 2110 hint: 25B)
36m[17:20:14.000707]: 0x007ff75d9d7060 -> USER32.dll!CreateIconIndirect (ord: 1619 hint: 6E)
36m[17:20:14.000707]: 0x007ff75d9d7068 -> USER32.dll!CharLowerBuffA (ord: 1556 hint: 2F)
36m[17:20:14.000710]: 0x007ff75d9d7070 -> USER32.dll!UnregisterClassA (ord: 2455 hint: 3B7)
36m[17:20:14.000713]: 0x007ff75d9d7078 -> USER32.dll!PostMessageA (ord: 2193 hint: 2AE)
36m[17:20:14.000713]: 0x007ff75d9d7080 -> USER32.dll!CallWindowProcW (ord: 1537 hint: 21)
36m[17:20:14.000716]: 0x007ff75d9d7088 -> USER32.dll!RegisterDeviceNotificationA (ord: 2246 hint: 2E3)
36m[17:20:14.000720]: 0x007ff75d9d7090 -> USER32.dll!UnregisterDeviceNotification (ord: 2457 hint: 3B9)
36m[17:20:14.000723]: 0x007ff75d9d7098 -> USER32.dll!PostThreadMessageW (ord: 2197 hint: 2B2)
36m[17:20:14.000726]: 0x007ff75d9d70a0 -> USER32.dll!UnregisterClassW (ord: 2456 hint: 3B8)
36m[17:20:14.000726]: 0x007ff75d9d70a8 -> USER32.dll!AttachThreadInput (ord: 1519 hint: F)
36m[17:20:14.000729]: 0x007ff75d9d70b0 -> USER32.dll!RegisterClassW (ord: 2242 hint: 2DF)
36m[17:20:14.000733]: 0x007ff75d9d70b8 -> USER32.dll!SetLayeredWindowAttributes (ord: 2335 hint: 33E)
36m[17:20:14.000734]: 0x007ff75d9d70c0 -> USER32.dll!GetKeyboardState (ord: 1872 hint: 16D)
36m[17:20:14.000736]: 0x007ff75d9d70c8 -> USER32.dll!GetMenu (ord: 1882 hint: 177)
36m[17:20:14.000739]: 0x007ff75d9d70d0 -> USER32.dll!SetForegroundWindow (ord: 2329 hint: 338)
36m[17:20:14.000742]: 0x007ff75d9d70d8 -> USER32.dll!SetPropW (ord: 2362 hint: 359)
36m[17:20:14.000745]: 0x007ff75d9d70e0 -> USER32.dll!RemovePropW (ord: 2277 hint: 302)
36m[17:20:14.000747]: 0x007ff75d9d70e8 -> USER32.dll!GetWindowTextLengthW (ord: 2011 hint: 1F6)
36m[17:20:14.000750]: 0x007ff75d9d70f0 -> USER32.dll!RegisterClassExA (ord: 2240 hint: 2DD)
36m[17:20:14.000750]: 0x007ff75d9d7100 -> VERSION.dll!GetFileVersionInfoA (ord: 1 hint: 0)
36m[17:20:14.000750]: 0x007ff75d9d7108 -> VERSION.dll!GetFileVersionInfoSizeA (ord: 5 hint: 4)
36m[17:20:14.000750]: 0x007ff75d9d7110 -> VERSION.dll!VerQueryValueA (ord: 16 hint: F)
36m[17:20:14.000751]: 0x007ff75d9d7120 -> WINHTTP.dll!WinHttpOpen (ord: 41 hint: 26)
36m[17:20:14.000751]: 0x007ff75d9d7128 -> WINHTTP.dll!WinHttpGetDefaultProxyConfiguration (ord: 31 hint: 1C)
36m[17:20:14.000751]: 0x007ff75d9d7130 -> WINHTTP.dll!WinHttpCrackUrl (ord: 24 hint: 15)
36m[17:20:14.000751]: 0x007ff75d9d7138 -> WINHTTP.dll!WinHttpGetProxyForUrl (ord: 33 hint: 1E)
