VM Reference
Address    Reference to VM                   Description                                                       Status
010013C0   JMP 01636523                      Function is coded VM                                              Postponed
0100188A   CALL 014EF81C                     USER32.GetDlgItemTextW                                            Done
0100197E   CALL 016067E9                     USER32.GetDlgItemTextW                                            Done
01001AA7   CALL 0184A06A                     USER32.SetDlgItemTextW                                            Done
01001D3D   CALL 016A4F1C                     USER32.SetDlgItemTextW                                            Done
01001D67   CALL 016EEC15                     USER32.GetDlgItem                                                 Done
01001D86   CALL 0162CC46                     USER32.IsDlgButtonChecked                                         Done
01001D95   CALL 015B548E                     USER32.GetDlgItem                                                 Done
01001DE4   CALL 015747AF                     USER32.PostMessageW                                               Done
01001E0B   CALL 015BD5C2                     USER32.GetDlgItem                                                 Done
01001FA3   CALL 0151C500                     USER32.IsDlgButtonChecked                                         Done
0100239B   CALL 017D5B65                     USER32.GetDlgItemTextW                                            Done
010024BD   CALL 017B659B                     USER32.IsDlgButtonChecked                                         Done
010024C3   CALL 0164A4A0                     USER32.GetDlgItem                                                 Done
0100256F   CALL 0152A15E                     USER32.SetDlgItemTextW                                            Done
010025F6   CALL 01722D91                     USER32.GetDlgItemInt                                              Done
01002659   CALL 01715395                     USER32.GetDlgItemTextW                                            Done
01002723   CALL 01787520                     USER32.SetDlgItemTextW                                            Done
01002A8A   CALL 014B4BF0                     USER32.GetWindowLongW                                             Done
01002B30   JMP 0157FD0A                      Function is coded VM                                              Postponed
01002B3E   JMP 014EC41C                      Function is coded VM                                              Postponed
01002B49   CALL 0164B3E0                     USER32.MessageBoxW                                                Done
01002B85   CALL 018592C0                     USER32.SetWindowLongW                                             Done
01002D1C   CALL 0181F373                     USER32.SetDlgItemTextW                                            Done
01002E17   CALL 017359A2                     Function is coded VM                                              Postponed
01002E31   CALL 0166554B                     USER32.GetDlgItem                                                 Done
01002E76   CALL 015BC4E8                     USER32.PostMessageW                                               Done
01002EAE   CALL 01656EC8                     USER32.SetWindowLongW                                             Done
01002F16   CALL 01561B4A                     USER32.GetWindowLongW                                             Done
01002FD9   CALL 01654D5B                     kernel32.GetDriveTypeW                                            Done
01002FF1   JMP 018588F1                      Function is coded VM                                              Postponed
01002FF8   CALL 016B0381                     USER32.MessageBoxW                                                Done
01003024   CALL 017AC894                     USER32.SetWindowLongW                                             Done
01003036   CALL 017B553F                     USER32.SetDlgItemTextW                                            Done
01003090   CALL 01703A8C                     USER32.GetDlgItem                                                 Done
010030FE   CALL 015265BD                     USER32.SetDlgItemTextW                                            Done
01003138   CALL 0157BDA4                     USER32.SetDlgItemTextW                                            Done
0100318D   CALL 01532164                     USER32.SetDlgItemTextW                                            Done
010031C7   CALL 0179E563                     USER32.SetDlgItemTextW                                            Done
010031FF   CALL 017CA8D5                     ADVAPI32.RegOpenKeyExW                                            Done
0100321D   CALL 017D0D17                     ADVAPI32.RegQueryValueExW                                         Done
010032C0   CALL 0171F179                     USER32.SetDlgItemTextW                                            Done
01003397   CALL 016CDC5A                     USER32.CheckDlgButton                                             Done
010033D1   CALL 01516021                     USER32.CheckDlgButton                                             Done
01003446   CALL 017966B0                     USER32.SetWindowLongW                                             Done
0100346F   CALL 018168A3                     USER32.SetWindowLongW                                             Done
01003491   CALL 0154468F                     USER32.IsDlgButtonChecked                                         Done
010034B1   CALL 0182183D                     USER32.SetWindowLongW                                             Done
010034F5   CALL 016C1010                     USER32.SetWindowLongW                                             Done
01003517   CALL 015B7364                     USER32.IsDlgButtonChecked                                         Done
0100355F   CALL 01843DC8                     USER32.PostMessageW                                               Done
0100356D   CALL 016AEEA1                     USER32.IsDlgButtonChecked                                         Done
0100361B   CALL 01529ED0                     USER32.IsDlgButtonChecked                                         Done
01003696   CALL 014B5886                     USER32.IsDlgButtonChecked                                         Done
010036C3   CALL 01801247                     USER32.SetWindowLongW                                             Done
010036FB   CALL 016163DA                     USER32.SetWindowLongW                                             Done
010037E0   JMP 0176DA35                      Function is coded VM                                              Postponed
01003840   CALL 014AD4E0                     False code VM entry point                                         Cancelled
01003915   CALL 014AF766                     False code VM entry point                                         Cancelled
0100394F   JMP 014B15D1                      False code VM entry point                                         Cancelled
01003976   JMP 014ACAD0                      False code VM entry point                                         Cancelled
01003984   JMP 014AD59C                      False code VM entry point                                         Cancelled
010039A7   CALL 014B04D2                     False code VM entry point                                         Cancelled
01003A0A   JMP 014F7FDC                      Function is coded VM                                              Postponed
01003A14   CALL 0166AF05                     USER32.GetFocus                                                   Done
01003A1B   CALL 015F7D5B                     USER32.MessageBoxW                                                Done
01003A36   JMP 0152E98D                      Function is coded VM                                              Postponed
01003A3C   CALL 01589CC5                     USER32.GetFocus                                                   Done
01003A43   CALL 015D330F                     USER32.MessageBoxW                                                Done
01003AA6   CALL 0185ED16                     USER32.GetWindowLongW                                             Done
01003AFB   CALL 0173124C                     USER32.GetDlgItemInt                                              Done
01003B48   CALL 014E450C                     USER32.SetDlgItemInt                                              Done
01003B53   CALL 017150FA                     USER32.GetDlgItemInt                                              Done
01003BA0   CALL 014F41E6                     USER32.SetDlgItemInt                                              Done
01003BA8   CALL 018096CA                     USER32.GetDlgItem                                                 Done
01003BB7   CALL 018989B4                     USER32.GetWindowTextLengthW                                       Done
01003BE5   CALL 01678392                     USER32.SetDlgItemInt                                              Done
01003C62   CALL 01744AFC                     USER32.SetWindowLongW                                             Done
01003C68   CALL 0168A7FE                     USER32.GetDlgItem                                                 Done
01003C82   CALL 015E4F4B                     COMCTL32.CreateUpDownControl                                      Done
01003CE1   CALL 014E2EFF                     USER32.CheckDlgButton                                             Done
01003E7D   CALL 017D4F95                     USER32.SetDlgItemTextW                                            Done
01004065   CALL 0183CF8F                     USER32.PostMessageW                                               Done
0100408E   JMP 017284F3                      Function is coded VM                                              Postponed
01004094   CALL 016F29BD                     USER32.GetFocus                                                   Done
0100409B   CALL 0167C812                     USER32.MessageBoxW                                                Done
010040A6   CALL 0180BDCD                     USER32.SetWindowLongW                                             Done
01004413   CALL 015EA02E                     USER32.GetDlgItem                                                 Done
01004522   CALL 01605EEC                     USER32.SetDlgItemTextW                                            Done
0100463F   CALL 01666993                     USER32.GetDlgItem                                                 Done
01004656   CALL 01611C19                     USER32.GetDlgItem                                                 Done
0100470E   CALL 0162DF4F                     USER32.GetDlgItem                                                 Done
010047BF   CALL 0166B91F                     USER32.AttachThreadInput                                          Done
010047DD   CALL 014EDC98                     kernel32.CloseHandle                                              Done
01004829   CALL 01894D34                     kernel32.GetCurrentThreadId                                       Done
01004842   CALL 014D6A26                     kernel32.CreateThread                                             Done
01004863   CALL 0181B010                     kernel32.ResumeThread                                             Done
01004870   JMP 015A0BE2                      Function is coded VM                                              Postponed
01004879   CALL 014B1700                     False code VM entry point                                         Cancelled
01004893   JMP 014B08C7                      False code VM entry point                                         Cancelled
0100495C   CALL 014ABC42                     False code VM entry point                                         Cancelled
010049D5   CALL 014ACEFB                     False code VM entry point                                         Cancelled
010049E1   CALL 014AFDD4                     False code VM entry point                                         Cancelled
01004A03   JMP 014AB366                      False code VM entry point                                         Cancelled
01004A0D   JMP 014B1A40                      False code VM entry point                                         Cancelled
01004A32   JMP 014ABBF6                      False code VM entry point                                         Cancelled
01004B21   CALL 01853D87                     USER32.GetDlgItem                                                 Done
01004B7C   CALL 01602796                     USER32.GetDlgItem                                                 Done
01004CCA   CALL 01682157                     USER32.GetWindowLongW                                             Done
01004EFB   JMP 01F9D010                      False code VM entry point                                         Cancelled
01004F15   CALL 0171C2C0                     USER32.GetDlgItemInt                                              Done
01004F5A   CALL 0189BA24                     USER32.SetDlgItemInt                                              Done
01004F62   CALL 0167B3C0                     USER32.GetDlgItemInt                                              Done
01004FA3   CALL 01683CC9                     USER32.SetDlgItemInt                                              Done
01004FBA   CALL 018B300B                     USER32.GetDlgItem                                                 Done
01004FED   CALL 018C082C                     USER32.SetWindowLongW                                             Done
01004FF3   CALL 016F1743                     USER32.GetDlgItem                                                 Done
0100500D   CALL 015BEB73                     COMCTL32.CreateUpDownControl                                      Done
0100520B   CALL 0151C2D7                     USER32.SetDlgItemTextW                                            Done
01005487   CALL 01558079                     USER32.PostMessageW                                               Done
0100549A   CALL 017EDFBE                     USER32.SetWindowLongW                                             Done
010054D4   JMP 014EB30C                      Function is coded VM                                              Postponed
010054DA   CALL 016FB83F                     USER32.GetFocus                                                   Done
010054E1   CALL 0163D6C4                     USER32.MessageBoxW                                                Done
010054EC   CALL 015FBFE7                     USER32.SetWindowLongW                                             Done
01005659   CALL 015BBEF6                     USER32.GetWindowLongW                                             Done
01005696   CALL 01663467                     USER32.IsDlgButtonChecked                                         Done
010056B2   CALL 0173D719                     USER32.PostMessageW                                               Done
010056DC   CALL 01800664                     USER32.SetWindowLongW                                             Done
010056EE   CALL 017EE157                     USER32.SetDlgItemTextW                                            Done
0100571A   CALL 017DD369                     USER32.CheckDlgButton                                             Done
0100574F   CALL 0153FBF5                     USER32.IsDlgButtonChecked                                         Done
0100576F   CALL 01654725                     USER32.PostMessageW                                               Done
01005784   CALL 0158A234                     USER32.SetWindowLongW                                             Done
010057D7   CALL 017098C1                     USER32.GetWindowLongW                                             Done
01005827   CALL 01625AF6                     USER32.SetDlgItemTextW                                            Done
01005853   CALL 015D61C2                     USER32.SetWindowLongW                                             Done
0100585C   CALL 0162B688                     USER32.SetDlgItemTextW                                            Done
0100590A   CALL 015B37C3                     USER32.PostMessageW                                               Done
0100591C   CALL 0170E8DD                     USER32.SetWindowLongW                                             Done
01005960   CALL 016ADCB7                     USER32.IsDlgButtonChecked                                         Done
01005C58   CALL 015A33C9                     USER32.GetWindowLongW                                             Done
01005CA1   CALL 01839425                     USER32.SetWindowLongW                                             Done
01005CB3   CALL 0158724B                     USER32.SetDlgItemTextW                                            Done
01005D83   CALL 0166E8B7                     USER32.CheckDlgButton                                             Done
01005DBA   CALL 01561187                     USER32.GetDlgItem                                                 Done
01005DF8   CALL 01518BEE                     USER32.PostMessageW                                               Done
01005E2E   JMP 014B26E5                      Function is coded VM                                              Postponed
01005E34   CALL 015BAE01                     USER32.GetFocus                                                   Done
01005E3B   CALL 0162C36C                     USER32.MessageBoxW                                                Done
01005E6E   CALL 01846489                     USER32.SetWindowLongW                                             Done
01005ECB   CALL 016CB40A                     USER32.GetDlgItemTextA                                            Done
01005FA9   CALL 01850500                     USER32.GetWindowLongW                                             Done
01006005   CALL 015EA49E                     SHELL32.SHGetFolderPathW                                          Done
01006018   CALL 016214D7                     USER32.GetDlgItemTextW                                            Done
010060AD   JMP 01F9E1C2                      Error at determine type VM entry point                            Error
010060BB   CALL 01703C1A                     USER32.GetDlgItemTextW                                            Done
01006174   CALL 014F2B54                     USER32.SetDlgItemTextW                                            Done
0100619E   CALL 01835CA9                     USER32.SetWindowLongW                                             Done
010061A4   CALL 015FBFE2                     USER32.SetDlgItemTextW                                            Done
01006226   CALL 016FEE80                     USER32.PostMessageW                                               Done
0100625D   JMP 0186677D                      Function is coded VM                                              Postponed
01006263   CALL 01525756                     USER32.GetFocus                                                   Done
0100626A   CALL 014FFDBE                     USER32.MessageBoxW                                                Done
01006286   CALL 01855DA0                     USER32.GetDlgItemTextW                                            Done
01006354   CALL 018071A4                     USER32.SetWindowLongW                                             Done
010063FA   CALL 01884B3A                     USER32.GetDlgItemTextW                                            Done
0100667E   CALL 0159DDAC                     USER32.GetDlgItem                                                 Done
010066AE   CALL 0169EC78                     USER32.GetDlgItemInt                                              Done
01006708   CALL 01828CF5                     USER32.SetDlgItemInt                                              Done
0100672A   CALL 017874C8                     USER32.SetDlgItemInt                                              Done
01006861   CALL 01874E87                     USER32.SetDlgItemTextW                                            Done
010068E1   CALL 014B3416                     USER32.GetDlgItemInt                                              Done
010068F6   CALL 01798B78                     USER32.SetDlgItemInt                                              Done
0100696B   CALL 01866BDB                     USER32.SetDlgItemTextW                                            Done
0100698F   CALL 0179DE70                     USER32.GetDlgItem                                                 Done
01006A77   CALL 0167D8AA                     USER32.GetDlgItemTextW                                            Done
01006A8D   CALL 01502D2D                     USER32.GetDlgItemInt                                              Done
01006B5F   CALL 01698798                     USER32.GetDlgItemTextW                                            Done
01006CAA   CALL 015F7185                     USER32.GetWindowLongW                                             Done
01006CE4   CALL 0186CADF                     USER32.GetDlgItemInt                                              Done
01006D25   CALL 01867523                     USER32.GetDlgItemInt                                              Done
01006D66   CALL 017E12E0                     USER32.SetDlgItemInt                                              Done
01006DA7   CALL 016EF775                     USER32.SetWindowLongW                                             Done
01006DB9   CALL 014B2A78                     USER32.GetDlgItem                                                 Done
01006DC5   CALL 0150775E                     COMCTL32.CreateUpDownControl                                      Done
01006DFA   CALL 018C3D78                     USER32.GetDlgItem                                                 Done
01006E3B   CALL 01574401                     USER32.SetDlgItemTextW                                            Done
01006F39   CALL 0185B497                     USER32.GetDlgItem                                                 Done
01006F97   CALL 0189EDB4                     USER32.GetDlgItem                                                 Done
01006F9E   CALL 016B83C9                     USER32.SetFocus                                                   Done
01006FD9   CALL 01831538                     USER32.PostMessageW                                               Done
01006FEC   CALL 0185B3AE                     USER32.SetWindowLongW                                             Done
01007034   JMP 0153E0A1                      Function is coded VM                                              Postponed
0100703A   CALL 0188D6D2                     USER32.GetFocus                                                   Done
01007041   CALL 01607703                     USER32.MessageBoxW                                                Done
0100704C   CALL 016E47E7                     USER32.SetWindowLongW                                             Done
01007130   JMP 0182447A                      Function is coded VM                                              Postponed
0100717A   JMP 014AC3EA                      False code VM entry point                                         Cancelled
01007187   JMP 014AF48E                      False code VM entry point                                         Cancelled
010071BA   CALL 014ABDB0                     False code VM entry point                                         Cancelled
010071C0   JMP 014B0779                      False code VM entry point                                         Cancelled
010071D9   CALL 014ACDB8                     False code VM entry point                                         Cancelled
01007208   CALL 014B1440                     False code VM entry point                                         Cancelled
01007210   CALL 014B1E72                     False code VM entry point                                         Cancelled
0100721E   CALL 014AF7B9                     False code VM entry point                                         Cancelled
0100726F   CALL 014ACF21                     False code VM entry point                                         Cancelled
010072B9   CALL 014B1B12                     False code VM entry point                                         Cancelled
010072CE   JMP 014AB366                      False code VM entry point                                         Cancelled
010072E5   CALL 014AEB05                     False code VM entry point                                         Cancelled
010072F2   CALL 014AE1CD                     False code VM entry point                                         Cancelled
010072F9   CALL 014ACD21                     Function is coded VM                                              Postponed
01007302   CALL 014AC4F6                     False code VM entry point                                         Cancelled
01007328   JMP 014AB366                      False code VM entry point                                         Cancelled
0100733D   CALL 014AB0D0                     False code VM entry point                                         Cancelled
0100734F   JMP 014AB4D8                      Function is coded VM                                              Postponed
01007392   JMP 014AD59C                      False code VM entry point                                         Cancelled
010073A8   JMP 014B08C7                      False code VM entry point                                         Cancelled
01007414   JMP 014B08B5                      False code VM entry point                                         Cancelled
01007426   JMP 014ADE8A                      False code VM entry point                                         Cancelled
01007454   JMP 014ACCB1                      False code VM entry point                                         Cancelled
01007470   JMP 014B08C7                      False code VM entry point                                         Cancelled
010074A4   JMP 014ACD7A                      False code VM entry point                                         Cancelled
010074BE   JMP 014AB366                      False code VM entry point                                         Cancelled
010074C3   JMP 014AE8B0                      False code VM entry point                                         Cancelled
010074C8   CALL 014AD0E7                     False code VM entry point                                         Cancelled
010074D5   CALL 014AD6C6                     False code VM entry point                                         Cancelled
010074E3   JMP 014AD7EA                      False code VM entry point                                         Cancelled
01007501   JMP 014B08C7                      False code VM entry point                                         Cancelled
0100750D   JMP 014AB2E0                      False code VM entry point                                         Cancelled
01007545   JMP 014AC3D1                      Function is coded VM                                              Postponed
0100756A   JMP 014AD15D                      False code VM entry point                                         Cancelled
01007581   JMP 014B1EF6                      False code VM entry point                                         Cancelled
01007598   JMP 014B08C7                      False code VM entry point                                         Cancelled
01007630   CALL 014AE950                     False code VM entry point                                         Cancelled
0100764C   JMP 014AB366                      False code VM entry point                                         Cancelled
0100765E   CALL 014B0936                     False code VM entry point                                         Cancelled
01007663   CALL 014AC8D3                     False code VM entry point                                         Cancelled
01007722   JMP 014B1F05                      False code VM entry point                                         Cancelled
01007770   JMP 014E3E29                      Function is coded VM                                              Postponed
01007775   CALL 014AD2FB                     False code VM entry point                                         Cancelled
