date/time         : 2017-07-28, 17:38:15, 332ms
computer name     : DRAGON
user name         : usuario
registered owner  : Usuario de Windows
operating system  : Windows NT New x64 build 9200
system language   : Spanish
system up time    : 1 day 23 hours
program up time   : 17 seconds
processors        : 4x Intel(R) Core(TM) i5 CPU 650 @ 3.20GHz
physical memory   : 2400/8055 MB (free/total)
free disk space   : (C:) 29.60 GB
display mode      : 1600x1200, 32 bit
process id        : $2ef8
allocated memory  : 81.87 MB
executable        : vmark.exe
exec. date/time   : 2010-06-21 12:20
compiled with     : BCB6
madExcept version : 3.0k
callstack crc     : $c548905e, $b2134370, $b2134370
count             : 2
exception number  : 1
exception class   : EFCreateError
exception message : Cannot create file C:\ProgramData\Visual Watermark\.styles.

main thread ($1990):
005fd414 +060 vmark.exe    Classes                TFileStream.Create
005fd390 +020 vmark.exe    Classes                TFileStream.Create
00438703 +037 vmark.exe    basefilter.cpp  77  +2 vwm.SaveStyles
004384a7 +003 vmark.exe    basefilter.cpp  59  +2 vwm.CloseFilters
00406a1f +087 vmark.exe    Unit1.cpp      540  +5 TForm1.FormClose
0065ad47 +017 vmark.exe    Forms                  TCustomForm.DoClose
0065e281 +055 vmark.exe    Forms                  TCustomForm.Close
0065d544 +000 vmark.exe    Forms                  TCustomForm.WMClose
0040cde3 +02f vmark.exe    Unit1.h        189  +2 TForm1.Dispatch
006706d8 +188 vmark.exe    Controls               TControl.WndProc
00673637 +157 vmark.exe    Controls               TWinControl.WndProc
0065b511 +421 vmark.exe    Forms                  TCustomForm.WndProc
006732b4 +02c vmark.exe    Controls               TWinControl.MainWndProc
00603fe0 +014 vmark.exe    Classes                _17260
7759411b +04b ntdll.dll                           KiUserCallbackDispatcher
00674c53 +09f vmark.exe    Controls               TWinControl.WMSysCommand
0065d625 +055 vmark.exe    Forms                  TCustomForm.WMSysCommand
0040cde3 +02f vmark.exe    Unit1.h        189  +2 TForm1.Dispatch
006706d8 +188 vmark.exe    Controls               TControl.WndProc
00673637 +157 vmark.exe    Controls               TWinControl.WndProc
0065b511 +421 vmark.exe    Forms                  TCustomForm.WndProc
006732b4 +02c vmark.exe    Controls               TWinControl.MainWndProc
00603fe0 +014 vmark.exe    Classes                _17260
7759411b +04b ntdll.dll                           KiUserCallbackDispatcher
006709b5 +015 vmark.exe    Controls               TControl.WMNCLButtonDown
0065d355 +085 vmark.exe    Forms                  TCustomForm.WMNCLButtonDown
0040cde3 +02f vmark.exe    Unit1.h        189  +2 TForm1.Dispatch
006706d8 +188 vmark.exe    Controls               TControl.WndProc
00673637 +157 vmark.exe    Controls               TWinControl.WndProc
0065b511 +421 vmark.exe    Forms                  TCustomForm.WndProc
006732b4 +02c vmark.exe    Controls               TWinControl.MainWndProc
00603fe0 +014 vmark.exe    Classes                _17260
745dfd8b +00b USER32.dll                          DispatchMessageA
006617d7 +083 vmark.exe    Forms                  TApplication.ProcessMessage
0066180e +00a vmark.exe    Forms                  TApplication.HandleMessage
00661a2e +096 vmark.exe    Forms                  TApplication.Run
004023f3 +21f vmark.exe    vmark.cpp       77 +35 WinMain
006a2f24 +14c vmark.exe                           __startup
745ed9b4 +134 USER32.dll                          GetWindow
7759411b +04b ntdll.dll                           KiUserCallbackDispatcher
766a8742 +022 KERNEL32.DLL                        BaseThreadInitThunk
775973eb +06b ntdll.dll                           bsearch
77569f08 +2b8 ntdll.dll                           LdrGetProcedureAddressForCaller
77546c46 +016 ntdll.dll                           LdrGetProcedureAddress