36m[17:20:14.000751]: 0x007ff75d9d7140 -> WINHTTP.dll!WinHttpGetIEProxyConfigForCurrentUser (ord: 32 hint: 1D)
36m[17:20:14.000751]: 0x007ff75d9d7148 -> WINHTTP.dll!WinHttpCloseHandle (ord: 11 hint: 8)
36m[17:20:14.000752]: 0x007ff75d9d7158 -> WINMM.dll!timeBeginPeriod (ord: 137 hint: 86)
36m[17:20:14.000752]: 0x007ff75d9d7160 -> WINMM.dll!timeEndPeriod (ord: 138 hint: 87)
36m[17:20:14.000753]: 0x007ff75d9d7168 -> WINMM.dll!waveInReset (ord: 156 hint: 99)
36m[17:20:14.000754]: 0x007ff75d9d7170 -> WINMM.dll!waveInStart (ord: 157 hint: 9A)
36m[17:20:14.000754]: 0x007ff75d9d7178 -> WINMM.dll!waveInAddBuffer (ord: 144 hint: 8D)
36m[17:20:14.000755]: 0x007ff75d9d7180 -> WINMM.dll!waveInUnprepareHeader (ord: 159 hint: 9C)
36m[17:20:14.000755]: 0x007ff75d9d7188 -> WINMM.dll!waveInPrepareHeader (ord: 155 hint: 98)
36m[17:20:14.000756]: 0x007ff75d9d7190 -> WINMM.dll!waveInClose (ord: 145 hint: 8E)
36m[17:20:14.000757]: 0x007ff75d9d7198 -> WINMM.dll!waveInOpen (ord: 154 hint: 97)
36m[17:20:14.000757]: 0x007ff75d9d71a0 -> WINMM.dll!waveInGetDevCapsW (ord: 147 hint: 90)
36m[17:20:14.000758]: 0x007ff75d9d71a8 -> WINMM.dll!waveInGetDevCapsA (ord: 146 hint: 8F)
36m[17:20:14.000759]: 0x007ff75d9d71b0 -> WINMM.dll!waveOutGetPosition (ord: 170 hint: A7)
36m[17:20:14.000759]: 0x007ff75d9d71b8 -> WINMM.dll!waveOutReset (ord: 176 hint: AD)
36m[17:20:14.000760]: 0x007ff75d9d71c0 -> WINMM.dll!waveOutWrite (ord: 182 hint: B3)
36m[17:20:14.000761]: 0x007ff75d9d71c8 -> WINMM.dll!waveOutUnprepareHeader (ord: 181 hint: B2)
36m[17:20:14.000761]: 0x007ff75d9d71d0 -> WINMM.dll!waveOutPrepareHeader (ord: 175 hint: AC)
36m[17:20:14.000762]: 0x007ff75d9d71d8 -> WINMM.dll!waveOutClose (ord: 161 hint: 9E)
36m[17:20:14.000763]: 0x007ff75d9d71e0 -> WINMM.dll!waveOutOpen (ord: 173 hint: AA)
36m[17:20:14.000763]: 0x007ff75d9d71e8 -> WINMM.dll!waveOutGetDevCapsW (ord: 163 hint: A0)
36m[17:20:14.000764]: 0x007ff75d9d71f0 -> WINMM.dll!waveOutGetDevCapsA (ord: 162 hint: 9F)
36m[17:20:14.000765]: 0x007ff75d9d71f8 -> WINMM.dll!waveInGetNumDevs (ord: 151 hint: 94)
36m[17:20:14.000765]: 0x007ff75d9d7200 -> WINMM.dll!waveOutGetNumDevs (ord: 167 hint: A4)
36m[17:20:14.000766]: 0x007ff75d9d7208 -> WINMM.dll!timeGetTime (ord: 141 hint: 8A)
36m[17:20:14.000767]: 0x007ff75d9d7218 -> WS2_32.dll!socket (ord: 23 hint: C2)
36m[17:20:14.000767]: 0x007ff75d9d7220 -> WS2_32.dll!gethostname (ord: 57 hint: A8)
36m[17:20:14.000768]: 0x007ff75d9d7228 -> WS2_32.dll!WSASetLastError (ord: 112 hint: 53)