0100778A   JMP 014ABCFC                      Function is coded VM                                              Postponed
010077C5   JMP 014AEAF1                      Function is coded VM                                              Postponed
010077CA   JMP 014AD5C8                      False code VM entry point                                         Cancelled
010077E7   CALL 01792E7A                     kernel32.CreateFileW                                              Done
01007802   CALL 016882D2                     kernel32.SetFilePointer                                           Done
01007808   CALL 01708666                     kernel32.WriteFile                                                Done
01007866   CALL 01579BCA                     kernel32.CloseHandle                                              Done
01007873   CALL 01808D0A                     kernel32.CloseHandle                                              Done
010078C4   CALL 01857CFC                     USER32.GetDlgItem                                                 Done
01007A90   JMP 01576314                      Function is coded VM                                              Postponed
01007AC6   JMP 014AD98E                      False code VM entry point                                         Cancelled
01007ADA   JMP 014B155A                      Function is coded VM                                              Postponed
01007AFF   CALL 014AB0B6                     Function is coded VM                                              Postponed
01007B1A   JMP 014AB366                      False code VM entry point                                         Cancelled
01007B1F   JMP 014ABFDE                      False code VM entry point                                         Cancelled
01007B24   CALL 014AFAD1                     False code VM entry point                                         Cancelled
01007B2D   CALL 014B0A36                     False code VM entry point                                         Cancelled
01007B9B   JMP 014AD59C                      False code VM entry point                                         Cancelled
01007BA0   JMP 014AAFD5                      False code VM entry point                                         Cancelled
01007BC6   JMP 014AB675                      False code VM entry point                                         Cancelled
01007BE7   CALL 014AB652                     False code VM entry point                                         Cancelled
01007C0D   JMP 014AD59C                      False code VM entry point                                         Cancelled
01007C3D   CALL 014AED0B                     False code VM entry point                                         Cancelled
01007C9C   CALL 014ADA55                     False code VM entry point                                         Cancelled
01007CA1   CALL 014AEE0D                     False code VM entry point                                         Cancelled
01007CA7   JMP 014B1D45                      False code VM entry point                                         Cancelled
01007CDB   JMP 014AB366                      False code VM entry point                                         Cancelled
01007CE3   JMP 014AFB5C                      False code VM entry point                                         Cancelled
01007CF7   JMP 014ADE47                      False code VM entry point                                         Cancelled
01007CFC   CALL 014AD00A                     Function is coded VM                                              Postponed
01008060   JMP 01556E94                      Function is coded VM                                              Postponed
010080B9   CALL 014AE992                     False code VM entry point                                         Cancelled
010080EE   JMP 014ADA3B                      Function is coded VM                                              Postponed
01008161   JMP 014B0D90                      False code VM entry point                                         Cancelled
010081A2   JMP 014B0782                      False code VM entry point                                         Cancelled
010081BD   CALL 014AE250                     False code VM entry point                                         Cancelled
010081CC   JMP 014ABE33                      Function is coded VM                                              Postponed
010081EB   CALL 014B0675                     False code VM entry point                                         Cancelled
010081F0   JMP 014B1650                      False code VM entry point                                         Cancelled
0100820F   JMP 014AE53A                      False code VM entry point                                         Cancelled
01008220   JMP 0153970C                      Function is coded VM                                              Postponed
010082E3   JMP 014AF33F                      False code VM entry point                                         Cancelled
010082E9   JMP 014AFAAE                      Function is coded VM                                              Postponed
01008300   JMP 014ABE9D                      Function is coded VM                                              Postponed
01008352   CALL 0184E5AB                     USER32.EndDialog                                                  Done
01008362   CALL 0159B301                     USER32.GetUpdateRect                                              Done
01008370   CALL 015B228A                     USER32.GetDlgItem                                                 Done
01008380   CALL 014B4C45                     USER32.GetWindowRect                                              Done
010083BC   CALL 0176CF4E                     USER32.ScreenToClient                                             Done
010083C8   CALL 015CA238                     USER32.BeginPaint                                                 Done
010083DC   CALL 0151AE88                     kernel32.GetModuleHandleW                                         Done
010083E3   CALL 01680016                     USER32.LoadImageW                                                 Done
01008401   CALL 0157C832                     USER32.DrawIconEx                                                 Done
01008408   CALL 016DD2C5                     USER32.DestroyIcon                                                Done
01008414   CALL 01677120                     USER32.EndPaint                                                   Done
0100842B   CALL 016A453A                     USER32.SetDlgItemTextW                                            Done
01008448   CALL 0188E6CB                     USER32.SetWindowTextW                                             Done
01008537   CALL 016A0BA1                     USER32.PostMessageW                                               Done
01008575   JMP 0151EF1E                      Function is coded VM                                              Postponed
0100857B   CALL 016F9050                     USER32.SetWindowTextW                                             Done
0100858D   CALL 015E618D                     USER32.SetDlgItemTextW                                            Done
010085AB   CALL 016FA4F1                     USER32.SetDlgItemTextW                                            Done
010085C1   CALL 01683A4C                     USER32.EndDialog                                                  Done
010085D8   CALL 01609E1F                     USER32.GetWindowLongW                                             Done
0100860B   CALL 018BED81                     USER32.GetDlgItem                                                 Done
0100862B   CALL 01789B73                     USER32.SetWindowLongW                                             Done
01008631   JMP 018A8336                      Function is coded VM                                              Postponed
01008637   CALL 017A8F18                     USER32.SetWindowTextW                                             Done
01008649   CALL 016179E9                     USER32.SetDlgItemTextW                                            Done
01008683   CALL 01759914                     USER32.GetDlgItem                                                 Done
010086D0   CALL 01713B24                     USER32.PostMessageW                                               Done
0100871A   CALL 01652E73                     USER32.PostMessageW                                               Done
01008786   CALL 0163EEE8                     USER32.DestroyWindow                                              Done
010087BE   CALL 01683CD6                     USER32.CreateDialogParamW                                         Done
01008820   JMP 01753568                      Function is coded VM                                              Postponed
010088A2   JMP 014AC3D8                      Function is coded VM                                              Postponed
010088C6   CALL 014B063B                     False code VM entry point                                         Cancelled
010088D6   CALL 014B03A5                     False code VM entry point                                         Cancelled
01008901   JMP 014ADAF5                      False code VM entry point                                         Cancelled
01008953   CALL 014AC801                     False code VM entry point                                         Cancelled
0100896E   CALL 014AF455                     False code VM entry point                                         Cancelled
01008990   JMP 01616C2A                      Function is coded VM                                              Postponed
010089A8   JMP 014B0D17                      Function is coded VM                                              Postponed
010089AD   JMP 014AFE15                      Function is coded VM                                              Postponed
010089B7   CALL 014AABD5                     False code VM entry point                                         Cancelled
010089C3   JMP 014B0F10                      False code VM entry point                                         Cancelled
010089C8   JMP 014AD7A2                      False code VM entry point                                         Cancelled
01008A04   JMP 014ACE29                      False code VM entry point                                         Cancelled
01008A09   JMP 014AD6D7                      False code VM entry point                                         Cancelled
01008A2E   CALL 014AB5BC                     Function is coded VM                                              Postponed
01008A33   JMP 014ACDF0                      False code VM entry point                                         Cancelled
01008BB3   CALL 017A7E59                     USER32.GetWindowLongW                                             Done
01008BFA   CALL 01507139                     USER32.SetWindowLongW                                             Done
01008C18   CALL 01613494                     USER32.GetDlgItemTextW                                            Done
01008C61   CALL 0175B71D                     USER32.GetDlgItemTextA                                            Done
01008CA0   JMP 018ACDE0                      Function is coded VM                                              Postponed
01008CA6   CALL 014E44F0                     USER32.GetFocus                                                   Done
01008CAD   CALL 014B571C                     USER32.MessageBoxW                                                Done
01008CE4   JMP 014FC2B0                      Function is coded VM                                              Postponed
01008CEA   CALL 0162ACE1                     USER32.GetFocus                                                   Done
01008CF1   CALL 017239EB                     USER32.MessageBoxW                                                Done
01008D3D   JMP 016C0FC7                      Function is coded VM                                              Postponed
01008DBF   CALL 017E5F3D                     USER32.SetDlgItemTextW                                            Done
01008DD8   JMP 016877C7                      Function is coded VM                                              Postponed
01008DDE   CALL 015431FB                     USER32.GetFocus                                                   Done
01008DE5   CALL 0161A6E6                     USER32.MessageBoxW                                                Done
01008DFC   CALL 01812ED0                     USER32.IsDlgButtonChecked                                         Done
01008E0A   CALL 0156EFC7                     USER32.GetDlgItemTextW                                            Done
01008F8C   CALL 0156813E                     USER32.GetDlgItemTextW                                            Done
01008FB1   CALL 0178F4AD                     USER32.PostMessageW                                               Done
01008FC1   CALL 0180F642                     USER32.SetWindowLongW                                             Done
01008FD3   CALL 015F669A                     USER32.SetDlgItemTextW                                            Done
01009030   CALL 017C1EE1                     USER32.SetWindowTextW                                             Done
01009093   CALL 0180CFCC                     USER32.CheckDlgButton                                             Done
010090AB   JMP 0173AA87                      Function is coded VM                                              Postponed
0100913D   JMP 0174643C                      Function is coded VM                                              Postponed
01009166   CALL 0163F05E                     USER32.SetDlgItemTextA                                            Done
010091A4   CALL 017F9BD1                     USER32.GetDlgItem                                                 Done
010091AB   CALL 0169F041                     USER32.SetFocus                                                   Done
010091D5   CALL 017E12DA                     USER32.EndDialog                                                  Done
01009285   CALL 0164D821                     USER32.CreateMenu                                                 Done
010092D8   CALL 018CBC77                     USER32.AppendMenuW                                                Done
010093FB   CALL 016FAC7D                     USER32.CheckMenuItem                                              Done
01009558   CALL 017BF352                     USER32.CreateWindowExW                                            Done
010095BD   CALL 015F4DF5                     USER32.CreateWindowExW                                            Done
0100962D   CALL 016C93EA                     COMCTL32.ImageList_Create                                         Done
01009698   CALL 018AF300                     USER32.LoadImageW                                                 Done
010096A6   CALL 01711979                     COMCTL32.ImageList_ReplaceIcon                                    Done
010098E2   JMP 01708BB2                      Function is coded VM                                              Postponed
010098E8   CALL 014FED2A                     USER32.GetFocus                                                   Done
010098EF   CALL 01783FC9                     USER32.MessageBoxW                                                Done
01009902   JMP 015C8DE2                      Function is coded VM                                              Postponed
01009908   CALL 015A0AFE                     USER32.GetFocus                                                   Done
0100990F   CALL 0185F0D4                     USER32.MessageBoxW                                                Done
01009980   JMP 018A0C73                      Function is coded VM                                              Postponed
01009DAC   JMP 014AB366                      False code VM entry point                                         Cancelled
01009DC7   JMP 014AB352                      False code VM entry point                                         Cancelled
01009DD6   CALL 014AE0E5                     False code VM entry point                                         Cancelled
01009EB1   JMP 014B17FF                      False code VM entry point                                         Cancelled
01009ED4   JMP 014B08C7                      False code VM entry point                                         Cancelled
01009F10   JMP 0158BD09                      Function is coded VM                                              Postponed
01009F6F   CALL 014B18C0                     False code VM entry point                                         Cancelled
01009F79   JMP 014AB0C1                      False code VM entry point                                         Cancelled
01009FA4   JMP 014AD59C                      False code VM entry point                                         Cancelled
01009FC2   CALL 015629CA                     False code VM entry point                                         Cancelled
01009FDA   CALL 014AB695                     False code VM entry point                                         Cancelled
0100A031   CALL 014B1E14                     False code VM entry point                                         Cancelled
0100A036   CALL 014ABFC5                     False code VM entry point                                         Cancelled
0100A043   JMP 014AD515                      False code VM entry point                                         Cancelled
0100A056   JMP 014AAE3C                      Function is coded VM                                              Postponed
0100A08A   JMP 014ACE4E                      False code VM entry point                                         Cancelled
0100A0C8   CALL 014B0F63                     False code VM entry point                                         Cancelled
0100A0CD   JMP 014B02F6                      False code VM entry point                                         Cancelled
0100A0F6   JMP 014B0EB0                      False code VM entry point                                         Cancelled
0100A149   JMP 014AD59C                      False code VM entry point                                         Cancelled
0100A167   CALL 014ABFA5                     False code VM entry point                                         Cancelled
0100A180   JMP 01564BA4                      Function is coded VM                                              Postponed
0100A595   CALL 014ACA1E                     False code VM entry point                                         Cancelled
0100A685   CALL 014AE4EB                     False code VM entry point                                         Cancelled
0100A697   CALL 014AC5C3                     False code VM entry point                                         Cancelled
0100A6C1   JMP 014B1840                      False code VM entry point                                         Cancelled
0100A6E3   JMP 014AD372                      False code VM entry point                                         Cancelled
0100A75C   JMP 014AD0EC                      False code VM entry point                                         Cancelled
0100A77C   CALL 014B0A66                     False code VM entry point                                         Cancelled
0100A78D   CALL 014AC1F4                     False code VM entry point                                         Cancelled
0100A7A9   CALL 014AB834                     False code VM entry point                                         Cancelled
0100A7B3   JMP 014ADBAC                      False code VM entry point                                         Cancelled
0100A7E7   JMP 014AE2B5                      False code VM entry point                                         Cancelled
0100A88E   JMP 014B08C7                      False code VM entry point                                         Cancelled
0100A8A1   CALL 014AC502                     Function is coded VM                                              Postponed
0100A8B4   CALL 014B1B05                     False code VM entry point                                         Cancelled
0100A8C1   JMP 014B0090                      False code VM entry point                                         Cancelled
0100A90B   JMP 014AD59C                      False code VM entry point                                         Cancelled
0100AA8B   CALL 0155F483                     USER32.GetDlgItem                                                 Done
0100AAC0   CALL 01526A8B                     USER32.SetWindowTextW                                             Done
0100AAE5   CALL 015300C3                     USER32.SetWindowTextW                                             Done
0100AB34   CALL 01796569                     USER32.SetWindowTextW                                             Done
0100AB74   CALL 016FDFA7                     USER32.SetWindowTextW                                             Done
0100AC3A   CALL 015CF7B0                     USER32.SetWindowTextW                                             Done
0100AC90   JMP 014B601D                      Function is coded VM                                              Postponed
0100ACEB   JMP 014AAF26                      False code VM entry point                                         Cancelled
0100AD50   JMP 01701244                      Function is coded VM                                              Postponed
0100AD64   JMP 014AB366                      False code VM entry point                                         Cancelled
0100AD7C   JMP 014AD59C                      False code VM entry point                                         Cancelled
0100ADBE   CALL 014B06D3                     False code VM entry point                                         Cancelled
0100ADF3   JMP 014B21A5                      False code VM entry point                                         Cancelled
0100ADFD   JMP 014B1988                      False code VM entry point                                         Cancelled
0100AE1B   CALL 014B1610                     False code VM entry point                                         Cancelled
0100AE39   JMP 014B1297                      False code VM entry point                                         Cancelled
0100AE42   JMP 014B07C5                      Error at determine type VM entry point                            Error
0100AE4C   CALL 014AE0F5                     False code VM entry point                                         Cancelled
0100AE64   CALL 015F8BD8                     USER32.GetDlgItem                                                 Done
0100AF17   CALL 01663524                     USER32.SetDlgItemTextW                                            Done
0100B03B   CALL 017401AF                     USER32.GetDlgItem                                                 Done
0100B114   CALL 016BF104                     USER32.GetDlgItem                                                 Done
0100B192   CALL 01705D71                     USER32.GetDlgItem                                                 Done
0100B248   CALL 016668D2                     USER32.GetDlgItem                                                 Done
0100B2AA   CALL 014B2AC5                     USER32.PostMessageW                                               Done
0100B496   CALL 01797EDD                     USER32.GetDlgItem                                                 Done
0100B500   JMP 016D0BF3                      Function is coded VM                                              Postponed
0100B50A   CALL 016D03EF                     USER32.GetFocus                                                   Done
0100B511   CALL 017A6FBF                     USER32.MessageBoxW                                                Done
0100B651   JMP 015A44D8                      Function is coded VM                                              Postponed
0100B65B   CALL 015129CB                     USER32.GetFocus                                                   Done
0100B662   CALL 016B840B                     USER32.MessageBoxW                                                Done
0100B8AF   CALL 016887E0                     kernel32.GetDateFormatW                                           Done
0100B8CD   CALL 017EA1FE                     kernel32.GetTimeFormatW                                           Done
0100B8FE   CALL 0156AB21                     USER32.GetDlgItem                                                 Done
0100B999   CALL 017CAA11                     USER32.GetDlgItem                                                 Done
0100B9FF   CALL 01713F75                     ADVAPI32.RegOpenKeyExW                                            Done
0100BA0D   CALL 014ED7EE                     ADVAPI32.RegQueryValueExW                                         Done
0100BAA2   CALL 01523C2C                     USER32.GetDlgItem                                                 Done
0100BB46   CALL 015655B1                     USER32.GetDlgItem                                                 Done
0100BCAE   CALL 015C33AE                     USER32.GetWindowLongW                                             Done
0100BCE2   CALL 014ECABF                     USER32.SetWindowLongW                                             Done
0100BCF5   CALL 016BB8B7                     USER32.SetDlgItemTextW                                            Done
0100BD0C   CALL 015830E9                     USER32.GetDlgItem                                                 Done
0100BD57   JMP 016B2A7E                      Function is coded VM                                              Postponed
0100BD83   CALL 0163680E                     USER32.SetWindowTextW                                             Done
0100BFD9   CALL 01615590                     kernel32.GetDateFormatW                                           Done
0100BFF7   CALL 015A9C6B                     kernel32.GetTimeFormatW                                           Done
0100C0FD   CALL 01551408                     USER32.PostMessageW                                               Done
0100C122   CALL 015DEA3E                     USER32.EndDialog                                                  Done
0100C14C   CALL 0170F61B                     SHELL32.SHGetFolderPathW                                          Done
0100C191   CALL 016E697F                     USER32.GetDlgItem                                                 Done
0100C198   CALL 017CD544                     USER32.PostMessageW                                               Done
0100C1BD   CALL 015761FA                     USER32.GetDlgItem                                                 Done
0100C1D4   CALL 01730338                     USER32.PostMessageW                                               Done
0100C1F1   CALL 01654BE9                     USER32.GetDlgItem                                                 Done
0100C208   CALL 0185CF6E                     USER32.SetDlgItemTextW                                            Done
0100C26B   CALL 0161CE31                     USER32.SetDlgItemTextW                                            Done
0100C2A2   CALL 015CD124                     USER32.GetDlgItem                                                 Done
0100C341   CALL 0166488C                     USER32.SetDlgItemTextW                                            Done
0100C4DF   CALL 016BF688                     ADVAPI32.RegOpenKeyExW                                            Done
0100C4ED   CALL 0161E5AE                     ADVAPI32.RegQueryValueExW                                         Done
0100C64D   CALL 01885A8A                     kernel32.GetTempPathW                                             Done
0100C67C   CALL 01874090                     kernel32.GetTempFileNameW                                         Done
0100C6CE   CALL 01694AF5                     kernel32.CreateFileW                                              Done
0100C6EF   CALL 0181A18F                     kernel32.WriteFile                                                Done
0100C6F6   CALL 0162DA6D                     kernel32.CloseHandle                                              Done