thread $1f4c:
766a8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $4580: <priority:-1>
76b22bed +fd KERNELBASE.dll  WaitForMultipleObjectsEx
76b22ad3 +13 KERNELBASE.dll  WaitForMultipleObjects
766a8742 +22 KERNEL32.DLL    BaseThreadInitThunk

thread $2d84:
766a8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $147c:
766a8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $35d0:
766a8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $3b84:
766a8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $3ecc:
76b22bed +fd KERNELBASE.dll           WaitForMultipleObjectsEx
005a2429 +0d vmark.exe      madExcept _17188
005a2493 +37 vmark.exe      madExcept _17189
766a8742 +22 KERNEL32.DLL             BaseThreadInitThunk
>> created by main thread ($1990) at:
7410c282 +00 combase.dll

thread $394c: <priority:2>
005a2429 +0d vmark.exe    madExcept _17188
005a2493 +37 vmark.exe    madExcept _17189
766a8742 +22 KERNEL32.DLL           BaseThreadInitThunk
>> created by main thread ($1990) at:
71eb31bb +00 WINMM.DLL

modules:
00400000 vmark.exe                                  C:\Program Files (x86)\Visual Watermark
03130000 FREEIMAGE.DLL                              C:\Program Files (x86)\Visual Watermark
10000000 ZLIB1.DLL                                  C:\Program Files (x86)\Visual Watermark
577c0000 SHFOLDER.DLL           6.2.15063.0         C:\WINDOWS\SYSTEM32
612c0000 sfc_os.DLL             6.2.15063.0         C:\WINDOWS\SYSTEM32
66680000 sfc.dll                6.2.15063.0         C:\WINDOWS\SYSTEM32
6a0e0000 MPR.dll                6.2.15063.0         C:\WINDOWS\SYSTEM32
6c460000 msxml3.dll             8.110.15063.483     C:\WINDOWS\System32
6c5f0000 AcLayers.DLL           6.2.15063.0         C:\WINDOWS\AppPatch
6eb40000 CoreUIComponents.dll   6.2.15063.483       C:\WINDOWS\System32
6ed70000 CoreMessaging.dll      6.2.15063.483       C:\WINDOWS\System32
6ee00000 SortWindows61.dll      6.2.15063.0         C:\WINDOWS\SYSTEM32
705e0000 usermgrcli.dll         6.2.15063.0         C:\WINDOWS\SYSTEM32
705f0000 TextInputFramework.dll 6.2.15063.0         C:\WINDOWS\System32
70ff0000 wintypes.dll           6.2.15063.0         C:\WINDOWS\SYSTEM32
71330000 apphelp.dll            6.2.15063.447       C:\WINDOWS\SYSTEM32
71900000 WindowsCodecs.dll      6.2.15063.483       C:\WINDOWS\SYSTEM32
71a80000 msimg32.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
71e80000 WINMMBASE.dll          6.2.15063.0         C:\WINDOWS\SYSTEM32
71eb0000 WINMM.DLL              6.2.15063.0         C:\WINDOWS\SYSTEM32
72150000 GDIPLUS.DLL            6.2.15063.483       C:\WINDOWS\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.15063.483_none_9e9856e456d5e776
72720000 oleacc.dll             7.2.15063.447       C:\WINDOWS\SYSTEM32
727c0000 WSOCK32.DLL            6.2.15063.0         C:\WINDOWS\SYSTEM32
72860000 olepro32.dll           6.2.15063.447       C:\WINDOWS\SYSTEM32
72ac0000 dwmapi.dll             6.2.15063.483       C:\WINDOWS\system32
72af0000 secur32.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
72b00000 uxtheme.dll            6.2.15063.0         C:\WINDOWS\system32