36m[17:20:14.000768]: 0x007ff75d9d7230 -> WS2_32.dll!WSADuplicateSocketW (ord: 59 hint: 26)
36m[17:20:14.000768]: 0x007ff75d9d7238 -> WS2_32.dll!WSAIoctl (ord: 78 hint: 3A)
36m[17:20:14.000768]: 0x007ff75d9d7240 -> WS2_32.dll!WSASend (ord: 96 hint: 4D)
36m[17:20:14.000769]: 0x007ff75d9d7248 -> WS2_32.dll!WSASocketW (ord: 120 hint: 57)
36m[17:20:14.000769]: 0x007ff75d9d7250 -> WS2_32.dll!WSAAddressToStringA (ord: 42 hint: 12)
36m[17:20:14.000770]: 0x007ff75d9d7258 -> WS2_32.dll!setsockopt (ord: 21 hint: C0)
36m[17:20:14.000770]: 0x007ff75d9d7260 -> WS2_32.dll!FreeAddrInfoW (ord: 27 hint: 2)
36m[17:20:14.000770]: 0x007ff75d9d7268 -> WS2_32.dll!WSAStartup (ord: 115 hint: 58)
36m[17:20:14.000771]: 0x007ff75d9d7270 -> WS2_32.dll!send (ord: 19 hint: BE)
36m[17:20:14.000772]: 0x007ff75d9d7278 -> WS2_32.dll!select (ord: 18 hint: BD)
36m[17:20:14.000772]: 0x007ff75d9d7280 -> WS2_32.dll!recv (ord: 16 hint: BB)
36m[17:20:14.000773]: 0x007ff75d9d7288 -> WS2_32.dll!listen (ord: 13 hint: B8)
36m[17:20:14.000774]: 0x007ff75d9d7290 -> WS2_32.dll!getsockopt (ord: 7 hint: B0)
36m[17:20:14.000774]: 0x007ff75d9d7298 -> WS2_32.dll!WSAGetLastError (ord: 111 hint: 2F)
36m[17:20:14.000775]: 0x007ff75d9d72a0 -> WS2_32.dll!getsockname (ord: 6 hint: AF)
36m[17:20:14.000775]: 0x007ff75d9d72a8 -> WS2_32.dll!getpeername (ord: 5 hint: AA)
36m[17:20:14.000776]: 0x007ff75d9d72b0 -> WS2_32.dll!ioctlsocket (ord: 10 hint: B7)
36m[17:20:14.000777]: 0x007ff75d9d72b8 -> WS2_32.dll!connect (ord: 4 hint: A3)
36m[17:20:14.000777]: 0x007ff75d9d72c0 -> WS2_32.dll!closesocket (ord: 3 hint: A2)
36m[17:20:14.000778]: 0x007ff75d9d72c8 -> WS2_32.dll!bind (ord: 2 hint: A1)
36m[17:20:14.000779]: 0x007ff75d9d72d0 -> WS2_32.dll!accept (ord: 1 hint: A0)
36m[17:20:14.000779]: 0x007ff75d9d72d8 -> WS2_32.dll!__WSAFDIsSet (ord: 151 hint: 9F)
36m[17:20:14.000780]: 0x007ff75d9d72e0 -> WS2_32.dll!htons (ord: 9 hint: B2)
36m[17:20:14.000781]: 0x007ff75d9d72e8 -> WS2_32.dll!htonl (ord: 8 hint: B1)
36m[17:20:14.000782]: 0x007ff75d9d72f0 -> WS2_32.dll!htons (ord: 9 hint: B2)
36m[17:20:14.000782]: 0x007ff75d9d72f8 -> WS2_32.dll!htonl (ord: 8 hint: B1)
36m[17:20:14.000783]: 0x007ff75d9d7300 -> WS2_32.dll!inet_pton (ord: 194 hint: B6)
36m[17:20:14.000783]: 0x007ff75d9d7308 -> WS2_32.dll!WSACancelAsyncRequest (ord: 108 hint: 1C)
36m[17:20:14.000783]: 0x007ff75d9d7310 -> WS2_32.dll!WSAAsyncGetHostByName (ord: 103 hint: 16)