0100C742   CALL 016B6CD8                     USER32.DialogBoxParamW                                            Done
0100C750   CALL 017B64D7                     kernel32.DeleteFileW                                              Done
0100C8CF   JMP 0166B0F9                      Function is coded VM                                              Postponed
0100C8D9   CALL 016E0D65                     USER32.GetFocus                                                   Done
0100C8E0   CALL 0167832C                     USER32.MessageBoxW                                                Done
0100CB11   JMP 015857C4                      Function is coded VM                                              Postponed
0100CB1B   CALL 0152F1DA                     USER32.GetFocus                                                   Done
0100CB22   CALL 018BF825                     USER32.MessageBoxW                                                Done
0100CBB7   JMP 016DB2C1                      Function is coded VM                                              Postponed
0100CBC1   CALL 016AC0DB                     USER32.GetFocus                                                   Done
0100CBC8   CALL 015BFCBA                     USER32.MessageBoxW                                                Done
0100CC1A   JMP 017776D4                      Function is coded VM                                              Postponed
0100CC24   CALL 01861389                     USER32.GetFocus                                                   Done
0100CC2B   CALL 0167D461                     USER32.MessageBoxW                                                Done
0100CC64   CALL 015C9DFC                     Function is coded VM                                              Postponed
0100D300   JMP 01808581                      Function is coded VM                                              Postponed
0100D365   JMP 014AB7A9                      False code VM entry point                                         Cancelled
0100D36B   JMP 014B1EBE                      False code VM entry point                                         Cancelled
0100D37C   JMP 014AE823                      False code VM entry point                                         Cancelled
0100D382   CALL 014AE60F                     Function is coded VM                                              Postponed
0100D39E   CALL 014AE9B0                     False code VM entry point                                         Cancelled
0100D3D5   JMP 014AB366                      False code VM entry point                                         Cancelled
0100D3DA   CALL 014ADBA3                     False code VM entry point                                         Cancelled
0100D43F   JMP 014AB366                      False code VM entry point                                         Cancelled
0100D448   JMP 014AC202                      False code VM entry point                                         Cancelled
0100D450   CALL 014AC13C                     Function is coded VM                                              Postponed
0100D475   JMP 014B0BC1                      False code VM entry point                                         Cancelled
0100D493   JMP 014B021F                      Error at determine type VM entry point                            Error
0100D4A8   JMP 014AAC52                      False code VM entry point                                         Cancelled
0100D4C8   JMP 014AFF9A                      False code VM entry point                                         Cancelled
0100D4D0   CALL 014AE7F2                     False code VM entry point                                         Cancelled
0100D50E   JMP 014ADBC1                      False code VM entry point                                         Cancelled
0100D558   JMP 014AC040                      Function is coded VM                                              Postponed
0100D563   CALL 014B0625                     False code VM entry point                                         Cancelled
0100D568   CALL 014AFADF                     False code VM entry point                                         Cancelled
0100D59C   CALL 014AB000                     False code VM entry point                                         Cancelled
0100D5A7   CALL 014AB62B                     False code VM entry point                                         Cancelled
0100D5F2   JMP 014AB140                      False code VM entry point                                         Cancelled
0100D627   CALL 014AAFF0                     False code VM entry point                                         Cancelled
0100D644   JMP 014AB352                      False code VM entry point                                         Cancelled
0100D662   CALL 014AE041                     False code VM entry point                                         Cancelled
0100D6B5   CALL 014AB758                     False code VM entry point                                         Cancelled
0100D6E7   CALL 014AE5CE                     False code VM entry point                                         Cancelled
0100D701   JMP 014B1D98                      Function is coded VM                                              Postponed
0100D73C   CALL 014AF385                     False code VM entry point                                         Cancelled
0100D741   JMP 014B0061                      Function is coded VM                                              Postponed
0100D74A   JMP 014B1200                      False code VM entry point                                         Cancelled
0100D756   CALL 014B1C82                     False code VM entry point                                         Cancelled
0100D762   JMP 014ABB29                      False code VM entry point                                         Cancelled
0100D767   CALL 014B19A7                     False code VM entry point                                         Cancelled
0100D772   JMP 014AC4DB                      False code VM entry point                                         Cancelled
0100D7D5   JMP 014B08C7                      False code VM entry point                                         Cancelled
0100D7DA   JMP 014B0EFA                      Function is coded VM                                              Postponed
0100D806   CALL 014B0099                     Function is coded VM                                              Postponed
0100D858   JMP 014ABCC0                      False code VM entry point                                         Cancelled
0100D8A1   CALL 014AE0AB                     False code VM entry point                                         Cancelled
0100D8BD   JMP 014AF39F                      False code VM entry point                                         Cancelled
0100D8CF   CALL 014AEB4E                     False code VM entry point                                         Cancelled
0100D8D9   CALL 014B07F0                     False code VM entry point                                         Cancelled
0100D906   JMP 014AB366                      False code VM entry point                                         Cancelled
0100D91B   CALL 014AB20F                     False code VM entry point                                         Cancelled
0100D94A   JMP 014AFEAB                      False code VM entry point                                         Cancelled
0100DA26   JMP 014B1FDE                      False code VM entry point                                         Cancelled
0100DA74   JMP 014ADD9E                      False code VM entry point                                         Cancelled
0100DAA0   CALL 014B1B99                     False code VM entry point                                         Cancelled
0100DAC1   JMP 014AC235                      False code VM entry point                                         Cancelled
0100DAC7   JMP 014AE03C                      False code VM entry point                                         Cancelled
0100DAEC   CALL 014AAE6F                     False code VM entry point                                         Cancelled
0100DB3C   CALL 014B0C80                     False code VM entry point                                         Cancelled
0100DB41   JMP 014B109F                      False code VM entry point                                         Cancelled
0100DB61   CALL 014B00C8                     False code VM entry point                                         Cancelled
0100DBEE   JMP 014AB220                      False code VM entry point                                         Cancelled
0100DC1A   CALL 014AD702                     False code VM entry point                                         Cancelled
0100DC4A   JMP 014AB827                      False code VM entry point                                         Cancelled
0100DC74   JMP 014AE1B5                      False code VM entry point                                         Cancelled
0100DC93   JMP 014B05E8                      False code VM entry point                                         Cancelled
0100DCB0   JMP 0166B0BA                      Function is coded VM                                              Postponed
0100DD24   CALL 014B0931                     False code VM entry point                                         Cancelled
0100DD77   CALL 014ACAC3                     False code VM entry point                                         Cancelled
0100DD80   JMP 014AB940                      False code VM entry point                                         Cancelled
0100DD8E   CALL 014ABBBD                     Function is coded VM                                              Postponed
0100DD95   CALL 014ADB5A                     False code VM entry point                                         Cancelled
0100DDBE   JMP 014B08C7                      False code VM entry point                                         Cancelled
0100DE00   JMP 014B0074                      False code VM entry point                                         Cancelled
0100DE05   CALL 014B18CC                     False code VM entry point                                         Cancelled
0100DE45   JMP 014B014D                      False code VM entry point                                         Cancelled
0100DE5F   CALL 014B21E5                     False code VM entry point                                         Cancelled
0100DE91   CALL 014AE9A1                     Function is coded VM                                              Postponed
0100DF43   CALL 014AC80B                     False code VM entry point                                         Cancelled
0100DF6A   CALL 014AC499                     False code VM entry point                                         Cancelled
0100DF85   JMP 014ACBF5                      False code VM entry point                                         Cancelled
0100DF8D   CALL 014AEC93                     False code VM entry point                                         Cancelled
0100DFA5   JMP 014AFE4F                      False code VM entry point                                         Cancelled
0100E026   CALL 016AF326                     USER32.KillTimer                                                  Done
0100E038   CALL 0151FDE6                     USER32.GetUpdateRect                                              Done
0100E046   CALL 0181208F                     USER32.GetDlgItem                                                 Done
0100E056   CALL 0177767B                     USER32.GetWindowRect                                              Done
0100E092   CALL 016FEE94                     USER32.ScreenToClient                                             Done
0100E09E   CALL 0168518B                     USER32.BeginPaint                                                 Done
0100E0AD   CALL 015477E0                     USER32.LoadIconW                                                  Done
0100E0D5   CALL 014DC856                     USER32.DrawIconEx                                                 Done
0100E0DC   CALL 0171198D                     USER32.DestroyIcon                                                Done
0100E0E8   CALL 016A5784                     USER32.EndPaint                                                   Done
0100E132   CALL 017ECCD8                     USER32.SetDlgItemTextW                                            Done
0100E14D   CALL 016528F5                     USER32.SetWindowLongW                                             Done
0100E1A0   JMP 0164CD28                      Function is coded VM                                              Postponed
0100E1A6   CALL 0181F39F                     USER32.SetWindowTextW                                             Done
0100E1B9   CALL 017BA51C                     USER32.SetTimer                                                   Done
0100E1EE   CALL 0168A754                     USER32.GetWindowLongW                                             Done
0100E1FB   CALL 0177921B                     USER32.SetWindowLongW                                             Done
0100E212   CALL 0152E178                     USER32.PostMessageW                                               Done
0100E24D   CALL 01844BD9                     USER32.SetDlgItemTextW                                            Done
0100E26A   CALL 01814B88                     USER32.KillTimer                                                  Done
0100E273   CALL 0180B418                     USER32.EndDialog                                                  Done
0100E2BB   CALL 016037BE                     USER32.AttachThreadInput                                          Done
0100E30F   CALL 017EDE70                     kernel32.CloseHandle                                              Done
0100E3CE   CALL 01749DE1                     kernel32.GetCurrentThreadId                                       Done
0100E3EB   CALL 0152883B                     kernel32.CreateThread                                             Done
0100E410   CALL 0166DE81                     kernel32.ResumeThread                                             Done
0100E435   CALL 016A86F4                     SHELL32.DragQueryFileW                                            Done
0100E45D   JMP 01551403                      Function is coded VM                                              Postponed
0100E463   CALL 018C956D                     USER32.GetFocus                                                   Done
0100E46A   CALL 0188F004                     USER32.MessageBoxW                                                Done
0100E471   CALL 01835CA4                     SHELL32.DragFinish                                                Done
0100E49D   CALL 0164EC15                     SHELL32.DragFinish                                                Done
0100E54A   CALL 018137E8                     USER32.PostMessageW                                               Done
0100E604   CALL 017D7EB6                     COMDLG32.GetOpenFileNameW                                         Done
0100E6A6   CALL 018C34BC                     USER32.CreateDialogParamW                                         Done
0100E723   CALL 01855629                     USER32.DialogBoxParamW                                            Done
0100E742   CALL 0160BA9C                     USER32.DialogBoxParamW                                            Done
0100E761   CALL 01714D9E                     kernel32.GetModuleFileNameW                                       Done
0100E7E2   JMP 015E8410                      Function is coded VM                                              Postponed
0100E7F0   CALL 0168EB40                     USER32.MessageBoxW                                                Done
0100E809   JMP 017F8E92                      Function is coded VM                                              Postponed
0100E810   CALL 016AA410                     USER32.MessageBoxW                                                Done
0100E837   CALL 014B57B1                     USER32.DialogBoxParamW                                            Done
0100E87B   CALL 0180C019                     USER32.CreateDialogParamW                                         Done
0100E89A   CALL 017A6B3F                     USER32.DestroyWindow                                              Done
0100EA0E   JMP 017D7B4A                      Function is coded VM                                              Postponed
0100EA1C   CALL 017FF6B1                     USER32.MessageBoxW                                                Done
0100EA35   CALL 015797F3                     SHELL32.ShellExecuteA                                             Done
0100EA42   CALL 014ECD14                     USER32.PostMessageW                                               Done
0100EB35   CALL 0170C958                     USER32.RegisterWindowMessageW                                     Done
0100EB5A   CALL 0170912E                     ole32.CoCreateInstance                                            Done
0100EBA0   CALL 016F5716                     USER32.SetWindowTextW                                             Done
0100EBB9   CALL 01747BA4                     USER32.SetMenu                                                    Done
0100EBF7   CALL 0171C6C4                     USER32.CreateWindowExW                                            Done
0100EC1F   JMP 016384AB                      Function is coded VM                                              Postponed
0100EE76   JMP 018CA37B                      Function is coded VM                                              Postponed
0100EE9B   JMP 017B1CB3                      Function is coded VM                                              Postponed
0100EEE1   CALL 01807A7E                     USER32.PostMessageW                                               Done
0100EF77   JMP 018877FD                      Function is coded VM                                              Postponed
0100EF7F   JMP 015D46EF                      Function is coded VM                                              Postponed
0100EF88   CALL 015CE900                     USER32.MessageBoxW                                                Done
0100EF9B   JMP 017874B6                      Function is coded VM                                              Postponed
0100EFC6   JMP 0180EA40                      Function is coded VM                                              Postponed
0100EFD0   CALL 0174E6A3                     SHELL32.ShellExecuteW                                             Done
0100EFD8   CALL 018CA3C1                     kernel32.ExitProcess                                              Done
0100EFEB   CALL 01665473                     USER32.SetTimer                                                   Done
0100EFF4   CALL 0187D7E9                     SHELL32.DragAcceptFiles                                           Done
0100F183   CALL 016F07F5                     USER32.PostMessageW                                               Done
0100F1AB   CALL 016B3F65                     USER32.PostMessageW                                               Done
0100F1DD   CALL 0188C25F                     USER32.GetDlgItem                                                 Done
0100F2D2   CALL 01528AD3                     USER32.GetClientRect                                              Done
0100F2E2   CALL 018B8EFC                     USER32.GetClientRect                                              Done
0100F320   CALL 015CD0E8                     USER32.MoveWindow                                                 Done
0100F460   CALL 017B3830                     USER32.GetClientRect                                              Done
0100F48D   CALL 0154786B                     USER32.RedrawWindow                                               Done
0100F4B2   CALL 014D6BE4                     USER32.GetDlgItem                                                 Done
0100F4B9   CALL 01787AF4                     USER32.SetFocus                                                   Done
0100F4E6   CALL 0173C817                     USER32.GetWindowPlacement                                         Done
0100F55D   CALL 016230A2                     SHELL32.DragAcceptFiles                                           Done
0100F565   CALL 016B9407                     USER32.PostQuitMessage                                            Done
0100F592   CALL 018C4ABC                     USER32.DestroyWindow                                              Done
0100F627   CALL 01680E9F                     USER32.GetSystemMetrics                                           Done
0100F676   CALL 014E2928                     USER32.DialogBoxParamW                                            Done
0100F6B8   CALL 01852EA4                     Function is coded VM                                              Postponed
0100F720   CALL 016040D7                     USER32.PostMessageW                                               Done
0100F752   CALL 017345B1                     USER32.DialogBoxParamW                                            Done
0100F7BC   CALL 01522E71                     USER32.DestroyWindow                                              Done
0100F7FA   CALL 016D7BF7                     USER32.CreateDialogParamW                                         Done
0100F8BC   CALL 01559AAB                     Function is coded VM                                              Postponed
0100FA0E   CALL 015089B2                     USER32.MessageBoxW                                                Done
0100FA37   CALL 0161552B                     USER32.DestroyWindow                                              Done
0100FA67   CALL 01567492                     USER32.DefWindowProcW                                             Done
0100FACC   CALL 01853D8C                     USER32.DefDlgProcW                                                Done
0100FB0E   CALL 0172C4DE                     ADVAPI32.RegOpenKeyExA                                            Done
0100FB1D   CALL 0159D937                     ADVAPI32.RegQueryValueExA                                         Done
0100FB78   CALL 0153F47F                     kernel32.ExpandEnvironmentStringsA                                Done
0100FBA0   CALL 014F7F94                     kernel32.LoadLibraryA                                             Done
0100FBB5   CALL 0172AAE5                     kernel32.GetProcAddress                                           Done
0100FBE0   JMP 016B6918                      Function is coded VM                                              Postponed
0100FC08   JMP 014ADBF4                      False code VM entry point                                         Cancelled
0100FC82   JMP 014AB366                      False code VM entry point                                         Cancelled
0100FCE9   JMP 014AB366                      False code VM entry point                                         Cancelled
0100FD06   JMP 014B0846                      Function is coded VM                                              Postponed
0100FD0F   JMP 014AE175                      False code VM entry point                                         Cancelled
0100FD1E   CALL 014AEA48                     False code VM entry point                                         Cancelled
0100FD43   JMP 014ACC2C                      False code VM entry point                                         Cancelled
0100FD58   JMP 014AD685                      False code VM entry point                                         Cancelled
0100FD74   JMP 014AE20E                      False code VM entry point                                         Cancelled
0100FD7E   JMP 014ADE80                      False code VM entry point                                         Cancelled
0100FDA0   JMP 014AB352                      False code VM entry point                                         Cancelled
0100FE57   JMP 014AFE6F                      Function is coded VM                                              Postponed
0100FEAD   JMP 014B035E                      Function is coded VM                                              Postponed
0100FECB   JMP 014ACCBA                      False code VM entry point                                         Cancelled
0100FEE5   CALL 014B19A2                     False code VM entry point                                         Cancelled
0100FF31   JMP 014ACB55                      False code VM entry point                                         Cancelled
0100FF6E   CALL 014AE737                     False code VM entry point                                         Cancelled
0100FFA3   CALL 014ACBDF                     False code VM entry point                                         Cancelled
0100FFA9   JMP 014AB892                      False code VM entry point                                         Cancelled
01010021   JMP 014AD535                      False code VM entry point                                         Cancelled
01010165   CALL 014AE9DB                     False code VM entry point                                         Cancelled
010101C0   JMP 0160FB43                      Function is coded VM                                              Postponed
010101D5   CALL 014AB128                     False code VM entry point                                         Cancelled
010101E2   JMP 014AD5A7                      False code VM entry point                                         Cancelled
010101F2   CALL 014AE241                     Function is coded VM                                              Postponed
01010220   JMP 0185B62F                      Function is coded VM                                              Postponed
0101022E   JMP 014AFB15                      False code VM entry point                                         Cancelled
010102AE   CALL 014B08D5                     False code VM entry point                                         Cancelled
01010301   JMP 014AE09B                      False code VM entry point                                         Cancelled
0101031A   JMP 014B145F                      False code VM entry point                                         Cancelled
01010323   CALL 014AE942                     False code VM entry point                                         Cancelled
0101035B   JMP 014ADC5C                      Function is coded VM                                              Postponed
0101037D   CALL 014B1D30                     False code VM entry point                                         Cancelled
010103BB   CALL 014B1C39                     Function is coded VM                                              Postponed
010103CF   CALL 014AE06F                     False code VM entry point                                         Cancelled
010103EA   CALL 014AD3E3                     Function is coded VM                                              Postponed
010103F5   JMP 014B1585                      False code VM entry point                                         Cancelled
010103FA   JMP 014B0BE0                      False code VM entry point                                         Cancelled
0101042F   CALL 014AE895                     False code VM entry point                                         Cancelled
01010444   JMP 014AC1A2                      False code VM entry point                                         Cancelled
0101044D   JMP 014AFEB6                      False code VM entry point                                         Cancelled
01010482   JMP 014B08C7                      False code VM entry point                                         Cancelled
010104B2   JMP 014B08C7                      False code VM entry point                                         Cancelled
010104DB   CALL 014B0B90                     False code VM entry point                                         Cancelled
010104F3   CALL 014AB4A7                     False code VM entry point                                         Cancelled
01010521   CALL 014B1D60                     False code VM entry point                                         Cancelled
01010576   JMP 014B08C7                      False code VM entry point                                         Cancelled
010105D0   CALL 014AC1E4                     False code VM entry point                                         Cancelled