36m[17:20:14.000784]: 0x007ff75d9d7318 -> WS2_32.dll!WSACleanup (ord: 116 hint: 1E)
36m[17:20:14.000784]: 0x007ff75d9d7320 -> WS2_32.dll!inet_addr (ord: 11 hint: B3)
36m[17:20:14.000785]: 0x007ff75d9d7328 -> WS2_32.dll!inet_ntoa (ord: 12 hint: B4)
36m[17:20:14.000786]: 0x007ff75d9d7330 -> WS2_32.dll!inet_ntop (ord: 193 hint: B5)
36m[17:20:14.000786]: 0x007ff75d9d7338 -> WS2_32.dll!getaddrinfo (ord: 191 hint: A5)
36m[17:20:14.000787]: 0x007ff75d9d7348 -> bcrypt.dll!BCryptGenRandom (ord: 30 hint: 1D)
36m[17:20:14.000787]: 0x007ff75d9d7358 -> dwmapi.dll!DwmGetCompositionTimingInfo (ord: 125 hint: B)
36m[17:20:14.000787]: 0x007ff75d9d7368 -> combase.dll!CoCreateInstance (ord: 253 hint: 2E)
36m[17:20:14.000787]: 0x007ff75d9d7370 -> combase.dll!CoInitializeEx (ord: 297 hint: 5A)
36m[17:20:14.000788]: 0x007ff75d9d7378 -> combase.dll!CoUninitialize (ord: 343 hint: 88)
36m[17:20:14.000788]: 0x007ff75d9d7380 -> combase.dll!CoTaskMemFree (ord: 340 hint: 85)
36m[17:20:14.000792]: 0x007ff75d9d7388 -> ole32.dll!CoInitialize (ord: 927 hint: 60)
36m[17:20:14.000795]: 0x007ff75d9d7390 -> ole32.dll!PropVariantClear (ord: 1280 hint: 1CF)
36m[17:20:14.000795]: 0x007ff75d9d7398 -> ole32.dll!CLSIDFromString (ord: 848 hint: 10) [forwarded]
36m[17:20:14.000797]: 0x007ff75d9d73a0 -> ole32.dll!CoTaskMemAlloc (ord: 970 hint: 8B) [forwarded]
36m[17:20:14.000798]: 0x007ff75d9d73a8 -> ole32.dll!CoInitializeSecurity (ord: 929 hint: 62) [forwarded]
36m[17:20:14.000800]: 0x007ff75d9d73b0 -> ole32.dll!CoSetProxyBlanket (ord: 966 hint: 87) [forwarded]
36m[17:20:14.000800]: Wrote import directory data for 614 functions from 19 modules
36m[17:20:14.000863]: Creating dump C:\Debug\WowClassic_1.14.4.51535.exe
36m[17:20:14.000924]: Wrote section headers to disk: 0x400 total bytes
36m[17:20:14.000957]: Wrote section .text to disk: 0x22f5400 total bytes
36m[17:20:14.000959]: Wrote section .rdata to disk: 0x2927600 total bytes
36m[17:20:14.000960]: Wrote section .data to disk: 0x2a79c00 total bytes
36m[17:20:14.000961]: Wrote section .pdata to disk: 0x2c22a00 total bytes
36m[17:20:14.000961]: Wrote section _RDATA to disk: 0x2c44a00 total bytes
36m[17:20:14.000961]: Wrote section .rsrc to disk: 0x2c99a00 total bytes
36m[17:20:14.000961]: Wrote section .reloc to disk: 0x2cd2600 total bytes
36m[17:20:14.000961]: Wrote section .import to disk: 0x2cd4000 total bytes
32m[17:20:14.000961]: Successfully created C:\Debug\WowClassic_1.14.4.51535.exe!

Am I supposed to find the object manager with the information provided above?
Or do I need to go further?
I noticed that it created a file named: C:\Debug\WowClassic_1.14.4.51535.exe.
Am I supposed to do something with this new .exe? Open it with IDA Pro?

[scizzydo]

Yes, now you have to use IDA (or some tool similar). That just produced a binary for you to work with

[scizzydo]

Pattern to classic object manager: 4C 8B ? ? ? ? ? 45 33 FF 33 F6 33 ED

It's the same layout as retail. 0x120 for the first curmgr object (or 0x130 if only going for unit/player)

[wulfcare]

Do you have any tips for bypassing the anti debug in wow classic?

[empathe]

Pattern to classic object manager: 4C 8B ? ? ? ? ? 45 33 FF 33 F6 33 ED

It's the same layout as retail. 0x120 for the first curmgr object (or 0x130 if only going for unit/player)

Thank you for the pattern, but I'm trying to figure everything out by myself with your explanations. I don't think I'm far off because in my opinion, I now have the switch for the object manager.
switch.PNG

[empathe]

Do you have any tips for bypassing the anti debug in wow classic?

I'm not there yet at the moment, but back then I used Cheat Engine which I had recompiled, removing all the markers where it said "cheat", changing the icon, and when I linked to the process, I used the VDBM driver integrated into Cheat Engine. I haven't tried it again since. Which software do you use?

[wulfcare]

x64dbg and Cheat engine. I have removed all the strings containing cheat engine and changed the icon. As soon as i try and attach any debugger even with scyllahide it just instantly crashes.

[namreeb]

x64dbg and Cheat engine. I have removed all the strings containing cheat engine and changed the icon. As soon as i try and attach any debugger even with scyllahide it just instantly crashes.

It's crashing because there is a thread with the THREAD_INFORMATION_CLASS::ThreadHideFromDebugger flag. When the debugger calls CreateRemoteThread(), the TLS callbacks are called in that hidden thread, which detect the debugger. There may be other mechanisms, but I believe this is the main one. I haven't tried defeating this, but one thing you might try is suspending all threads, clearing the TLS callbacks, creating your thread, restoring the TLS callbacks, and then resuming any threads you had suspended.

[wulfcare]

Thanks namreeb, this is exactly what I needed

[empathe]

Thanks namreeb, this is exactly what I needed

Maybe something like this:

#include <Windows.h>
#include <TlHelp32.h>
#include <iostream>

void SuspendAllThreads(DWORD processId)
{
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);//maybe need to change for 64bits don't know atm
    if (hSnapshot != INVALID_HANDLE_VALUE)
    {
        THREADENTRY32 te;
        te.dwSize = sizeof(THREADENTRY32);
        if (Thread32First(hSnapshot, &te))
        {
            do
            {
                if (te.th32OwnerProcessID == processId)
                {
                    HANDLE hThread = OpenThread(THREAD_SUSPEND_RESUME, FALSE, te.th32ThreadID);
                    if (hThread)
                    {
                        SuspendThread(hThread);
                        CloseHandle(hThread);
                    }
                }
            } while (Thread32Next(hSnapshot, &te));
        }
        CloseHandle(hSnapshot);
    }
}

DWORD ClearTLSCallbacks(HANDLE processHandle, LPVOID baseAddress)
{
    IMAGE_DOS_HEADER dosHeader;
    IMAGE_NT_HEADERS ntHeaders;

    // Read IMAGE_DOS
    ReadProcessMemory(processHandle, baseAddress, &dosHeader, sizeof(dosHeader), nullptr);

    // Read IMAGE_NT
    ReadProcessMemory(processHandle, (LPBYTE)baseAddress + dosHeader.e_lfanew, &ntHeaders, sizeof(ntHeaders), nullptr);

    // Save TLS  values
    DWORD originalTLSCallbacksAddress = ntHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress;
    
    // Nullify
    ntHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress = 0;
    ntHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].Size = 0;
    
    // Write the modified back
    WriteProcessMemory(processHandle, (LPBYTE)baseAddress + dosHeader.e_lfanew, &ntHeaders, sizeof(ntHeaders), nullptr);

    return originalTLSCallbacksAddress;
}

void RestoreTLSCallbacks(HANDLE processHandle, LPVOID baseAddress, DWORD originalTLSCallbacksAddress)
{
    IMAGE_DOS_HEADER dosHeader;
    IMAGE_NT_HEADERS ntHeaders;

    // Read IMAGE_DOS
    ReadProcessMemory(processHandle, baseAddress, &dosHeader, sizeof(dosHeader), nullptr);

    // Read IMAGE_NT
    ReadProcessMemory(processHandle, (LPBYTE)baseAddress + dosHeader.e_lfanew, &ntHeaders, sizeof(ntHeaders), nullptr);

    // Restore  saved values
    ntHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress = originalTLSCallbacksAddress;
    
    // Write back into memory
    WriteProcessMemory(processHandle, (LPBYTE)baseAddress + dosHeader.e_lfanew, &ntHeaders, sizeof(ntHeaders), nullptr);
}

int main()
{
    DWORD processId = ...; // replace with actual process ID
    HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId); // i think need debug privilege 
    LPVOID baseAddress = ...; // replace with actual process/module
    
    SuspendAllThreads(processId);
    
    DWORD originalTLSCallbacksAddress = ClearTLSCallbacks(processHandle, baseAddress);

    Sleep(5000);
    //SLEEP HERE & ATTACH

    RestoreTLSCallbacks(processHandle, baseAddress, originalTLSCallbacksAddress);
    CloseHandle(processHandle);
    return 0;
}

if you found the exactly way, can you share this please thanks.