010105D9   CALL 014AADEB                     False code VM entry point                                         Cancelled
010105F9   JMP 014AD59C                      False code VM entry point                                         Cancelled
01010638   CALL 014AC2AB                     False code VM entry point                                         Cancelled
0101063D   CALL 014AC50F                     False code VM entry point                                         Cancelled
01010695   JMP 014B0818                      False code VM entry point                                         Cancelled
0101070D   JMP 014ADE85                      False code VM entry point                                         Cancelled
01010737   JMP 014B191F                      False code VM entry point                                         Cancelled
01010741   CALL 014AC52B                     False code VM entry point                                         Cancelled
01010769   JMP 014B08C7                      False code VM entry point                                         Cancelled
01010781   CALL 014AB0F6                     False code VM entry point                                         Cancelled
010107A2   CALL 014B0F30                     False code VM entry point                                         Cancelled
01010A3E   CALL 017774AE                     kernel32.InitializeCriticalSection                                Done
01010A4F   CALL 016B67C3                     kernel32.QueryPerformanceCounter                                  Done
01010B20   JMP 01721598                      Function is coded VM                                              Postponed
01010B58   CALL 014ADF69                     False code VM entry point                                         Cancelled
01010B75   JMP 014AB9BF                      False code VM entry point                                         Cancelled
01010B85   JMP 014B1756                      False code VM entry point                                         Cancelled
01010BC6   JMP 014AD59C                      False code VM entry point                                         Cancelled
01010BDB   JMP 014AB856                      False code VM entry point                                         Cancelled
01010BFF   CALL 014B0BB0                     False code VM entry point                                         Cancelled
01010C1D   JMP 014B0923                      False code VM entry point                                         Cancelled
01010C4C   JMP 014AB366                      False code VM entry point                                         Cancelled
01010C59   CALL 014AE45E                     False code VM entry point                                         Cancelled
01010CCA   CALL 014ABFF6                     False code VM entry point                                         Cancelled
01010CD8   CALL 014AD2DD                     Function is coded VM                                              Postponed
01010CDD   CALL 014AFD67                     False code VM entry point                                         Cancelled
01010D23   CALL 014AC5F9                     False code VM entry point                                         Cancelled
01010D7C   JMP 014AB366                      False code VM entry point                                         Cancelled
01010D9B   CALL 014B1FD5                     False code VM entry point                                         Cancelled
01010DAF   JMP 014AD59C                      False code VM entry point                                         Cancelled
01010DF1   JMP 014ACC69                      False code VM entry point                                         Cancelled
01010E38   JMP 014ADD61                      False code VM entry point                                         Cancelled
01010E3D   JMP 014AB4BB                      False code VM entry point                                         Cancelled
01010E60   JMP 016B73E5                      Function is coded VM                                              Postponed
01010E96   CALL 014B1760                     False code VM entry point                                         Cancelled
01010EE8   CALL 014B1CA2                     False code VM entry point                                         Cancelled
01010EED   JMP 014ABC00                      False code VM entry point                                         Cancelled
01010F16   CALL 014AE159                     False code VM entry point                                         Cancelled
01010F20   JMP 014B1AA7                      False code VM entry point                                         Cancelled
01010F2A   CALL 014AD3AD                     Function is coded VM                                              Postponed
01010F34   JMP 014AD16A                      False code VM entry point                                         Cancelled
01010F83   JMP 014AD59C                      False code VM entry point                                         Cancelled
01010FA4   CALL 014AFA68                     False code VM entry point                                         Cancelled
01010FE0   CALL 014B2285                     False code VM entry point                                         Cancelled
0101100B   JMP 014B1E56                      False code VM entry point                                         Cancelled
01011011   JMP 014AEA11                      False code VM entry point                                         Cancelled
01011067   CALL 014AE5C9                     False code VM entry point                                         Cancelled
01011088   JMP 014AD4DA                      False code VM entry point                                         Cancelled
01011091   CALL 014AC380                     False code VM entry point                                         Cancelled
010110E7   CALL 014AE200                     False code VM entry point                                         Cancelled
01011161   JMP 014B08C7                      False code VM entry point                                         Cancelled
01011184   JMP 014AB366                      False code VM entry point                                         Cancelled
0101118A   JMP 014AFAA5                      False code VM entry point                                         Cancelled
01011194   JMP 014AE3F8                      False code VM entry point                                         Cancelled
010111B8   JMP 014B08C7                      False code VM entry point                                         Cancelled
01011295   CALL 0152941A                     kernel32.RtlDeleteCriticalSection                                 Done
010114A7   CALL 017E20B9                     kernel32.QueryPerformanceCounter                                  Done
01011519   CALL 0185E189                     kernel32.RtlEnterCriticalSection                                  Done
01011532   CALL 016AC9A6                     kernel32.RtlLeaveCriticalSection                                  Done
01011547   CALL 016ECAAD                     kernel32.QueryPerformanceCounter                                  Done
01011552   CALL 017AA716                     kernel32.QueryPerformanceFrequency                                Done
010115FC   CALL 017A9DEF                     kernel32.RtlEnterCriticalSection                                  Done
01011666   CALL 016163DF                     kernel32.RtlLeaveCriticalSection                                  Done
010117BC   CALL 015EE884                     kernel32.RtlLeaveCriticalSection                                  Done
010117DF   CALL 0184B0D0                     kernel32.RtlEnterCriticalSection                                  Done
0101186E   CALL 018405B3                     kernel32.RtlLeaveCriticalSection                                  Done
01011947   CALL 01596979                     kernel32.QueryPerformanceCounter                                  Done
01011986   CALL 01566A4A                     kernel32.RtlLeaveCriticalSection                                  Done
010119FB   CALL 0167BDB9                     kernel32.CreateEventW                                             Done
01011A20   CALL 0185CE47                     kernel32.CloseHandle                                              Done
01011A5B   CALL 016D1B54                     kernel32.InitializeCriticalSection                                Done
01011AC1   CALL 0184C59F                     kernel32.CloseHandle                                              Done
01011AED   CALL 01836EE8                     kernel32.RtlDeleteCriticalSection                                 Done
01011B19   CALL 017ECAC4                     kernel32.RtlEnterCriticalSection                                  Done
01011B31   CALL 01738CAD                     kernel32.RtlLeaveCriticalSection                                  Done
01011B41   CALL 017118AD                     kernel32.Sleep                                                    Done
01011B5B   CALL 016195D2                     kernel32.RtlLeaveCriticalSection                                  Done
01011C1B   CALL 018A8A28                     kernel32.SetEvent                                                 Done
01011C25   CALL 0160AA3C                     kernel32.RtlLeaveCriticalSection                                  Done
01011C4F   CALL 01608736                     kernel32.RtlEnterCriticalSection                                  Done
01011C91   CALL 01643578                     kernel32.RtlLeaveCriticalSection                                  Done
01011CA6   CALL 01609DD8                     kernel32.WaitForSingleObject                                      Done
01011CB4   CALL 0174B727                     kernel32.RtlEnterCriticalSection                                  Done
01011CC1   CALL 014B63D7                     kernel32.RtlLeaveCriticalSection                                  Done
01011D12   CALL 015079AB                     kernel32.WaitForSingleObject                                      Done
01011D1C   CALL 0180AFAD                     kernel32.CloseHandle                                              Done
01011D50   CALL 01748C33                     kernel32.WaitForSingleObject                                      Done
01011D5F   CALL 015786A0                     kernel32.RtlEnterCriticalSection                                  Done
01011D97   CALL 0159D884                     kernel32.RtlLeaveCriticalSection                                  Done
01011DC2   CALL 015227AC                     kernel32.ResetEvent                                               Done
01011DD9   CALL 01773076                     kernel32.RtlEnterCriticalSection                                  Done
01011DEA   CALL 017E4846                     kernel32.RtlLeaveCriticalSection                                  Done
01011DFB   CALL 0168F869                     kernel32.SetEvent                                                 Done
010121BC   CALL 015CAE63                     kernel32.CloseHandle                                              Done
010121EE   CALL 014B61C0                     kernel32.RtlDeleteCriticalSection                                 Done
01012246   CALL 01590D01                     ADVAPI32.RegOpenKeyExW                                            Done
01012258   CALL 018B7D86                     ADVAPI32.RegQueryValueExW                                         Done
010122D7   CALL 0167B43D                     kernel32.QueryPerformanceCounter                                  Done
01012534   CALL 016EACB4                     kernel32.QueryPerformanceCounter                                  Done
01012542   CALL 017EC58B                     kernel32.QueryPerformanceFrequency                                Done
0101272C   CALL 016EDA01                     kernel32.QueryPerformanceCounter                                  Done
0101273A   CALL 016E4E30                     kernel32.QueryPerformanceFrequency                                Done
010129C0   CALL 017A1885                     kernel32.QueryPerformanceCounter                                  Done
010129CE   CALL 017C0506                     kernel32.QueryPerformanceFrequency                                Done
01012AD5   CALL 01639D18                     kernel32.WaitForSingleObject                                      Done
01012AE7   CALL 018C54FD                     kernel32.RtlEnterCriticalSection                                  Done
01012AF8   CALL 0168D7AC                     kernel32.RtlLeaveCriticalSection                                  Done
01012BD2   CALL 0187C526                     kernel32.SetThreadExecutionState                                  Done
01012BEC   CALL 018C20D3                     kernel32.QueryPerformanceCounter                                  Done
01012C37   CALL 01741B06                     kernel32.WaitForSingleObject                                      Done
01012C52   CALL 017E2E8E                     kernel32.RtlEnterCriticalSection                                  Done
01012C60   CALL 017D2CCF                     kernel32.RtlLeaveCriticalSection                                  Done
01012C98   CALL 018B93ED                     kernel32.RtlEnterCriticalSection                                  Done
01012CCF   CALL 014B2AA7                     kernel32.CloseHandle                                              Done
01012D54   CALL 015B22C2                     kernel32.RtlDeleteCriticalSection                                 Done
01012D7F   CALL 014D86F2                     kernel32.QueryPerformanceCounter                                  Done
0101390A   CALL 01884BAC                     ADVAPI32.RegOpenKeyExW                                            Done
01013914   CALL 01534CDB                     ADVAPI32.RegQueryValueExW                                         Done
010139D0   JMP 0150B559                      Function is coded VM                                              Postponed
01013A03   JMP 014B21F4                      False code VM entry point                                         Cancelled
01013A29   CALL 014AC009                     False code VM entry point                                         Cancelled
01013A33   CALL 014AD34D                     False code VM entry point                                         Cancelled
01013A67   JMP 014AB366                      False code VM entry point                                         Cancelled
01013ABE   JMP 014AB366                      False code VM entry point                                         Cancelled
01013AD4   JMP 014B1A79                      False code VM entry point                                         Cancelled
01013B25   JMP 014B08C7                      False code VM entry point                                         Cancelled
01013B71   JMP 014AB366                      False code VM entry point                                         Cancelled
01013BB3   CALL 014AFA0A                     False code VM entry point                                         Cancelled
01013BC7   CALL 014B1C0D                     Function is coded VM                                              Postponed
01013BCD   JMP 014ABDE6                      Function is coded VM                                              Postponed
01013BD6   JMP 014B0B10                      False code VM entry point                                         Cancelled
01013BF3   CALL 014B2192                     False code VM entry point                                         Cancelled
01013C09   CALL 014ACD1B                     False code VM entry point                                         Cancelled
01013CAC   CALL 014B0B7E                     False code VM entry point                                         Cancelled
01013CB1   JMP 014AAD3F                      False code VM entry point                                         Cancelled
01013CB8   JMP 014AB3D0                      False code VM entry point                                         Cancelled
01013D1D   JMP 014AB366                      False code VM entry point                                         Cancelled
01013D25   JMP 014AB2CD                      False code VM entry point                                         Cancelled
01013D41   CALL 014B1FF6                     False code VM entry point                                         Cancelled
01013D4B   JMP 014AE136                      False code VM entry point                                         Cancelled
01013D55   CALL 014AE2EE                     False code VM entry point                                         Cancelled
01013D5A   JMP 014AB295                      Function is coded VM                                              Postponed
01013D64   CALL 014AE04C                     False code VM entry point                                         Cancelled
01013DC5   JMP 014B0038                      False code VM entry point                                         Cancelled
01013DE8   CALL 014ADCC3                     False code VM entry point                                         Cancelled
01013E6A   JMP 014AD072                      False code VM entry point                                         Cancelled
01013E7B   JMP 014B0880                      False code VM entry point                                         Cancelled
01013EDD   CALL 014B048C                     False code VM entry point                                         Cancelled
01013EFC   JMP 014AC9CE                      False code VM entry point                                         Cancelled
01013F45   JMP 014AC996                      False code VM entry point                                         Cancelled
01013F67   CALL 014AB405                     False code VM entry point                                         Cancelled
01013F88   CALL 014AFFFD                     False code VM entry point                                         Cancelled
01013F8D   CALL 014ACEBD                     False code VM entry point                                         Cancelled
01013FA6   JMP 014AE4D1                      False code VM entry point                                         Cancelled
01013FAE   JMP 014AD608                      False code VM entry point                                         Cancelled
01013FCB   CALL 014ABD05                     False code VM entry point                                         Cancelled
01013FD9   JMP 014AE6A0                      False code VM entry point                                         Cancelled
01013FF2   CALL 014B0366                     Error at determine type VM entry point                            Error
0101406E   CALL 015077F7                     ADVAPI32.RegOpenKeyExW                                            Done
0101407C   CALL 0169C71E                     ADVAPI32.RegQueryValueExW                                         Done
01014143   CALL 016AC6F8                     kernel32.RtlEnterCriticalSection                                  Done
0101415F   CALL 01694513                     kernel32.RtlLeaveCriticalSection                                  Done
010143AA   CALL 016C8DD8                     kernel32.QueryPerformanceCounter                                  Done
010143E3   CALL 01571604                     Function is coded VM                                              Postponed
0101441E   JMP 01674355                      Function is coded VM                                              Postponed
0101453F   CALL 015EFBF2                     kernel32.Sleep                                                    Done
01014596   CALL 01613D64                     kernel32.QueryPerformanceCounter                                  Done
010145C5   CALL 0162BBA9                     kernel32.QueryPerformanceFrequency                                Done
010146F3   CALL 0155A106                     kernel32.RtlEnterCriticalSection                                  Done
0101470C   CALL 015A210C                     kernel32.RtlLeaveCriticalSection                                  Done
0101480D   JMP 0161AC34                      Function is coded VM                                              Postponed
01014837   JMP 014AC984                      False code VM entry point                                         Cancelled
01014849   JMP 014AFE8C                      False code VM entry point                                         Cancelled
01014855   CALL 014ACC77                     False code VM entry point                                         Cancelled
01014860   JMP 014ABC6B                      False code VM entry point                                         Cancelled
0101488C   CALL 014ADC3C                     False code VM entry point                                         Cancelled
010148AD   CALL 014ABE71                     Function is coded VM                                              Postponed
010149F4   CALL 01657082                     kernel32.CloseHandle                                              Done
01014A3F   CALL 016E4849                     kernel32.RtlEnterCriticalSection                                  Done
01014A62   CALL 01550A69                     kernel32.RtlLeaveCriticalSection                                  Done
01014A7A   CALL 0161491D                     kernel32.QueryPerformanceFrequency                                Done
01014C1A   CALL 014E54A7                     kernel32.CloseHandle                                              Done
01014C34   CALL 01646D46                     kernel32.RtlDeleteCriticalSection                                 Done
01014C7C   CALL 0171F619                     ADVAPI32.RegCreateKeyW                                            Done
01014D86   CALL 0150A3DA                     ADVAPI32.RegOpenKeyExW                                            Done
01014D94   CALL 014EE606                     ADVAPI32.RegQueryValueExW                                         Done
01014E94   CALL 016DCB20                     kernel32.CreateFileW                                              Done
01014EC0   CALL 016AF391                     kernel32.GetFileInformationByHandle                               Done
01014ECB   CALL 016B096F                     kernel32.CloseHandle                                              Done
01014F01   CALL 016BF6A4                     kernel32.CloseHandle                                              Done
01014F30   CALL 0183824A                     kernel32.ReadFile                                                 Done
01014F9E   CALL 01F8D4B2                     False code VM entry point                                         Cancelled
01015009   CALL 0157A02F                     kernel32.ReadFile                                                 Done
01015014   CALL 01845F2C                     kernel32.CloseHandle                                              Done
01015038   CALL 016C4A9F                     kernel32.CloseHandle                                              Done
0101509D   CALL 01657DBB                     kernel32.CloseHandle                                              Done
010150AE   CALL 0170A654                     kernel32.CloseHandle                                              Done
010150D2   CALL 015265D4                     kernel32.CloseHandle                                              Done
010151A3   CALL 018820A7                     kernel32.CreateFileW                                              Done
010151D6   CALL 0157A426                     kernel32.ReadFile                                                 Done
01015253   CALL 017EDF39                     kernel32.CloseHandle                                              Done
01015292   CALL 0152E187                     kernel32.ReadFile                                                 Done
010152BA   CALL 01706F97                     kernel32.CloseHandle                                              Done
010152DA   CALL 016990C5                     kernel32.CloseHandle                                              Done
010152F8   CALL 01587FF4                     kernel32.CloseHandle                                              Done
01017274   CALL 0155145F                     kernel32.RtlEnterCriticalSection                                  Done
01017293   CALL 01684D2F                     kernel32.RtlLeaveCriticalSection                                  Done
010172AD   CALL 017D0988                     kernel32.RtlEnterCriticalSection                                  Done
010172CD   CALL 015AE4AA                     kernel32.RtlLeaveCriticalSection                                  Done
010173B6   CALL 016371E4                     COMDLG32.GetOpenFileNameW                                         Done
01017429   CALL 0154811D                     COMDLG32.GetSaveFileNameW                                         Done
01017477   CALL 016528FA                     kernel32.GetLocaleInfoW                                           Done
01017550   JMP 014B5BD7                      Function is coded VM                                              Postponed
010175A3   JMP 014ADFAE                      False code VM entry point                                         Cancelled
0101760B   JMP 014AB7F7                      False code VM entry point                                         Cancelled
0101761A   JMP 014B179E                      False code VM entry point                                         Cancelled
01017930   JMP 01531C1E                      Function is coded VM                                              Postponed
01017966   JMP 014B1AC1                      Function is coded VM                                              Postponed
01017D66   CALL 016654BA                     ADVAPI32.RegOpenKeyExW                                            Done
01017D74   CALL 014DCD53                     ADVAPI32.RegQueryValueExW                                         Done
01017E4F   CALL 014E07B5                     COMDLG32.GetOpenFileNameW                                         Done
01017EC2   CALL 01843946                     ADVAPI32.RegCreateKeyW                                            Done
01018295   CALL 01841D8E                     SHLWAPI.PathIsFileSpecW                                           Done
010182A8   CALL 01711310                     kernel32.GetCurrentDirectoryW                                     Done
010182B4   CALL 01663539                     SHLWAPI.PathAppendW                                               Done
01018317   CALL 0150281E                     kernel32.GetCommandLineW                                          Done
01018728   CALL 016005EF                     SHLWAPI.PathRemoveExtensionW                                      Done
01018840   JMP 0175AE61                      Function is coded VM                                              Postponed
01018880   JMP 017A15B9                      Function is coded VM                                              Postponed
010188C1   JMP 01663844                      Function is coded VM                                              Postponed
010192A0   JMP 0165F3B4                      Function is coded VM                                              Postponed
010192C4   JMP 014AB352                      False code VM entry point                                         Cancelled
010192F0   JMP 018CBCAF                      Function is coded VM                                              Postponed
01019300   CALL 014AE470                     False code VM entry point                                         Cancelled
01019318   CALL 014ACFE1                     Function is coded VM                                              Postponed
0101933B   CALL 014ABF18                     False code VM entry point                                         Cancelled
0101936D   CALL 014AF9D1                     Function is coded VM                                              Postponed
010193B2   CALL 014AC1EF                     False code VM entry point                                         Cancelled
0101940C   CALL 014AB1C0                     False code VM entry point                                         Cancelled
01019420   JMP 0181F362                      Function is coded VM                                              Postponed