[qop1832]

1.14.4.51535

MouseoverGUID > 0x2e433b0
PetGUID > 0x2e44980
PlayerGUID > 0x2d2d170
TargetGUID > 0x2af3bb8
LastTargetGUID > 0x2af3bc8
LastEnemyGuid > 0x2af3bd8
LastFriendlyGuid > 0x2af3be8
FocusGUID > 0x2af3bf8
DialogWindowOwnerGuid > 0x2af3c08
BagGuid > 0x2e466a0
GameStatus > 0x2e4334c
PlayerName > 0x2d2d188
CorpsePosition > 0x2982470
LastError > 0x2e42690
LootWindow > 0x2e44b18
Chat_Open > 0x2cfa644
Chat_Base > 0x2de3e70
KeyBinding_Base > 0x2d2c398
SpellBook_player_count > 0x2e43810
SpellBook_player_Base > 0x2e43818
SpellBook_Pet_count > 0x2e43830
SpellBook_Pet_Base > 0x2e43838
ZoneID > 0x2e4268c
SubZoneID > 0x2e43248
ZoneName > 0x2e425e8
SubZoneName > 0x2e425f0
Indoors > 0x2d75f05
ObjectManager_Base > 0x2de3a70
CoolDown_Base > 0x2d7d410
Macro_Base > 0x298bde8
MoveControl > 0x29678e5
FrameBase > 0x2af0fa8
GetTime > 0x2af37c0
CorpseMapID > 0x2a805b8
GetRuneCooldown > 0x2e60298
GetCurrency > 0x298d4a0
getAllCvars > 0x292cef0
CombatLog > 0x297c8d0