01019435   CALL 014ACED9                     False code VM entry point                                         Cancelled
01019562   CALL 014AD162                     Function is coded VM                                              Postponed
0101956E   JMP 014B033E                      False code VM entry point                                         Cancelled
0101957C   CALL 014AB462                     False code VM entry point                                         Cancelled
0101958E   JMP 014AFC18                      Error at determine type VM entry point                            Error
010195A0   JMP 014E084A                      Function is coded VM                                              Postponed
010195D1   CALL 014AEE6F                     False code VM entry point                                         Cancelled
010195EB   JMP 014B1159                      False code VM entry point                                         Cancelled
010195FC   JMP 014AD59C                      False code VM entry point                                         Cancelled
010196C4   JMP 014AB965                      False code VM entry point                                         Cancelled
010196DD   JMP 014AB366                      False code VM entry point                                         Cancelled
010196E5   JMP 014B151D                      False code VM entry point                                         Cancelled
01019702   JMP 014AB366                      False code VM entry point                                         Cancelled
01019712   CALL 014B0D20                     False code VM entry point                                         Cancelled
01019720   JMP 01749C15                      Function is coded VM                                              Postponed
01019759   JMP 014AB366                      False code VM entry point                                         Cancelled
01019766   JMP 014AAE64                      False code VM entry point                                         Cancelled
01019779   JMP 014AE7A0                      False code VM entry point                                         Cancelled
010197C5   JMP 014B08C7                      False code VM entry point                                         Cancelled
010197CD   JMP 014B0B70                      False code VM entry point                                         Cancelled
010197E9   CALL 014AC226                     False code VM entry point                                         Cancelled
010197FA   CALL 014AC7E5                     False code VM entry point                                         Cancelled
01019CC6   CALL 016B26ED                     kernel32.GetModuleHandleW                                         Done
01019CD8   CALL 0179FD44                     False code VM entry point                                         Cancelled
01019CE1   CALL 0156B921                     kernel32.SizeofResource                                           Done
01019CFA   CALL 018A785E                     False code VM entry point                                         Cancelled
01019D02   CALL 015C862A                     kernel32.SetHandleCount                                           Done
01019D21   CALL 0184655F                     kernel32.FreeResource                                             Done
01019E09   CALL 015B176C                     kernel32.CreateFileW                                              Done
01019E33   CALL 0169C7D4                     kernel32.SetFilePointer                                           Done
01019E64   CALL 0167A250                     kernel32.CloseHandle                                              Done
01019E8F   CALL 017D672C                     kernel32.ReadFile                                                 Done
01019EA0   CALL 018631A0                     kernel32.CloseHandle                                              Done
0101CB0A   CALL 0159C70D                     kernel32.RtlEnterCriticalSection                                  Done
0101CB2B   CALL 01627C80                     kernel32.RtlLeaveCriticalSection                                  Done
0101D297   CALL 017E5F04                     kernel32.WideCharToMultiByte                                      Done
0101E374   CALL 0150058D                     kernel32.InitializeCriticalSection                                Done
0101E3FF   CALL 0158BC7F                     kernel32.RtlDeleteCriticalSection                                 Done
0101E45D   CALL 0173D2B0                     SHELL32.SHGetFolderPathW                                          Done
0101E467   CALL 015C85FD                     SHLWAPI.PathAppendW                                               Done
0101E53A   CALL 017CD4EC                     kernel32.RtlEnterCriticalSection                                  Done
0101E6C8   CALL 01774503                     kernel32.GetSystemTime                                            Done
0101E7E4   CALL 016AAECB                     kernel32.RtlLeaveCriticalSection                                  Done
0101E82D   CALL 016811A0                     kernel32.RtlEnterCriticalSection                                  Done
0101E8C1   CALL 0162B6CA                     kernel32.GetSystemTime                                            Done
0101E913   CALL 016FA9B3                     kernel32.RtlLeaveCriticalSection                                  Done
0101E98C   CALL 017D0CEB                     kernel32.RtlEnterCriticalSection                                  Done
0101E9E5   CALL 015F57A3                     kernel32.RtlLeaveCriticalSection                                  Done
0101EA22   CALL 015E900F                     kernel32.RtlLeaveCriticalSection                                  Done
0101EB29   CALL 0186C9A6                     kernel32.GetSystemTime                                            Done
0101EBD1   CALL 015238C9                     kernel32.RtlEnterCriticalSection                                  Done
0101ED00   CALL 0153009A                     kernel32.RtlEnterCriticalSection                                  Done
0101ED20   CALL 015CE065                     kernel32.RtlLeaveCriticalSection                                  Done
0101ED5E   CALL 0160F573                     kernel32.RtlLeaveCriticalSection                                  Done
0101ED8E   CALL 01867D3C                     GDI32.CreateCompatibleDC                                          Done
0101ED99   CALL 0181D67B                     GDI32.GetDeviceCaps                                               Done
0101EDA2   CALL 017AA711                     GDI32.DeleteDC                                                    Done
0101EDE9   CALL 014E5746                     GDI32.CreateFontIndirectW                                         Done
0101EED2   CALL 0162C12C                     GDI32.DeleteObject                                                Done
0101EF6C   CALL 0165902A                     USER32.ReleaseCapture                                             Done
0101EF83   CALL 0155ED54                     USER32.DestroyWindow                                              Done
0101F00B   CALL 0158C5B0                     USER32.PtInRect                                                   Done
0101F063   CALL 016D4DA6                     GDI32.SelectObject                                                Done
0101F069   CALL 0186A682                     USER32.GetSysColor                                                Done
0101F085   CALL 01809EEF                     GDI32.SetTextColor                                                Done
0101F095   CALL 015B9FEB                     GDI32.SetBkColor                                                  Done
0101F131   CALL 015B9E9D                     GDI32.SelectObject                                                Done
0101F14F   CALL 016B07AA                     GDI32.SetTextColor                                                Done
0101F16D   CALL 01622A2A                     GDI32.SetBkColor                                                  Done
0101F19F   CALL 015C704B                     GDI32.TextOutW                                                    Done
0101F1C3   CALL 016FF57C                     GDI32.SelectObject                                                Done
0101F6A1   CALL 01583505                     USER32.GetDC                                                      Done
0101F6B7   CALL 0172C2B4                     GDI32.SelectObject                                                Done
0101F755   CALL 018C9F04                     GDI32.GetTextExtentExPointW                                       Done
0101F8A9   CALL 0186776B                     GDI32.GetTextExtentExPointW                                       Done
0101F9DD   CALL 01545685                     GDI32.SelectObject                                                Done
0101F9E8   CALL 01845F41                     USER32.ReleaseDC                                                  Done
0101FAEB   CALL 01741751                     USER32.GetSystemMetrics                                           Done
0101FB07   CALL 017D0B34                     USER32.MoveWindow                                                 Done
0101FB34   CALL 016CAA69                     USER32.SetScrollInfo                                              Done
0101FB9F   CALL 014EF7FE                     USER32.GetSystemMetrics                                           Done
0101FE44   CALL 0160B8EB                     USER32.MessageBoxW                                                Done
01020242   CALL 0161F681                     USER32.GetSystemMetrics                                           Done
01020263   CALL 017ADEFA                     kernel32.GetModuleHandleW                                         Done
0102028B   CALL 018C9583                     USER32.CreateWindowExW                                            Done
01020303   CALL 016A2C19                     USER32.SetScrollInfo                                              Done
010203BF   CALL 0187625B                     USER32.GetScrollInfo                                              Done
01020468   CALL 0160409A                     USER32.SetScrollInfo                                              Done
0102047C   CALL 018193BD                     USER32.GetScrollInfo                                              Done
010204AB   CALL 015F624F                     USER32.GetSystemMetrics                                           Done
01020530   CALL 01551481                     kernel32.CreateFileW                                              Done
01020545   CALL 017245B5                     USER32.GetFocus                                                   Done
0102054C   CALL 016AF4AD                     USER32.MessageBoxW                                                Done
0102058F   CALL 015B34DB                     kernel32.CloseHandle                                              Done
010205FF   CALL 017A84B4                     kernel32.WideCharToMultiByte                                      Done
01020640   CALL 0174178A                     kernel32.WriteFile                                                Done
0102069A   CALL 018C022A                     kernel32.CloseHandle                                              Done
01020700   CALL 0164A304                     USER32.GetWindowLongW                                             Done
01020773   CALL 0162C1BE                     USER32.SetWindowLongW                                             Done
0102077F   CALL 014EC59E                     USER32.GetClientRect                                              Done
010207BE   CALL 014DB006                     USER32.GetUpdateRect                                              Done
010207CD   CALL 017661BC                     USER32.IsIconic                                                   Done
010207E1   CALL 01544492                     USER32.BeginPaint                                                 Done
010207EC   CALL 01564B87                     GDI32.CreateCompatibleDC                                          Done
010207FA   CALL 01561275                     USER32.GetClientRect                                              Done
0102080F   CALL 01507DD6                     GDI32.CreateCompatibleBitmap                                      Done
0102081B   CALL 0189B9FB                     GDI32.SelectObject                                                Done
0102082D   CALL 01701DDF                     USER32.FillRect                                                   Done
0102085F   CALL 01581A59                     GDI32.BitBlt                                                      Done
0102086B   CALL 014ED9B5                     GDI32.SelectObject                                                Done
01020876   CALL 016A7767                     GDI32.DeleteObject                                                Done
0102087D   CALL 018ADB7A                     GDI32.DeleteDC                                                    Done
01020889   CALL 0183A847                     USER32.EndPaint                                                   Done
01020911   CALL 017FD414                     USER32.GetSystemMetrics                                           Done
0102093A   CALL 0171F1B6                     USER32.GetCursorPos                                               Done
01020946   CALL 015762D0                     USER32.ScreenToClient                                             Done
01020967   CALL 0163298E                     USER32.LoadCursorW                                                Done
0102096E   CALL 0189A563                     USER32.SetCursor                                                  Done
01020995   CALL 018CBEE1                     USER32.DefWindowProcW                                             Done
01020A07   CALL 0158AF87                     USER32.ScrollWindow                                               Done
01020A0E   CALL 01828419                     USER32.UpdateWindow                                               Done
01020A26   CALL 016944B5                     USER32.ReleaseCapture                                             Done
01020A38   CALL 0179D9E7                     USER32.GetCursorPos                                               Done
01020A44   CALL 01659A6E                     USER32.ScreenToClient                                             Done
01020AE0   JMP 015081FE                      Function is coded VM                                              Postponed
01020AE6   CALL 01843901                     SHELL32.ShellExecuteW                                             Done
01020B0A   CALL 01682F53                     USER32.OpenClipboard                                              Done
01020B1D   CALL 0152E16B                     USER32.EmptyClipboard                                             Done
01020B4D   CALL 01703BB7                     kernel32.GlobalAlloc                                              Done
01020B5A   CALL 01565BE0                     kernel32.GlobalLock                                               Done
01020B74   CALL 016325A1                     kernel32.GlobalUnlock                                             Done
01020B7D   CALL 016D6EC2                     USER32.SetClipboardData                                           Done
01020B88   CALL 0185069F                     USER32.CloseClipboard                                             Done
01020BA3   CALL 0184186A                     USER32.MessageBoxW                                                Done
01020BBD   CALL 01746435                     USER32.PostMessageW                                               Done
01020BD1   CALL 0157D8A1                     USER32.MessageBoxW                                                Done
01020BE3   JMP 016E1C7B                      Function is coded VM                                              Postponed
01020BEA   CALL 01861EEA                     SHELL32.ShellExecuteW                                             Done
01020BFA   CALL 0167A298                     USER32.GetCursorPos                                               Done
01020C06   CALL 0189BA19                     USER32.ScreenToClient                                             Done
01020C2E   CALL 0188BEF2                     USER32.SetCapture                                                 Done
01020C35   CALL 0151FB6B                     USER32.SetFocus                                                   Done
01020C6E   CALL 0161C71E                     USER32.DefWindowProcW                                             Done
01020D10   JMP 018285D0                      Function is coded VM                                              Postponed
01020D56   CALL 014AD109                     Function is coded VM                                              Postponed
01020D6C   JMP 014AE592                      False code VM entry point                                         Cancelled
01020D72   JMP 014B215B                      False code VM entry point                                         Cancelled
01020D77   CALL 014AB90E                     False code VM entry point                                         Cancelled
01020E2B   CALL 017ED005                     USER32.GetDlgItemInt                                              Done
01020E4D   CALL 016F71A2                     USER32.SetDlgItemInt                                              Done
01020E80   CALL 017566C1                     USER32.SetDlgItemTextW                                            Done
01020EAF   CALL 017AF4D8                     USER32.SetDlgItemTextW                                            Done
01020FB6   CALL 016ED848                     ADVAPI32.RegOpenKeyExW                                            Done
01020FD4   CALL 0173B57E                     ADVAPI32.RegQueryValueExW                                         Done
0102111E   CALL 018C1375                     kernel32.GetSystemInfo                                            Done
01021154   CALL 0152A125                     ADVAPI32.RegQueryValueExW                                         Done
01021167   JMP 016C68A8                      Function is coded VM                                              Postponed
0102118F   JMP 017ED131                      Function is coded VM                                              Postponed
010211C1   CALL 016E2AEF                     USER32.GetDlgItem                                                 Done
010211EE   CALL 016F3922                     COMCTL32.CreateUpDownControl                                      Done
01021209   CALL 016C9441                     USER32.SetDlgItemInt                                              Done
01021224   CALL 016E843C                     USER32.SetDlgItemInt                                              Done
01021262   CALL 01608835                     USER32.GetDlgItemInt                                              Done
01021274   JMP 017ED06C                      Function is coded VM                                              Postponed
010212DA   CALL 01561AA1                     USER32.SetWindowLongW                                             Done
010213B7   CALL 0184835E                     USER32.SetDlgItemTextW                                            Done
01021448   CALL 014D9E59                     USER32.SetDlgItemTextW                                            Done
01021456   CALL 01862685                     USER32.IsDlgButtonChecked                                         Done
01021465   CALL 0168BF80                     USER32.GetDlgItem                                                 Done
01021479   CALL 016FFC57                     USER32.GetDlgItem                                                 Done
010214CC   CALL 015FC241                     USER32.SetDlgItemTextW                                            Done
0102158A   CALL 017B0054                     ADVAPI32.RegOpenKeyExW                                            Done
01021594   CALL 015A2A3B                     ADVAPI32.RegQueryValueExW                                         Done
01021603   CALL 0171D93E                     USER32.CheckDlgButton                                             Done
01021610   CALL 01683DFE                     USER32.GetDlgItem                                                 Done
01021624   CALL 017D5C2E                     USER32.GetDlgItem                                                 Done
010216F4   CALL 015FBF91                     USER32.GetDlgItemTextW                                            Done
01021754   CALL 0166353E                     USER32.IsDlgButtonChecked                                         Done
01021790   CALL 017D5E80                     USER32.SetWindowLongW                                             Done
01021885   CALL 0178E411                     USER32.SetDlgItemTextW                                            Done
01021890   CALL 016B29E0                     USER32.IsDlgButtonChecked                                         Done
0102189A   CALL 017D2C73                     USER32.GetDlgItem                                                 Done
010218DB   CALL 01820058                     USER32.SetDlgItemTextW                                            Done
01021945   CALL 01510B04                     ADVAPI32.RegOpenKeyExW                                            Done
01021953   CALL 018C0A15                     ADVAPI32.RegQueryValueExW                                         Done
010219BD   CALL 0161B5EC                     USER32.CheckDlgButton                                             Done
010219E4   CALL 015B2039                     USER32.GetDlgItem                                                 Done
01021A28   CALL 015DD946                     USER32.GetDlgItemTextW                                            Done
01021A87   CALL 017C0501                     kernel32.GetDriveTypeW                                            Done
01021A9F   JMP 01801C99                      Function is coded VM                                              Postponed
01021AA6   CALL 016AF3A6                     USER32.MessageBoxW                                                Done
01021AAF   CALL 014EDF11                     USER32.IsDlgButtonChecked                                         Done
01021AEE   CALL 0171C17A                     USER32.SetWindowLongW                                             Done
01021E3F   CALL 0177355D                     USER32.GetDlgItem                                                 Done
01021EBE   CALL 016AF73B                     USER32.SetDlgItemTextW                                            Done
01021F69   CALL 015FBFA6                     USER32.CheckDlgButton                                             Done
01022011   CALL 015B4EB5                     USER32.GetDlgItem                                                 Done
01022033   CALL 017D5F65                     USER32.GetDlgItem                                                 Done
01022130   CALL 014B5843                     USER32.IsDlgButtonChecked                                         Done
01022149   CALL 016FB1F4                     ADVAPI32.RegCreateKeyW                                            Done
0102217E   CALL 01638547                     USER32.SetWindowLongW                                             Done
0102229F   CALL 016CDAB9                     USER32.PostMessageW                                               Done
010223F7   CALL 0167E5F5                     COMCTL32.PropertySheetW                                           Done
0102250A   CALL 0155D01A                     USER32.GetDlgItemTextW                                            Done
0102262F   CALL 01581B29                     USER32.GetDlgItem                                                 Done
01022655   CALL 0166DFB0                     USER32.GetScrollInfo                                              Done
0102266D   CALL 018A9CAC                     USER32.SetScrollInfo                                              Done
0102271A   CALL 0167E566                     USER32.SetDlgItemTextW                                            Done
01022778   CALL 01826C7C                     kernel32.CreateFileW                                              Done
0102278B   CALL 01839E06                     kernel32.SetFilePointer                                           Done
010227B8   CALL 0161C723                     kernel32.CloseHandle                                              Done
010227CD   CALL 0173C8A7                     kernel32.ReadFile                                                 Done
010227D4   CALL 0159499C                     kernel32.CloseHandle                                              Done
010227F0   CALL 014EC225                     USER32.SetDlgItemTextW                                            Done
01022823   CALL 0171183F                     USER32.SetDlgItemTextA                                            Done
010229CE   CALL 01841DD3                     USER32.GetDlgItemTextW                                            Done
01022AB2   JMP 0153D321                      Function is coded VM                                              Postponed
01022AB9   CALL 016DDE45                     USER32.MessageBoxW                                                Done
01022AEB   CALL 01799C35                     kernel32.CreateFileW                                              Done
01022B25   CALL 015E034A                     kernel32.WriteFile                                                Done
01022B2C   CALL 0153974C                     kernel32.CloseHandle                                              Done
01022B9A   CALL 017087B3                     USER32.SetDlgItemTextW                                            Done
01022C0B   CALL 0154F6A2                     ADVAPI32.RegOpenKeyExW                                            Done
01022C19   CALL 0159CD54                     ADVAPI32.RegQueryValueExW                                         Done
01022D61   CALL 01796A9F                     COMDLG32.GetSaveFileNameW                                         Done
01022E22   CALL 016CC196                     USER32.GetDlgItem                                                 Done
01022E34   CALL 017401CA                     USER32.SetScrollInfo                                              Done
01022E64   CALL 0185B02B                     USER32.CallWindowProcW                                            Done
01022ED1   CALL 015BE9A1                     USER32.SetWindowTextW                                             Done
01023061   CALL 0151F96B                     USER32.GetDlgItem                                                 Done
010230A5   CALL 0150788A                     USER32.DestroyWindow                                              Done
010230C3   CALL 0162ACAE                     USER32.SetDlgItemTextW                                            Done
01023138   CALL 014B4B89                     USER32.GetDlgItemTextW                                            Done
010231BB   CALL 017798DA                     USER32.EndDialog                                                  Done
010231CC   CALL 01773080                     USER32.GetDlgItem                                                 Done
010231DC   CALL 01573FFA                     USER32.SetWindowLongW                                             Done
0102322F   CALL 016D1B2E                     USER32.SetDlgItemTextW                                            Done
010232C8   CALL 016AF1C9                     USER32.GetDlgItem                                                 Done
010232D6   CALL 01621001                     USER32.SetWindowLongW                                             Done
010232EE   CALL 016189DF                     USER32.SetWindowTextW                                             Done
01023423   CALL 016D9521                     USER32.SetDlgItemTextW                                            Done
010234CC   JMP 0171BA65                      Function is coded VM                                              Postponed
010234D3   CALL 0162D35E                     USER32.MessageBoxW                                                Done
01023562   JMP 01734974                      Function is coded VM                                              Postponed
01023569   CALL 0166591D                     USER32.MessageBoxW                                                Done
010235A2   JMP 01600FD1                      Function is coded VM                                              Postponed
010235B0   CALL 018A76ED                     USER32.MessageBoxW                                                Done
010235C5   CALL 0182C7EA                     USER32.DestroyWindow                                              Done
010235E5   CALL 0174312E                     USER32.SetDlgItemTextW                                            Done
01023604   CALL 018976EF                     USER32.CreateDialogParamW                                         Done
0102361F   CALL 01587FF9                     USER32.SetDlgItemTextW                                            Done
01023681   CALL 0168426F                     USER32.PostMessageW                                               Done
010237B0   JMP 017BB5F2                      Function is coded VM                                              Postponed
010237E5   JMP 014ACBB6                      False code VM entry point                                         Cancelled
01023849   CALL 014B0A98                     False code VM entry point                                         Cancelled
01023859   JMP 014B1D87                      False code VM entry point                                         Cancelled
01023880   CALL 014ACD0D                     False code VM entry point                                         Cancelled
01023885   JMP 014AC194                      False code VM entry point                                         Cancelled
01023970   CALL 014ED456                     USER32.GetWindowLongW                                             Done
010239B0   CALL 015E0332                     USER32.GetUpdateRect                                              Done
010239D7   CALL 01612AA4                     USER32.BeginPaint                                                 Done
010239FB   CALL 017D86B7                     USER32.GetClientRect                                              Done
01023A0F   CALL 01528A24                     USER32.GetWindowTextW                                             Done
01023A30   CALL 0155118E                     GDI32.SelectObject                                                Done
01023A3D   CALL 017B5C7E                     GDI32.SetBkMode                                                   Done
01023A49   CALL 014E923F                     GDI32.SetTextColor                                                Done
01023A7A   CALL 017F283C                     USER32.DrawTextW                                                  Done
01023AA5   CALL 017596B0                     GDI32.GetTextExtentPointW                                         Done
01023B03   CALL 016D2617                     GDI32.SelectObject                                                Done
01023B0F   CALL 018B12F7                     USER32.EndPaint                                                   Done
01023B2C   CALL 01619004                     USER32.SetWindowLongW                                             Done
01023B69   CALL 01745487                     USER32.SetWindowLongW                                             Done
01023B71   CALL 016C542E                     USER32.GetClientRect                                              Done
01023B81   CALL 018720E0                     USER32.GetCursorPos                                               Done
01023B8D   CALL 014B2864                     USER32.ScreenToClient                                             Done
01023B9E   CALL 01899CE0                     USER32.PtInRect                                                   Done
01023BAF   CALL 017D826D                     USER32.LoadCursorW                                                Done
01023BB6   CALL 0174D4BC                     USER32.SetCursor                                                  Done
01023BE3   CALL 01874DA4                     USER32.DefWindowProcW                                             Done
01023C17   CALL 01793392                     USER32.DefWindowProcW                                             Done
01023C48   CALL 01616281                     USER32.GetWindowTextW                                             Done
01023C67   JMP 01664F79                      Function is coded VM                                              Postponed
01023C6E   CALL 01684A81                     SHELL32.ShellExecuteW                                             Done
01023C83   CALL 0166A047                     USER32.GetCursorPos                                               Done
01023C8F   CALL 01857E86                     USER32.ScreenToClient                                             Done
01023CA0   CALL 015934B7                     USER32.PtInRect                                                   Done
0102443D   CALL 016AF4B2                     kernel32.RtlEnterCriticalSection                                  Done
0102445C   CALL 014B5C25                     kernel32.RtlLeaveCriticalSection                                  Done
01024AD7   CALL 0174DCA5                     kernel32.WideCharToMultiByte                                      Done
01024B34   CALL 017ECECF                     kernel32.WideCharToMultiByte                                      Done
01024BC4   CALL 0188231C                     kernel32.WideCharToMultiByte                                      Done
01024C2C   CALL 018A89EC                     kernel32.WideCharToMultiByte                                      Done
01024CB7   CALL 0171F492                     kernel32.WideCharToMultiByte                                      Done
01024D14   CALL 017B503A                     kernel32.WideCharToMultiByte                                      Done
01024D7C   CALL 015A5E6B                     kernel32.WideCharToMultiByte                                      Done
010255C4   CALL 0172C4D0                     kernel32.WideCharToMultiByte                                      Done
01025611   CALL 01894333                     kernel32.WideCharToMultiByte                                      Done
010262F7   CALL 014B4D1D                     kernel32.WideCharToMultiByte                                      Done
01026354   CALL 0179A943                     kernel32.WideCharToMultiByte                                      Done
01026CEB   CALL 0161346B                     kernel32.InitializeCriticalSection                                Done
01026D3D   CALL 01787874                     kernel32.RtlDeleteCriticalSection                                 Done
01026E39   CALL 017C62DF                     SHELL32.SHGetFolderPathW                                          Done
01026E47   CALL 0169ABB2                     SHLWAPI.PathAppendW                                               Done
01026E79   CALL 016387E6                     kernel32.CreateDirectoryW                                         Done
01026EF6   CALL 0158D492                     kernel32.RtlEnterCriticalSection                                  Done
01026F16   CALL 016FADCA                     kernel32.RtlLeaveCriticalSection                                  Done
01027C70   JMP 015CECF8                      Function is coded VM                                              Postponed
01027C86   CALL 014AE4B8                     False code VM entry point                                         Cancelled
01027CD2   CALL 014AE294                     False code VM entry point                                         Cancelled
01027D30   JMP 0151C4E9                      Function is coded VM                                              Postponed
01027D5F   JMP 014AB366                      False code VM entry point                                         Cancelled
01027D88   JMP 014AB248                      False code VM entry point                                         Cancelled
01027E2A   CALL 014ABBE0                     False code VM entry point                                         Cancelled
01027E92   CALL 014AE46B                     False code VM entry point                                         Cancelled
01027EC6   CALL 014AE1A8                     False code VM entry point                                         Cancelled
01027ED2   CALL 014ADE7B                     Function is coded VM                                              Postponed
01027ED9   JMP 014AD93D                      False code VM entry point                                         Cancelled
01027F1C   CALL 014B0479                     False code VM entry point                                         Cancelled
01027F33   CALL 014ABE87                     False code VM entry point                                         Cancelled
01027F3D   JMP 014ADE95                      Function is coded VM                                              Postponed
010281E0   JMP 017926AD                      Function is coded VM                                              Postponed
010281FD   JMP 014B037C                      False code VM entry point                                         Cancelled
01028244   JMP 014ABD72                      False code VM entry point                                         Cancelled
01028249   JMP 014ABD56                      False code VM entry point                                         Cancelled
01028289   CALL 0174B750                     ADVAPI32.RegOpenKeyExW                                            Done
01028293   CALL 016FAC5A                     ADVAPI32.RegQueryValueExW                                         Done
0102831F   CALL 017E2D59                     ADVAPI32.RegCreateKeyW                                            Done
01028398   CALL 01563FA6                     ADVAPI32.RegOpenKeyExW                                            Done
010283A6   CALL 01574371                     ADVAPI32.RegQueryValueExW                                         Done
01028431   CALL 017E8C72                     ADVAPI32.RegCreateKeyW                                            Done
01028499   CALL 015FB76A                     ADVAPI32.RegCreateKeyW                                            Done
010284AB   CALL 0153DDFF                     ADVAPI32.RegQueryValueExW                                         Done
0102854F   CALL 014F4CFB                     ADVAPI32.RegCreateKeyW                                            Done
010285F4   CALL 01595F13                     kernel32.CreateFileA                                              Done
01028624   CALL 016B7403                     kernel32.CreateFileW                                              Done
01028654   CALL 018558F2                     kernel32.CreateFileW                                              Done
01028684   CALL 016EB62D                     kernel32.CreateFileW                                              Done
010286B7   CALL 016DA1D3                     kernel32.ReadFile                                                 Done
010286F7   CALL 017C64A7                     kernel32.WriteFile                                                Done
0102875D   CALL 0164CC43                     kernel32.SetFilePointer                                           Done
010287AD   CALL 0150E118                     kernel32.GetFileInformationByHandle                               Done
0102881D   CALL 0163F0EE                     kernel32.GetFileInformationByHandle                               Done
01028865   CALL 017EBD5D                     kernel32.SetEndOfFile                                             Done
01028875   CALL 0170488E                     kernel32.CloseHandle                                              Done
01028940   CALL 014DFCE5                     ole32.StgOpenStorage                                              Done
01028AD3   CALL 016F0542                     kernel32.GetSystemTime                                            Done
01028D3A   CALL 0158E36F                     kernel32.GetTempPathW                                             Done
01028D67   CALL 0167642F                     kernel32.GetTempFileNameW                                         Done
01028DA6   CALL 017356EF                     kernel32.CreateFileW                                              Done
01028DEA   CALL 015C767D                     kernel32.WriteFile                                                Done
01028DF8   CALL 017A1535                     kernel32.CloseHandle                                              Done
01028E12   CALL 017EFF5D                     kernel32.CloseHandle                                              Done
01028E1A   CALL 0166592E                     kernel32.CloseHandle                                              Done
01028E35   CALL 015BF4C7                     ole32.StgOpenStorage                                              Done
01028E70   CALL 015E0054                     kernel32.DeleteFileW                                              Done
01028ED3   CALL 01528A57                     kernel32.LoadLibraryA                                             Done
01028EE7   CALL 01757774                     kernel32.GetProcAddress                                           Done
01028FF7   CALL 016AF85D                     kernel32.WideCharToMultiByte                                      Done
01029014   CALL 01786F0F                     kernel32.WideCharToMultiByte                                      Done
010290D7   CALL 016318AD                     kernel32.QueryPerformanceCounter                                  Done
010290F7   CALL 015715D3                     kernel32.QueryPerformanceFrequency                                Done
01029130   CALL 0183709D                     kernel32.GetTickCount                                             Done
01029144   CALL 017ECC9A                     kernel32.MoveFileExW                                              Done
01029179   CALL 01647B37                     kernel32.SetThreadExecutionState                                  Done
01029194   CALL 01661B76                     kernel32.InitializeCriticalSection                                Done
010291A1   CALL 015C7416                     kernel32.RtlEnterCriticalSection                                  Done
010291B1   CALL 01741D7E                     kernel32.RtlLeaveCriticalSection                                  Done
010291C5   CALL 01783F88                     kernel32.RtlDeleteCriticalSection                                 Done
010291E2   CALL 01605EF6                     kernel32.Sleep                                                    Done
01029211   CALL 0157F859                     kernel32.CloseHandle                                              Done
0102924F   CALL 01883062                     kernel32.GetModuleHandleA                                         Done
01029256   CALL 0160985A                     kernel32.GetProcAddress                                           Done
01029379   CALL 015A5E7D                     kernel32.GetSystemInfo                                            Done
01029485   CALL 018C551D                     kernel32.GetSystemInfo                                            Done
01029544   CALL 017A9DEA                     kernel32.GetModuleHandleA                                         Done
0102954B   CALL 016FD16E                     kernel32.GetProcAddress                                           Done
01029618   CALL 017AB7BF                     kernel32.SetThreadPriority                                        Done
01029623   CALL 0152399F                     kernel32.ResumeThread                                             Done
0102967A   CALL 016A20D6                     kernel32.GetModuleFileNameW                                       Done
01029687   CALL 015FA555                     VERSION.GetFileVersionInfoSizeW                                   Done
010296AD   CALL 01531D97                     VERSION.GetFileVersionInfoW                                       Done
010296CB   CALL 018BB2AF                     VERSION.VerQueryValueW                                            Done
010296FF   CALL 0155F4AE                     USER32.wsprintfW                                                  Done
01029758   CALL 017F4010                     USER32.wsprintfW                                                  Done
01029823   CALL 01830B6D                     USER32.wsprintfW                                                  Done
010298C3   CALL 018A62E7                     USER32.wsprintfW                                                  Done
0102990B   CALL 017E37EF                     kernel32.IsBadReadPtr                                             Done
01029B77   CALL 017E0E43                     USER32.EmptyClipboard                                             Done
01029B94   CALL 014D2BC9                     kernel32.GlobalAlloc                                              Done
01029BA1   CALL 014EF00E                     kernel32.GlobalLock                                               Done
01029BB3   CALL 0157D7D5                     kernel32.GlobalUnlock                                             Done
01029BBC   CALL 016AC65B                     USER32.SetClipboardData                                           Done
01029BC5   CALL 017EA823                     USER32.CloseClipboard                                             Done
01029C1D   CALL 015357CB                     USER32.PostMessageW                                               Done
01029C28   CALL 01826C15                     USER32.GetDlgItem                                                 Done
01029C34   CALL 01638495                     USER32.GetWindowTextLengthA                                       Done
01029C60   CALL 016B0780                     USER32.GetWindowTextA                                             Done
01029C67   CALL 018B8BC6                     USER32.OpenClipboard                                              Done
01029C8A   CALL 017C019D                     GDI32.CreateCompatibleDC                                          Done
01029C95   CALL 01845BE6                     GDI32.GetDeviceCaps                                               Done
01029C9E   CALL 017CDBDE                     GDI32.DeleteDC                                                    Done
01029D04   CALL 0171C691                     GDI32.CreateFontIndirectW                                         Done
01029D2B   CALL 0181393E                     USER32.GetDlgItem                                                 Done
01029D32   CALL 015DB030                     USER32.SetFocus                                                   Done
01029D3D   CALL 01732592                     USER32.EndDialog                                                  Done
0102A06C   CALL 016868E7                     USER32.GetFocus                                                   Done
0102A076   CALL 015E0394                     USER32.DialogBoxIndirectParamW                                    Done
0102A0B1   CALL 015AD4AC                     USER32.MessageBoxW                                                Done
0102A0F4   CALL 017B772D                     USER32.MessageBeep                                                Done
0102A115   CALL 0167F754                     USER32.GetFocus                                                   Done
0102A11C   CALL 018B93D0                     USER32.MessageBoxW                                                Done
0102A124   CALL 01871975                     kernel32.GetCurrentProcess                                        Done
0102A18C   CALL 01814093                     kernel32.GetCurrentProcess                                        Done
0102A1C5   CALL 016AF1CE                     kernel32.SetUnhandledExceptionFilter                              Done
0102A206   CALL 0168FFE5                     VERSION.GetFileVersionInfoSizeW                                   Done
0102A23F   CALL 017E51B5                     VERSION.GetFileVersionInfoW                                       Done
0102A269   CALL 01894DC5                     VERSION.VerQueryValueW                                            Done
0102AAC2   CALL 01867D26                     ADVAPI32.RegCreateKeyW                                            Done
0102ABDD   CALL 015880B4                     ADVAPI32.RegCreateKeyW                                            Done
0102AFB0   CALL 0174635C                     ADVAPI32.RegCreateKeyW                                            Done
0102B0F0   CALL 017E3856                     kernel32.QueryPerformanceCounter                                  Done
0102B14B   CALL 0185B5DE                     kernel32.QueryPerformanceFrequency                                Done
0102CD12   CALL 0158606D                     kernel32.CreateFileW                                              Done
0102CD26   CALL 01666956                     kernel32.SetFilePointer                                           Done
0102CD53   CALL 0184652E                     kernel32.CloseHandle                                              Done
0102CD6A   CALL 016E2AD4                     kernel32.ReadFile                                                 Done
0102CD78   CALL 015F70BB                     kernel32.CloseHandle                                              Done
0102F0FC   CALL 01636A21                     kernel32.RtlEnterCriticalSection                                  Done
0102F11C   CALL 0185E72B                     kernel32.RtlLeaveCriticalSection                                  Done
01031B67   CALL 018A4D88                     kernel32.LoadLibraryA                                             Done
01031B8C   CALL 016C6923                     kernel32.GetProcAddress                                           Done
01031BC5   CALL 0159B2FC                     kernel32.LoadLibraryA                                             Done
01031BD9   CALL 01665097                     kernel32.GetProcAddress                                           Done
01031C45   CALL 0182EA4C                     kernel32.LoadLibraryA                                             Done
01031C59   CALL 01882328                     kernel32.GetProcAddress                                           Done
010325C9   JMP 02030B4F                      False code VM entry point                                         Cancelled
010327F8   JMP 02030D7E                      False code VM entry point                                         Cancelled
01032A21   JMP 02030FA7                      False code VM entry point                                         Cancelled
01032C53   JMP 020311D9                      False code VM entry point                                         Cancelled
010333FB   CALL 01E6B508                     False code VM entry point                                         Cancelled
010335C0   JMP 02031B46                      False code VM entry point                                         Cancelled
010337DE   JMP 02031D64                      False code VM entry point                                         Cancelled
01033A02   JMP 02031F88                      False code VM entry point                                         Cancelled
01033C26   JMP 020321AC                      False code VM entry point                                         Cancelled
01033E71   JMP 020323F7                      False code VM entry point                                         Cancelled
010340B2   JMP 02032638                      False code VM entry point                                         Cancelled
010342C7   CALL 020267DC                     False code VM entry point                                         Cancelled
01034305   JMP 0203288B                      False code VM entry point                                         Cancelled
01034F0A   JMP 01BFD21E                      Error at determine type VM entry point                            Error
01036FBD   CALL 0203AD42                     False code VM entry point                                         Cancelled
01039435   CALL 0203935F                     False code VM entry point                                         Cancelled
0103B581   CALL 0203B3AB                     False code VM entry point                                         Cancelled
0103BB9F   CALL 0203B9C9                     False code VM entry point                                         Cancelled
0103BD03   CALL 0203BB2D                     False code VM entry point                                         Cancelled
0103C246   CALL 0203C070                     False code VM entry point                                         Cancelled
0103C61D   CALL 0202EB2A                     False code VM entry point                                         Cancelled
0103C764   CALL 01845378                     False code VM entry point                                         Cancelled
0103D957   CALL 0203D881                     False code VM entry point                                         Cancelled
0103DB84   CALL 0203D9AE                     False code VM entry point                                         Cancelled
0103E945   CALL 0203E86F                     False code VM entry point                                         Cancelled
0103E96C   CALL 014E11C0                     USER32.GetFocus                                                   Done
0103E973   CALL 01819381                     USER32.MessageBoxW                                                Done
0103E99C   CALL 01512718                     USER32.GetFocus                                                   Done
0103E9A3   CALL 0162AB3B                     USER32.MessageBoxW                                                Done
0103F710   CALL 0203F63A                     False code VM entry point                                         Cancelled
0103F743   JMP 0150F84B                      False code VM entry point                                         Cancelled
0103F78E   JMP 0150F896                      False code VM entry point                                         Cancelled
0103F915   CALL 0203F83F                     False code VM entry point                                         Cancelled
0103F963   CALL 02031E6E                     False code VM entry point                                         Cancelled
0103FA4B   CALL 0203F975                     False code VM entry point                                         Cancelled
01040023   CALL 0203252B                     False code VM entry point                                         Cancelled
0104030C   CALL 01648F7A                     VERSION.GetFileVersionInfoW                                       Done
01040312   CALL 01607F7F                     VERSION.VerQueryValueW                                            Done
01040318   CALL 015D01D0                     VERSION.GetFileVersionInfoSizeW                                   Done
0104031E   CALL 01528822                     ADVAPI32.RegQueryValueExA                                         Done
01040324   CALL 016134A6                     ADVAPI32.RegOpenKeyExA                                            Done
01040330   CALL 018ADF99                     USER32.GetDlgItemTextA                                            Done
01040342   CALL 01848FDD                     USER32.SetDlgItemTextW                                            Done
01040348   CALL 017D7CE8                     USER32.GetDlgItemTextW                                            Done
0104034E   CALL 0175AD13                     USER32.MessageBoxW                                                Done
01040354   CALL 017D3194                     USER32.IsDlgButtonChecked                                         Done
01040360   CALL 015B0C8B                     USER32.CheckDlgButton                                             Done
0104036C   CALL 01823355                     USER32.SetWindowLongW                                             Done
01040372   CALL 0183B5F2                     USER32.GetDlgItem                                                 Done
01040378   CALL 018C9858                     USER32.GetWindowTextW                                             Done
0104037E   CALL 015EE303                     USER32.GetWindowLongW                                             Done