    "MouseoverGUID": build_dump("48 39 0D ?? ?? ?? ?? 75 33 48 8B 43", 3),
    "PetGUID":build_dump ("48 8B 05 ?? ?? ?? ?? 33 DB 45 8B",3), # OK
    "PlayerGUID": build_dump("48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 BC 24 ?? ?? ?? ?? ?? 7C ?? 48 8B 8C 24 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 45 33 C9 45 8D 41 ?? E8 ?? ?? ?? ?? 48 81 C4",3),
    "TargetGUID": build_dump("48 39 05 ?? ?? ?? ?? 48 8B F9 75 0D 48 8B 42",3),
    "LastTargetGUID":build_dump("48 39 05 ?? ?? ?? ?? 48 8B F9 75 0D 48 8B 42", 3, + 0x10),
    "LastEnemyGuid":build_dump("48 39 05 ?? ?? ?? ?? 48 8B F9 75 0D 48 8B 42",3, + 0x20),
    "LastFriendlyGuid":build_dump("48 39 05 ?? ?? ?? ?? 48 8B F9 75 0D 48 8B 42",3, + 0x30),
    "FocusGUID":build_dump( "48 39 05 ?? ?? ?? ?? 48 8B F9 75 0D 48 8B 42",3, + 0x40),
    "DialogWindowOwnerGuid": build_dump( "48 39 05 ?? ?? ?? ?? 48 8B F9 75 0D 48 8B 42",3, + 0x50),
    "BagGuid": build_dump("48 8D 0D ?? ?? ?? ?? 48 03 C0 0F 10 04 C1 0F 11 44 24 40", 3), # ok
    "GameStatus": build_dump( "0F B6 05 ?? ?? ?? ?? B9 ?? ?? ?? ?? FF",3),
    "PlayerName": build_dump( "E8 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 8B D8 E8 ?? ?? ?? ?? 4C 89 74 24",1, 0, 5),
    "CorpsePosition": build_dump("8B 05 ?? ?? ?? ?? 89 06 8B 05 ?? ?? ?? ?? 89 07 B0 ??",2, 0x40),
    "LastError": build_dump( "48 8D 0D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 0F 1F 40 ??", 3),
    "LootWindow": build_dump( "0F B6 15 ?? ?? ?? ?? 48 3B C1 0F 42 C8 E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ??", 3),
    "Chat_Open": build_dump( "44 39 25 ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? 33 D2 45 33 C9", 3),
    "Chat_Base": build_dump( "48 8D 15 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 80 BA ?? ?? ?? ?? ?? 74 ?? 8B 01 39 82 ?? ?? ?? ?? 74 ?? 48 81 C2 ?? ?? ?? ?? 49 3B D0 75 ?? 32 C0", 3),
    "KeyBinding_Base":build_dump("48 8B 0D ?? ?? ?? ?? 33 DB 89 1D ?? ?? ?? ?? F6",3,0x50),
    "SpellBook_player_count":build_dump( "48 8D 0D ?? ?? ?? ?? 0F B6 D0",3),  # 做个笔记   法术书搜索  Getspellbookit or GetSpellBookItemTexture
    "SpellBook_player_Base": build_dump( "48 8D 0D ?? ?? ?? ?? 0F B6 D0",3, 0x8),
    "SpellBook_Pet_count": build_dump("4C 8B 0D ?? ?? ?? ?? 90 49 8B 0C D1 8B 41", 3,-8),
    "SpellBook_Pet_Base": build_dump( "4C 8B 0D ?? ?? ?? ?? 90 49 8B 0C D1 8B 41",3),
    "ZoneID": build_dump( "44 8B 25 ?? ?? ?? ?? 46 89 A4 0A ?? ?? ?? ?? 41 8B 87 ?? ?? ?? ?? C1 E8 ?? 24", 3),
    "SubZoneID": build_dump( "74 33 8B 15 ?? ?? ?? ?? 4C 8D 8C 24 ?? ?? ?? ?? 45 33 C0 48 8D 0D ?? ?? ?? ?? E8",4),
    "ZoneName": build_dump( "C3 CC CC CC 48 83 EC ?? 48 8B 05 ?? ?? ?? ?? 48 8D 15", 11),
    "SubZoneName": build_dump( "C3 CC CC CC 48 83 EC ?? 48 8B 05 ?? ?? ?? ?? 48 8D 15",11,8),
    "Indoors": build_dump( "44 0F B6 0D ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 45 84 C9", 4),
    "ObjectManager_Base":build_dump("48 8B 1D ?? ?? ?? ?? 48 85 DB 74 ?? 80 3D ?? ?? ?? ?? ?? 74 ?? 48 8D 0D",3),
    "CoolDown_Base": build_dump("48 8D 15 ?? ?? ?? ?? 48 1B C9 81 E1 ?? ?? ?? ?? 48 03 CA 8B 53 ??",3),
    "Macro_Base": build_dump( "48 83 EC ?? 48 8B 05 ?? ?? ?? ?? 33 F6 A8 ?? ?? ?? 8B D6",7),
    "MoveControl": build_dump( "8B 3D ?? ?? ?? ?? 33 C9 C1",2,1),
    "FrameBase": build_dump( "48 8B 0D ?? ?? ?? ?? 48 8B D3 84 C0 74 0A",3),
    "GetTime": build_dump("4C 89 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C9 89 4D", 3,+0x188),
    "CorpseMapID": build_dump("4d 85 c0 ?? ?? 48 8d 0d ?? ?? ?? ?? e8 ?? ?? ?? ?? e9 ?? ?? ?? ?? 48 b9", 8),
    "GetRuneCooldown": build_dump("48 8D 0D ?? ?? ?? ?? 8B 04 81 C3 CC CC 48 63 C1 48 8D 0D ?? ?? ?? ?? 0F B6 04 08 C3",3),
    "GetCurrency": build_dump("48 8B 0D ?? ?? ?? ?? 8B D0 F6 C1 ?? 75 ?? 48 85 C9 74 ?? 45 33 C0",3),# 下一个 0x8 , 类型 0x10 ，数量 0x14
    "getAllCvars":build_dump("48 83 EC ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 48 8B 3D ?? ?? ?? ?? 48 8B 0D",0x13),
    "CombatLog": build_dump("48 8B 15 ?? ?? ?? ?? 33 DB 4C 63 C0 F6 C2",3)