01040384   CALL 01843282                     USER32.SetDlgItemInt                                              Done
0104038A   CALL 018B8B96                     USER32.SetFocus                                                   Done
01040390   CALL 016E486B                     USER32.AttachThreadInput                                          Done
0104039C   CALL 016BD30B                     USER32.PostMessageW                                               Done
010403A2   CALL 016644B9                     USER32.GetDlgItemInt                                              Done
010403A8   CALL 015B8CA9                     USER32.GetWindowTextLengthW                                       Done
010403AE   CALL 0161A469                     USER32.DispatchMessageW                                           Done
010403B4   CALL 015C4EB2                     USER32.MoveWindow                                                 Done
010403BA   CALL 016E57C6                     USER32.CheckMenuItem                                              Done
010403C0   CALL 018886AD                     USER32.DefWindowProcW                                             Done
010403C6   CALL 01775EFE                     USER32.SetDlgItemTextA                                            Done
010403CC   CALL 016883A8                     USER32.DestroyIcon                                                Done
010403D2   CALL 0187AF87                     USER32.SetWindowTextW                                             Done
010403D8   CALL 01775E59                     USER32.DestroyMenu                                                Done
010403DE   CALL 017F0177                     USER32.UpdateWindow                                               Done
010403E4   CALL 014F3EDB                     USER32.GetSystemMetrics                                           Done
010403EA   CALL 017C073E                     USER32.CreateWindowExW                                            Done
010403F0   CALL 0159AE3B                     USER32.CreateDialogParamW                                         Done
010403FC   CALL 015FBFCE                     USER32.SetMenu                                                    Done
01040402   CALL 0179E559                     USER32.RedrawWindow                                               Done
01040408   CALL 0150D2A6                     USER32.EndDialog                                                  Done
0104040E   CALL 018C887A                     USER32.EnableMenuItem                                             Done
01040414   CALL 015C73BF                     USER32.AppendMenuW                                                Done
01040420   CALL 0161DA39                     USER32.GetWindowPlacement                                         Done
01040426   CALL 018B93F2                     USER32.LoadIconW                                                  Done
0104042C   CALL 0175EC7B                     USER32.RegisterClassExW                                           Done
01040432   CALL 0187D7C5                     USER32.IsDialogMessageW                                           Done
01040438   CALL 015795EA                     USER32.GetMenu                                                    Done
0104043E   CALL 01616384                     USER32.LoadAcceleratorsW                                          Done
01040444   CALL 0173CEEF                     USER32.TranslateMessage                                           Done
0104044A   CALL 01855809                     USER32.GetUpdateRect                                              Done
01040450   CALL 01583155                     USER32.BeginPaint                                                 Done
01040456   CALL 0185C51B                     USER32.CreateMenu                                                 Done
0104045C   CALL 01797957                     USER32.GetClientRect                                              Done
01040462   CALL 018C9F60                     USER32.LoadCursorW                                                Done
01040468   CALL 0179D776                     USER32.DialogBoxParamW                                            Done
0104046E   CALL 0165285B                     USER32.GetFocus                                                   Done
01040474   CALL 017839B2                     USER32.DefDlgProcW                                                Done
0104047A   CALL 01612BAD                     USER32.DrawIconEx                                                 Done
01040480   CALL 01722DF2                     USER32.KillTimer                                                  Done
01040486   CALL 0167A2CD                     USER32.LoadImageW                                                 Done
0104048C   CALL 0175CAD3                     USER32.RegisterWindowMessageW                                     Done
01040492   CALL 01877A5C                     USER32.PostQuitMessage                                            Done
01040498   CALL 017E8C6D                     USER32.GetMessageW                                                Done
0104049E   CALL 015825B6                     USER32.GetWindowRect                                              Done
010404A4   CALL 01815EC5                     USER32.ScreenToClient                                             Done
010404AA   CALL 0189ABFA                     USER32.SetTimer                                                   Done
010404B6   CALL 015C7719                     USER32.DestroyWindow                                              Done
010404BC   CALL 01618ABE                     USER32.EndPaint                                                   Done
010404C2   CALL 018BA2F8                     COMCTL32.PropertySheetW                                           Done
010404C8   CALL 016F0A3B                     COMCTL32.CreateUpDownControl                                      Done
010404CE   CALL 016E74B7                     COMCTL32.InitCommonControlsEx                                     Done
010404D4   CALL 015EF796                     COMCTL32.ImageList_ReplaceIcon                                    Done
010404DA   CALL 0187F10C                     COMCTL32.ImageList_Create                                         Done
010404E0   CALL 016F2D19                     ole32.CoCreateInstance                                            Done
010404E6   CALL 016D2658                     ole32.CoUninitialize                                              Done
010404EC   CALL 017F28B5                     ole32.CoInitializeEx                                              Done
010404F2   CALL 014EAC67                     GDI32.CreateCompatibleDC                                          Done
010404F8   CALL 01842707                     GDI32.GetDeviceCaps                                               Done
010404FE   CALL 01564A3B                     GDI32.CreateFontIndirectW                                         Done
01040504   CALL 016B5815                     GDI32.DeleteDC                                                    Done
0104050A   CALL 0153D02E                     COMDLG32.GetOpenFileNameW                                         Done
01040510   CALL 014D6FD1                     SHELL32.SHGetFolderPathW                                          Done
01040516   CALL 018266A7                     SHELL32.ShellExecuteA                                             Done
0104051C   CALL 017D8273                     SHELL32.DragAcceptFiles                                           Done
01040522   CALL 014B576A                     SHELL32.ShellExecuteW                                             Done
01040528   CALL 01820614                     SHELL32.DragQueryFileW                                            Done
0104052E   CALL 0185FB9C                     SHELL32.DragFinish                                                Done
01044349   CALL 01EEE5BE                     False code VM entry point                                         Cancelled
01044439   CALL 01EEE6AE                     False code VM entry point                                         Cancelled
01044527   CALL 01EEE79C                     False code VM entry point                                         Cancelled
0104460F   CALL 01EEE884                     False code VM entry point                                         Cancelled
01044CFB   CALL 01F3EF50                     False code VM entry point                                         Cancelled
01044E7B   CALL 01F3F0D0                     False code VM entry point                                         Cancelled
01044FFB   CALL 01F3F250                     False code VM entry point                                         Cancelled
0104517B   CALL 01F3F3D0                     False code VM entry point                                         Cancelled
010458D1   CALL 01EEFB46                     False code VM entry point                                         Cancelled
010459C1   CALL 01EEFC36                     False code VM entry point                                         Cancelled
01045AAF   CALL 01EEFD24                     False code VM entry point                                         Cancelled
01045B97   CALL 01EEFE0C                     False code VM entry point                                         Cancelled
01046283   CALL 01F404D8                     False code VM entry point                                         Cancelled
01046403   CALL 01F40658                     False code VM entry point                                         Cancelled
01046583   CALL 01F407D8                     False code VM entry point                                         Cancelled
01046703   CALL 01F40958                     False code VM entry point                                         Cancelled
0106B7F4   CALL 0205DD09                     False code VM entry point                                         Cancelled
0106B872   CALL 0205DD87                     False code VM entry point                                         Cancelled
0106B8F0   CALL 0205DE05                     False code VM entry point                                         Cancelled
0106B974   CALL 0205DE89                     False code VM entry point                                         Cancelled
010704BC   CALL 016040F5                     Function is coded VM                                              Postponed
010704C2   JMP 0174F750                      False code VM entry point                                         Cancelled
010704D4   CALL 0151B145                     Function is coded VM                                              Postponed
010704DA   CALL 01507134                     Function is coded VM                                              Postponed
0107072B   CALL 017A30B2                     kernel32.RtlFreeHeap                                              Done
01070786   CALL 016A0BBC                     kernel32.RtlAllocateHeap                                          Done
010707D3   CALL 017EDC87                     kernel32.RtlAllocateHeap                                          Done
010711DA   CALL 01B3CB62                     False code VM entry point                                         Cancelled
0107122E   CALL 01B3CAB6                     False code VM entry point                                         Cancelled
010716BE   CALL 017D0C0C                     kernel32.RtlReAllocateHeap                                        Done
0107179C   JMP 017098C6                      Function is coded VM                                              Postponed
010717AF   CALL 014AB4F9                     False code VM entry point                                         Cancelled
010717F1   JMP 014AD59C                      False code VM entry point                                         Cancelled
01071853   CALL 014AAF00                     False code VM entry point                                         Cancelled
01071875   JMP 014B050D                      False code VM entry point                                         Cancelled
0107187E   JMP 014B0312                      False code VM entry point                                         Cancelled
0107189C   JMP 014AD1F9                      False code VM entry point                                         Cancelled
010718BF   CALL 014AE010                     False code VM entry point                                         Cancelled
010718C4   CALL 014B0230                     False code VM entry point                                         Cancelled
01071919   CALL 01834B61                     kernel32.RtlDecodePointer                                         Done
01071949   CALL 01661155                     kernel32.RtlDecodePointer                                         Done
01071954   CALL 0189FE99                     kernel32.RtlEncodePointer                                         Done
0107196A   CALL 015968B1                     kernel32.RtlDecodePointer                                         Done
010721D6   CALL 01B3DB5E                     False code VM entry point                                         Cancelled
0107222A   CALL 01B3DAB2                     False code VM entry point                                         Cancelled
0107230C   CALL 015AE92F                     kernel32.ExitThread                                               Done
01072388   CALL 01820AA9                     kernel32.ExitThread                                               Done
0107238E   CALL 016AF80D                     kernel32.GetCurrentThreadId                                       Done
0107242E   CALL 018BDE53                     kernel32.CreateThread                                             Done
01072E3B   CALL 018B0085                     kernel32.GetModuleHandleW                                         Done
01072E4B   CALL 015C9114                     kernel32.GetProcAddress                                           Done
01072E6D   CALL 015DD851                     kernel32.ExitProcess                                              Done
01073035   CALL 016F7FC8                     kernel32.RtlDecodePointer                                         Done
01073254   CALL 016AF32C                     kernel32.IsDebuggerPresent                                        Done
01073269   CALL 01616CA5                     kernel32.SetUnhandledExceptionFilter                              Done
01073274   CALL 01590F27                     kernel32.UnhandledExceptionFilter                                 Done
01073290   CALL 0175AFCC                     kernel32.GetCurrentProcess                                        Done
01073353   CALL 015AD09B                     kernel32.GetCPInfo                                                Done
0107351B   CALL 017760B0                     kernel32.InterlockedDecrement                                     Done
01073546   CALL 0189EDA7                     kernel32.InterlockedIncrement                                     Done
0107358F   CALL 0172A732                     kernel32.GetOEMCP                                                 Done
010735B2   CALL 015CE950                     kernel32.GetACP                                                   Done
01073655   CALL 015DC80B                     kernel32.IsValidCodePage                                          Done
01073668   CALL 01825410                     kernel32.GetCPInfo                                                Done
01073693   CALL 0203BCA7                     False code VM entry point                                         Cancelled
0107387F   CALL 015B2547                     kernel32.InterlockedDecrement                                     Done
0107389E   CALL 017F01F8                     kernel32.InterlockedIncrement                                     Done
01073936   CALL 016AD985                     kernel32.InterlockedDecrement                                     Done
010739C8   CALL 017967C7                     kernel32.InterlockedIncrement                                     Done
01073A63   CALL 014B24D5                     kernel32.InterlockedDecrement                                     Done
01073CFC   CALL 01645061                     kernel32.RtlEncodePointer                                         Done
01073D03   CALL 014E8C65                     kernel32.TlsAlloc                                                 Done
01073D47   CALL 0179061D                     kernel32.RtlDecodePointer                                         Done
01073D71   CALL 015EA0AE                     kernel32.RtlDecodePointer                                         Done
01073D8E   CALL 01573B4C                     kernel32.RtlDecodePointer                                         Done
01073DCB   CALL 016EC227                     kernel32.GetModuleHandleW                                         Done
01073E0C   CALL 015EE89A                     kernel32.InterlockedIncrement                                     Done
01073EAE   CALL 01589D1E                     kernel32.RtlDecodePointer                                         Done
01073EC4   CALL 0166DE8A                     kernel32.GetCurrentThreadId                                       Done
01073EDC   CALL 01704BEB                     kernel32.RtlSetLastWin32Error                                     Done
01073F9F   CALL 0175AE43                     kernel32.InterlockedDecrement                                     Done
01074079   CALL 015EC5EA                     kernel32.RtlDecodePointer                                         Done
0107409E   CALL 0184F1CA                     kernel32.GetCurrentThreadId                                       Done
010740A4   CALL 0167CD34                     kernel32.GetCurrentThread                                         Done
010740B2   CALL 01778746                     kernel32.GetModuleHandleW                                         Done
010740C8   CALL 0168248A                     kernel32.GetProcAddress                                           Done
0107414B   CALL 01850F75                     kernel32.TlsAlloc                                                 Done
0107417B   CALL 015A9C48                     kernel32.RtlEncodePointer                                         Done
010741B8   CALL 01658FED                     kernel32.RtlDecodePointer                                         Done
0107420A   CALL 01541E0E                     kernel32.GetCurrentThreadId                                       Done
0107431E   CALL 018251C9                     kernel32.IsDebuggerPresent                                        Done
01074328   CALL 015B4883                     kernel32.SetUnhandledExceptionFilter                              Done
01074335   CALL 016FEAFF                     kernel32.UnhandledExceptionFilter                                 Done
01074369   CALL 017AC54D                     kernel32.RtlDecodePointer                                         Done
01074374   CALL 01842E61                     kernel32.RtlEncodePointer                                         Done
0107438A   CALL 01508F85                     kernel32.RtlDecodePointer                                         Done
010743A7   CALL 016069CF                     kernel32.GetCurrentProcess                                        Done
010743DB   CALL 01654ED6                     kernel32.RtlDecodePointer                                         Done
0107442D   CALL 017A42B6                     kernel32.GetCurrentProcess                                        Done
01074662   CALL 01606BB7                     kernel32.InterlockedDecrement                                     Done
01074781   CALL 014B54A1                     kernel32.InterlockedIncrement                                     Done
01074A47   CALL 0189ECA2                     kernel32.InterlockedDecrement                                     Done
01074AA4   CALL 017BD8A9                     kernel32.InterlockedDecrement                                     Done
01074FFA   CALL 0157B8AC                     kernel32.InterlockedDecrement                                     Done
010754DF   CALL 015BC216                     kernel32.HeapCreate                                               Done
010754FA   CALL 0166B023                     kernel32.HeapDestroy                                              Done
010755D0   CALL 018528E0                     kernel32.GetModuleFileNameW                                       Done
01075682   CALL 01850509                     kernel32.GetStdHandle                                             Done
010756CE   CALL 015A7BCE                     kernel32.WriteFile                                                Done
0107573F   CALL 016B5876                     kernel32.RtlDecodePointer                                         Done
0107574A   CALL 017B0359                     kernel32.RtlEncodePointer                                         Done
01075771   CALL 017187BD                     kernel32.RtlDecodePointer                                         Done
01075783   CALL 01734892                     kernel32.RtlDecodePointer                                         Done
01075ABD   CALL 02075ABD                     False code VM entry point                                         Cancelled
010760AF   CALL 01822E20                     kernel32.RtlDecodePointer                                         Done
010764CE   CALL 020764CE                     False code VM entry point                                         Cancelled
01076D26   CALL 015C4193                     kernel32.RtlDecodePointer                                         Done
01077154   CALL 02077154                     False code VM entry point                                         Cancelled
01077EE1   CALL 0160975C                     kernel32.RtlDecodePointer                                         Done
0107872C   CALL 01D007BC                     False code VM entry point                                         Cancelled
01078930   CALL 017ECC85                     kernel32.LCMapStringW                                             Done
01078A00   CALL 018842BA                     kernel32.WideCharToMultiByte                                      Done
01078FC5   CALL 017C930F                     kernel32.RtlDecodePointer                                         Done
01079044   CALL 0188C7B4                     kernel32.RtlEncodePointer                                         Done
01079052   CALL 015934E2                     kernel32.RtlEncodePointer                                         Done
01079084   CALL 016E6B13                     kernel32.RtlEncodePointer                                         Done
01079139   CALL 01732546                     kernel32.RaiseException                                           Done
01079265   CALL 0167D7EC                     kernel32.SetUnhandledExceptionFilter                              Done
0107970E   CALL 018CBEEC                     kernel32.GetModuleFileNameA                                       Done
010797A7   CALL 018569C0                     kernel32.GetEnvironmentStringsW                                   Done
010797CF   CALL 0163A973                     kernel32.WideCharToMultiByte                                      Done
0107981B   CALL 01574272                     kernel32.FreeEnvironmentStringsW                                  Done
01079827   CALL 014E2594                     kernel32.FreeEnvironmentStringsW                                  Done
01079841   CALL 016EB1AF                     kernel32.GetStartupInfoW                                          Done
01079974   CALL 016EC669                     kernel32.GetFileType                                              Done
010799AA   CALL 0157A849                     kernel32.InitializeCriticalSectionAndSpinCount                    Done
010799FE   CALL 015B8AB5                     kernel32.GetStdHandle                                             Done
01079A10   CALL 01723A04                     kernel32.GetFileType                                              Done
01079A3E   CALL 0174356F                     kernel32.InitializeCriticalSectionAndSpinCount                    Done
01079A67   CALL 01647EFC                     kernel32.SetHandleCount                                           Done
01079A9C   CALL 017ABFB1                     kernel32.RtlDeleteCriticalSection                                 Done
01079D76   CALL 014D4324                     kernel32.GetSystemTimeAsFileTime                                  Done
01079D82   CALL 017D199E                     kernel32.GetCurrentProcessId                                      Done
01079D8A   CALL 018439D6                     kernel32.GetCurrentThreadId                                       Done
01079D92   CALL 016E9C7E                     kernel32.GetTickCount                                             Done
01079D9E   CALL 018840FD                     kernel32.QueryPerformanceCounter                                  Done
01079F51   CALL 0175A3DF                     kernel32.GetLocaleInfoW                                           Done
01079FBF   CALL 015FB721                     kernel32.GetLocaleInfoW                                           Done
0107A3FF   CALL 01793287                     kernel32.LCMapStringW                                             Done
0107A443   CALL 017AC63E                     kernel32.GetStringTypeW                                           Done
0107B1C5   CALL 016383CF                     kernel32.RtlDecodePointer                                         Done
0107B225   CALL 0207B227                     False code VM entry point                                         Cancelled
0107BB39   CALL 016E8441                     kernel32.Sleep                                                    Done
0107BB8B   CALL 0156CB4D                     kernel32.Sleep                                                    Done
0107BBD7   CALL 015CB81D                     kernel32.Sleep                                                    Done
0107BC25   CALL 015C0608                     kernel32.Sleep                                                    Done
0107BC77   CALL 018AAB40                     kernel32.Sleep                                                    Done
0107BFB1   CALL 01616366                     kernel32.ReadFile                                                 Done
0107C067   CALL 016B700F                     kernel32.ReadFile                                                 Done
0107C28D   CALL 016F578F                     kernel32.ReadFile                                                 Done
0107C614   CALL 016ABDF3                     kernel32.RtlEnterCriticalSection                                  Done
0107C647   CALL 018AF0EE                     kernel32.RtlEnterCriticalSection                                  Done
0107C683   CALL 01509999                     kernel32.RtlLeaveCriticalSection                                  Done
0107C6B2   CALL 015113B9                     kernel32.RtlLeaveCriticalSection                                  Done
0107C7BF   CALL 014E92E2                     kernel32.IsProcessorFeaturePresent                                Done
0107C8AF   CALL 0150AEC0                     kernel32.InitializeCriticalSectionAndSpinCount                    Done
0107C8D4   CALL 016990EA                     kernel32.RtlDeleteCriticalSection                                 Done
0107C937   CALL 015CF991                     kernel32.RtlLeaveCriticalSection                                  Done
0107C945   CALL 015B0CC6                     kernel32.FatalAppExitA                                            Done
0107C9CF   CALL 017C3388                     kernel32.InitializeCriticalSectionAndSpinCount                    Done
0107CA43   CALL 01672398                     kernel32.RtlEnterCriticalSection                                  Done
0107CAAA   CALL 0151D280                     kernel32.RtlDecodePointer                                         Done
0107CAD5   CALL 014DD9EC                     kernel32.RtlEncodePointer                                         Done
0107CB27   CALL 016ADE41                     kernel32.RtlDecodePointer                                         Done
0107CB44   CALL 018B6061                     kernel32.RtlDecodePointer                                         Done
0107CBD8   CALL 017905B0                     kernel32.RtlDecodePointer                                         Done
0107CD10   CALL 016B8782                     kernel32.SetConsoleCtrlHandler                                    Done
0107CD60   CALL 01843AA5                     kernel32.RtlDecodePointer                                         Done
0107CD6E   CALL 016E2729                     kernel32.RtlEncodePointer                                         Done
0107CD81   CALL 017006C9                     kernel32.RtlDecodePointer                                         Done
0107CD8F   CALL 017131A0                     kernel32.RtlEncodePointer                                         Done
0107CDA2   CALL 01665536                     kernel32.RtlDecodePointer                                         Done
0107CDB0   CALL 016BAF22                     kernel32.RtlEncodePointer                                         Done
0107CDC3   CALL 01559F53                     kernel32.RtlDecodePointer                                         Done
0107CDD1   CALL 01696786                     kernel32.RtlEncodePointer                                         Done
0107CEE3   CALL 015B5941                     kernel32.RtlDecodePointer                                         Done
0107CFF0   CALL 0172C542                     kernel32.RtlDecodePointer                                         Done
0107D026   CALL 016AF207                     kernel32.LoadLibraryW                                             Done
0107D04F   CALL 01694AB5                     kernel32.GetProcAddress                                           Done
0107D085   CALL 01575019                     kernel32.RtlEncodePointer                                         Done
0107D09A   CALL 015E545E                     kernel32.InterlockedExchange                                      Done
0107D0A8   CALL 017A5AA9                     kernel32.FreeLibrary                                              Done
0107D0DF   CALL 0169ABDF                     kernel32.RtlEncodePointer                                         Done
0107D1C4   CALL 02041790                     False code VM entry point                                         Cancelled
0107D316   CALL 0167E4E4                     kernel32.GetStringTypeW                                           Done
0107DF5B   CALL 017B91D4                     kernel32.InterlockedDecrement                                     Done
0107E1A2   CALL 017C91F7                     kernel32.InterlockedDecrement                                     Done
0107E633   CALL 0167D26A                     kernel32.InterlockedDecrement                                     Done
0107E644   CALL 017620E4                     kernel32.InterlockedDecrement                                     Done
0107E7C3   CALL 015AE38B                     kernel32.GetCPInfo                                                Done
0107E970   CALL 017E3D8C                     kernel32.InterlockedDecrement                                     Done
0107EA36   CALL 0182AB20                     kernel32.InterlockedDecrement                                     Done
0107ECA4   CALL 01839DD0                     kernel32.GetUserDefaultLCID                                       Done
0107ECF0   CALL 015E61B6                     kernel32.GetLocaleInfoW                                           Done
0107ED19   CALL 01720D05                     kernel32.GetLocaleInfoW                                           Done
0107ED2D   CALL 014B2824                     kernel32.GetACP                                                   Done
0107EE6E   CALL 01796ACA                     kernel32.GetLocaleInfoW                                           Done
0107F154   CALL 01506EC1                     kernel32.EnumSystemLocalesA                                       Done
0107F1AC   CALL 016344A4                     kernel32.EnumSystemLocalesA                                       Done
0107F1F7   CALL 015BD56B                     kernel32.EnumSystemLocalesA                                       Done
0107F2D8   CALL 01533DDE                     kernel32.EnumSystemLocalesA                                       Done
0107F2F1   CALL 01772CD8                     kernel32.GetUserDefaultLCID                                       Done
0107F343   CALL 01887153                     kernel32.IsValidCodePage                                          Done
0107F356   CALL 0187ED7C                     kernel32.IsValidLocale                                            Done
0108203B   CALL 01609D2B                     kernel32.LoadLibraryW                                             Done
0108204B   CALL 01636043                     kernel32.GetProcAddress                                           Done
01082061   CALL 014FFD7F                     kernel32.RtlEncodePointer                                         Done
010820BB   CALL 014ED7B0                     kernel32.RtlDecodePointer                                         Done
01082217   CALL 018A8A06                     kernel32.SetFilePointer                                           Done
01082454   CALL 018809CC                     kernel32.GetConsoleMode                                           Done
01082474   CALL 01586B91                     kernel32.GetConsoleCP                                             Done
01082564   CALL 01852957                     kernel32.WideCharToMultiByte                                      Done
0108258D   CALL 014DA328                     kernel32.WriteFile                                                Done
010825E6   CALL 0168BF7B                     kernel32.WriteFile                                                Done
01082754   CALL 0164D29C                     kernel32.WriteFile                                                Done
0108282E   CALL 016BE52E                     kernel32.WriteFile                                                Done
010828FE   CALL 017B8D78                     kernel32.WideCharToMultiByte                                      Done
0108292F   CALL 017CDDB2                     kernel32.WriteFile                                                Done
01082986   CALL 01789AF9                     kernel32.WriteFile                                                Done
01083415   CALL 02083417                     False code VM entry point                                         Cancelled
0108383D   CALL 0208383F                     False code VM entry point                                         Cancelled
010838D3   CALL 01876CA4                     kernel32.RtlDecodePointer                                         Done
01083933   CALL 02083935                     False code VM entry point                                         Cancelled
01083A71   CALL 02083A73                     False code VM entry point                                         Cancelled
01084B19   CALL 01705D52                     kernel32.RtlDecodePointer                                         Done
01085357   CALL 0178E2FA                     kernel32.RtlSizeHeap                                              Done
0108578F   CALL 01741CCA                     kernel32.GetLocaleInfoW                                           Done
01085829   CALL 0171C704                     kernel32.WideCharToMultiByte                                      Done
0108B55C   CALL 0175DB42                     kernel32.WideCharToMultiByte                                      Done
0108B68C   CALL 016F2117                     kernel32.RtlAllocateHeap                                          Done
0108B790   CALL 015B08D2                     kernel32.SetStdHandle                                             Done
0108B816   CALL 01615CCE                     kernel32.SetStdHandle                                             Done
0108B8F3   CALL 016ABBD9                     kernel32.InitializeCriticalSectionAndSpinCount                    Done
0108B92B   CALL 01757E28                     kernel32.RtlEnterCriticalSection                                  Done
0108B967   CALL 016AF377                     kernel32.RtlLeaveCriticalSection                                  Done
0108B9FE   CALL 016DBDC1                     kernel32.InitializeCriticalSectionAndSpinCount                    Done
0108BA23   CALL 017E76C4                     kernel32.RtlEnterCriticalSection                                  Done
0108BA30   CALL 014B2764                     kernel32.RtlLeaveCriticalSection                                  Done
0108BB3C   CALL 0153D31B                     kernel32.GetFileType                                              Done
0108BC7D   CALL 018B76FC                     kernel32.RtlDeleteCriticalSection                                 Done
0108C2E9   CALL 014D6BBD                     kernel32.WriteConsoleW                                            Done
0108CC39   CALL 016C4B58                     kernel32.FlushFileBuffers                                         Done
0108D034   CALL 01681E12                     kernel32.CreateFileW                                              Done
0108D050   CALL 018377B1                     kernel32.CloseHandle                                              Done
0108D0A9   CALL 017B65C1                     kernel32.CloseHandle                                              Done
0108D1E8   CALL 01820077                     kernel32.GetDriveTypeW                                            Done
0108D1EE   CALL 0160873B                     kernel32.Sleep                                                    Done
0108D1F4   CALL 01510A24                     False code VM entry point                                         Cancelled
0108D1FA   CALL 017D6877                     kernel32.GetCurrentThreadId                                       Done
0108D200   CALL 016AE1F8                     kernel32.CloseHandle                                              Done
0108D206   CALL 01504884                     kernel32.ResumeThread                                             Done
0108D20C   CALL 0163394B                     kernel32.CreateThread                                             Done
0108D212   CALL 0174174C                     kernel32.ExitProcess                                              Done
0108D218   CALL 017DC8A8                     kernel32.GetDateFormatW                                           Done
0108D21E   CALL 016ADD0C                     kernel32.GetTempFileNameW                                         Done
0108D224   CALL 016414B5                     kernel32.SetProcessAffinityMask                                   Done
0108D22A   CALL 016767E7                     kernel32.FindFirstFileW                                           Done
0108D230   CALL 01689EC3                     kernel32.SetFilePointer                                           Done
0108D236   CALL 016C9477                     kernel32.GetCurrentProcess                                        Done
0108D23C   CALL 015DA510                     kernel32.GetModuleHandleW                                         Done
0108D242   CALL 018693A8                     kernel32.ExpandEnvironmentStringsA                                Done
0108D248   CALL 0175361F                     kernel32.WriteFile                                                Done
0108D24E   CALL 0156C8C7                     kernel32.GetLocaleInfoW                                           Done
0108D254   CALL 017D3E63                     kernel32.GetTimeFormatW                                           Done
0108D25A   CALL 016C68CE                     kernel32.GetModuleFileNameW                                       Done
0108D260   CALL 016D2486                     kernel32.CreateFileW                                              Done
0108D26C   CALL 015669DE                     kernel32.GetTempPathW                                             Done
0108D272   CALL 01600491                     kernel32.GetProcAddress                                           Done
0108D278   CALL 01527958                     kernel32.LoadLibraryA                                             Done
0108D27E   CALL 01839448                     kernel32.GetProcessAffinityMask                                   Done
0108D284   CALL 016FD108                     kernel32.FindNextFileW                                            Done
0108D28A   CALL 016904E7                     kernel32.DeleteFileW                                              Done
0108D290   CALL 015EA401                     kernel32.WaitForSingleObject                                      Done
0108D296   CALL 0157FCEB                     kernel32.SetEvent                                                 Done
0108D29C   CALL 0160FC99                     kernel32.ResetEvent                                               Done
0108D2A2   CALL 0161B823                     kernel32.CreateEventW                                             Done
0108D2A8   CALL 0164E52E                     kernel32.ReadFile                                                 Done
0108D2AE   CALL 016BD2E8                     kernel32.GetFileInformationByHandle                               Done
0108D2B4   CALL 016E74E0                     kernel32.GetCommandLineW                                          Done
0108D2BA   CALL 0168D88D                     kernel32.GetCurrentDirectoryW                                     Done
0108D2C0   CALL 017D73FC                     kernel32.WideCharToMultiByte                                      Done
0108D2C6   CALL 01561B63                     kernel32.FreeResource                                             Done
0108D2CD   CALL 0161CBEA                     False code VM entry point                                         Cancelled
0108D2D3   CALL 018B4E68                     False code VM entry point                                         Cancelled
0108D2D8   CALL 015EE9EF                     kernel32.SizeofResource                                           Done
0108D2DE   CALL 015CE264                     kernel32.SetHandleCount                                           Done
0108D2E4   CALL 015C90C9                     kernel32.GlobalLock                                               Done
0108D2EA   CALL 018A0BAF                     kernel32.GlobalAlloc                                              Done
0108D2F0   CALL 01620DAC                     kernel32.GlobalUnlock                                             Done
0108D2F6   CALL 017349AF                     kernel32.CreateDirectoryW                                         Done
0108D302   CALL 016E2B27                     kernel32.CreateFileA                                              Done
0108D308   CALL 01648A09                     kernel32.SetEndOfFile                                             Done
0108D30E   CALL 015463A7                     kernel32.MoveFileExW                                              Done
0108D314   CALL 0160A74D                     kernel32.QueryPerformanceCounter                                  Done
0108D31A   CALL 017AB8F0                     kernel32.SetThreadExecutionState                                  Done
0108D320   CALL 01526574                     kernel32.GetTickCount                                             Done
0108D326   CALL 016B8289                     kernel32.InitializeCriticalSection                                Done
0108D32C   CALL 015D8FCC                     kernel32.RtlLeaveCriticalSection                                  Done
0108D332   CALL 015304DB                     kernel32.SetThreadPriority                                        Done
0108D338   CALL 015EE974                     kernel32.RtlEnterCriticalSection                                  Done
0108D33E   CALL 017D6CEC                     kernel32.GetSystemInfo                                            Done
0108D344   CALL 01609CDE                     kernel32.GetModuleHandleA                                         Done
0108D34A   CALL 016FACC5                     kernel32.QueryPerformanceFrequency                                Done
0108D350   CALL 015E4D18                     kernel32.RtlDeleteCriticalSection                                 Done
0108D356   CALL 01741D8F                     kernel32.GetSystemTime                                            Done
0108D35C   CALL 015A5D57                     kernel32.SetUnhandledExceptionFilter                              Done
0108D362   CALL 01664807                     kernel32.IsBadReadPtr                                             Done
0108D36E   CALL 0158FC92                     kernel32.RtlFreeHeap                                              Done
0108D374   CALL 016AF6E5                     kernel32.RtlAllocateHeap                                          Done
0108D37A   CALL 0180AF80                     kernel32.RtlReAllocateHeap                                        Done
0108D380   CALL 015D6C89                     kernel32.GetCommandLineA                                          Done
0108D386   CALL 016FA959                     kernel32.HeapSetInformation                                       Done
0108D38C   CALL 016D929C                     kernel32.GetStartupInfoW                                          Done
0108D392   CALL 01823302                     kernel32.RtlDecodePointer                                         Done
0108D398   CALL 015C9D4E                     kernel32.RtlEncodePointer                                         Done
0108D39E   CALL 0162FFD0                     kernel32.ExitThread                                               Done
0108D3A4   CALL 017A7E69                     kernel32.UnhandledExceptionFilter                                 Done
0108D3AA   CALL 0156C9C6                     kernel32.IsDebuggerPresent                                        Done
0108D3B0   CALL 01880BBA                     kernel32.GetCPInfo                                                Done
0108D3B6   CALL 017D74AE                     kernel32.InterlockedIncrement                                     Done
0108D3BC   CALL 017ECEE2                     kernel32.InterlockedDecrement                                     Done
0108D3C2   CALL 015A88E3                     kernel32.GetACP                                                   Done
0108D3C8   CALL 018B708F                     kernel32.GetOEMCP                                                 Done
0108D3CE   CALL 01748CF6                     kernel32.IsValidCodePage                                          Done
0108D3D4   CALL 0157550E                     kernel32.TlsAlloc                                                 Done
0108D3EC   CALL 016D7EE2                     kernel32.RtlSetLastWin32Error                                     Done
0108D3F2   CALL 016DB38C                     kernel32.GetCurrentThread                                         Done
0108D3F8   CALL 016AF840                     kernel32.HeapCreate                                               Done
0108D3FE   CALL 017CE735                     kernel32.HeapDestroy                                              Done
0108D404   CALL 0178F50C                     kernel32.GetStdHandle                                             Done
0108D40A   CALL 0166BFC4                     kernel32.LCMapStringW                                             Done
0108D410   CALL 014EC857                     kernel32.RaiseException                                           Done
0108D416   CALL 0175E876                     kernel32.GetModuleFileNameA                                       Done
0108D41C   CALL 014E567F                     kernel32.FreeEnvironmentStringsW                                  Done
0108D422   CALL 0162126B                     kernel32.GetEnvironmentStringsW                                   Done
0108D428   CALL 016CE8AA                     kernel32.SetHandleCount                                           Done
0108D42E   CALL 017B3873                     kernel32.InitializeCriticalSectionAndSpinCount                    Done
0108D434   CALL 01766179                     kernel32.GetFileType                                              Done
0108D43A   CALL 0167A2BA                     kernel32.GetCurrentProcessId                                      Done
0108D440   CALL 0168CFD8                     kernel32.GetSystemTimeAsFileTime                                  Done
0108D446   CALL 017DE624                     kernel32.GetStringTypeW                                           Done
0108D44C   CALL 01574FCD                     kernel32.IsProcessorFeaturePresent                                Done
0108D452   CALL 018ADF9E                     kernel32.FatalAppExitA                                            Done
0108D458   CALL 0189196C                     kernel32.SetConsoleCtrlHandler                                    Done
0108D45E   CALL 0162E79E                     kernel32.FreeLibrary                                              Done
0108D464   CALL 01704855                     kernel32.InterlockedExchange                                      Done
0108D46A   CALL 01509D4E                     kernel32.LoadLibraryW                                             Done
0108D470   CALL 016C4AB2                     kernel32.GetUserDefaultLCID                                       Done
0108D47C   CALL 01639D65                     kernel32.EnumSystemLocalesA                                       Done
0108D482   CALL 017CE702                     kernel32.IsValidLocale                                            Done
0108D488   CALL 0186CA90                     kernel32.GetConsoleCP                                             Done
0108D48E   CALL 0151B567                     kernel32.GetConsoleMode                                           Done
0108D494   CALL 0161F65E                     kernel32.RtlSizeHeap                                              Done
0108D49A   CALL 016CD9F7                     kernel32.RtlUnwind                                                Done
0108D4A0   CALL 0182C8E1                     kernel32.SetStdHandle                                             Done
0108D4A6   CALL 016A7B29                     kernel32.WriteConsoleW                                            Done
0108D4AC   CALL 01826D32                     kernel32.FlushFileBuffers                                         Done
0108D4B2   CALL 015CF7A2                     ADVAPI32.RegQueryValueExW                                         Done
0108D4B8   CALL 0183CE14                     ADVAPI32.RegOpenKeyExW                                            Done
0108D4BE   CALL 016DE53E                     ADVAPI32.RegCreateKeyW                                            Done
0108D4CA   CALL 016A1328                     USER32.EnumDisplayDevicesW                                        Done
0108D4D0   CALL 01680EC6                     USER32.SetScrollInfo                                              Done
0108D4D6   CALL 01550FF6                     USER32.SetClipboardData                                           Done
0108D4DC   CALL 01626D96                     USER32.ReleaseCapture                                             Done
0108D4E2   CALL 015005E5                     USER32.OpenClipboard                                              Done
0108D4E8   CALL 0152EF4E                     USER32.GetCursorPos                                               Done
0108D4EE   CALL 015C3534                     USER32.GetSysColor                                                Done
0108D4F4   CALL 015410B2                     USER32.ScrollWindow                                               Done
0108D4FA   CALL 015B8CD3                     USER32.EmptyClipboard                                             Done
0108D500   CALL 01871BBE                     USER32.ReleaseDC                                                  Done
0108D506   CALL 01684B59                     USER32.GetScrollInfo                                              Done
0108D50C   CALL 018C984C                     USER32.GetDC                                                      Done
0108D512   CALL 0180E752                     USER32.PtInRect                                                   Done
0108D518   CALL 0162D57D                     USER32.SetCapture                                                 Done
0108D51E   CALL 017CDFAC                     USER32.FillRect                                                   Done
0108D524   CALL 01550736                     USER32.IsIconic                                                   Done
0108D52A   CALL 016EAF55                     USER32.CloseClipboard                                             Done
0108D530   CALL 015C6DE0                     USER32.SetCursor                                                  Done
0108D536   CALL 01822E1A                     USER32.CallWindowProcW                                            Done
0108D53C   CALL 0152525F                     USER32.RegisterClassW                                             Done
0108D542   CALL 015F95F3                     USER32.DrawTextW                                                  Done
0108D548   CALL 017A91EE                     USER32.GetWindowTextA                                             Done
0108D54E   CALL 018BFBE1                     USER32.wsprintfW                                                  Done
0108D554   CALL 01661DA4                     USER32.GetWindowTextLengthA                                       Done
0108D55A   CALL 014D6B68                     USER32.MessageBeep                                                Done
0108D560   CALL 016D136B                     USER32.DialogBoxIndirectParamW                                    Done
0108D566   CALL 01703BC9                     ole32.StgOpenStorage                                              Done
0108D56C   CALL 01633015                     GDI32.TextOutW                                                    Done
0108D572   CALL 016C82A2                     GDI32.GetTextExtentExPointW                                       Done
0108D578   CALL 015BFCC0                     GDI32.CreateCompatibleBitmap                                      Done
0108D57E   CALL 015A212B                     GDI32.SelectObject                                                Done
0108D584   CALL 015E108F                     GDI32.DeleteObject                                                Done
0108D58A   CALL 016053D4                     GDI32.SetBkColor                                                  Done
0108D590   CALL 0188AB56                     GDI32.SetTextColor                                                Done
0108D596   CALL 014FBD07                     GDI32.BitBlt                                                      Done
0108D59C   CALL 015C3F72                     GDI32.GetObjectW                                                  Done
0108D5A2   CALL 0178E4BB                     GDI32.GetTextExtentPointW                                         Done
0108D5A8   CALL 015B3183                     GDI32.SetBkMode                                                   Done
0108D5AE   CALL 015A0BB4                     COMDLG32.GetSaveFileNameW                                         Done
0108D5B4   CALL 0167CB43                     SHELL32.SHBrowseForFolderW                                        Done
0108D5BA   CALL 0189BAD1                     SHELL32.SHGetMalloc                                               Done
0108D5C0   CALL 014F0F63                     SHELL32.SHGetPathFromIDListW                                      Done
0108D5C6   CALL 01565EE7                     WININET.InternetOpenW                                             Done
0108D5CC   CALL 0151BD1C                     WININET.InternetOpenUrlW                                          Done
0108D5D2   CALL 016D6507                     WININET.InternetReadFile                                          Done
0108D5D8   CALL 0161633D                     WININET.InternetCloseHandle                                       Done
0108D5DE   CALL 01717C1E                     SHLWAPI.PathRemoveExtensionW                                      Done
0108D5E4   CALL 017C90DB                     SHLWAPI.PathIsFileSpecW                                           Done
0108D5EA   CALL 01616254                     SHLWAPI.PathFileExistsW                                           Done
0108D5F0   CALL 0167679C                     SHLWAPI.PathAppendW                                               Done
0108DE19   CALL 020543A1                     False code VM entry point                                         Cancelled