72cc0000 COMCTL32.DLL           6.10.15063.0        C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8
73580000 ntmarta.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
73b30000 bcrypt.dll             6.2.15063.0         C:\WINDOWS\SYSTEM32
73b50000 VERSION.DLL            6.2.15063.0         C:\WINDOWS\SYSTEM32
73b60000 WINSPOOL.DRV           6.2.15063.138       C:\WINDOWS\SYSTEM32
73fe0000 CRYPTBASE.dll          6.2.15063.0         C:\WINDOWS\System32
73ff0000 SspiCli.dll            6.2.15063.0         C:\WINDOWS\System32
74010000 combase.dll            6.2.15063.447       C:\WINDOWS\System32
74250000 clbcatq.dll            2001.12.10941.16384 C:\WINDOWS\System32
742e0000 advapi32.dll           6.2.15063.0         C:\WINDOWS\System32
74360000 WS2_32.dll             6.2.15063.0         C:\WINDOWS\System32
743d0000 cfgmgr32.dll           6.2.15063.0         C:\WINDOWS\System32
744f0000 IMM32.DLL              6.2.15063.0         C:\WINDOWS\System32
745c0000 USER32.dll             6.2.15063.0         C:\WINDOWS\System32
74700000 win32u.dll             6.2.15063.0         C:\WINDOWS\System32
748a0000 gdi32full.dll          6.2.15063.413       C:\WINDOWS\System32
74a00000 powrprof.dll           6.2.15063.0         C:\WINDOWS\System32
74a50000 kernel.appcore.dll     6.2.15063.0         C:\WINDOWS\System32
74ae0000 msvcp_win.dll          6.2.15063.0         C:\WINDOWS\System32
74b60000 COMDLG32.DLL           6.2.15063.483       C:\WINDOWS\System32
74c50000 profapi.dll            6.2.15063.0         C:\WINDOWS\System32
74c60000 bcryptPrimitives.dll   6.2.15063.138       C:\WINDOWS\System32
74cc0000 MSCTF.dll              6.2.15063.332       C:\WINDOWS\System32
74e10000 shlwapi.dll            6.2.15063.0         C:\WINDOWS\System32
74e60000 SETUPAPI.dll           6.2.15063.0         C:\WINDOWS\System32
75280000 msvcrt.dll             7.0.15063.0         C:\WINDOWS\System32
75340000 SHELL32.dll            6.2.15063.483       C:\WINDOWS\System32
76690000 KERNEL32.DLL           6.2.15063.296       C:\WINDOWS\System32
76760000 ole32.dll              6.2.15063.483       C:\WINDOWS\System32
769e0000 sechost.dll            6.2.15063.0         C:\WINDOWS\System32
76a30000 KERNELBASE.dll         6.2.15063.483       C:\WINDOWS\System32
76c00000 shcore.dll             6.2.15063.0         C:\WINDOWS\System32
76c90000 windows.storage.dll    6.2.15063.483       C:\WINDOWS\System32
77220000 OLEAUT32.dll           6.2.15063.332       C:\WINDOWS\System32
77310000 RPCRT4.dll             6.2.15063.447       C:\WINDOWS\System32
773d0000 GDI32.dll              6.2.15063.483       C:\WINDOWS\System32
77400000 ucrtbase.dll           6.2.15063.447       C:\WINDOWS\System32
77520000 ntdll.dll              6.2.15063.447       C:\WINDOWS\SYSTEM32

processes:
0000 Idle                       0 0    0
0004 System                     0 0    0
0150 smss.exe                   0 0    0
01c4 csrss.exe                  0 0    0
0248 wininit.exe                0 0    0
0250 csrss.exe                  1 0    0
029c services.exe               0 0    0
02a8 lsass.exe                  0 0    0
0300 winlogon.exe               1 0    0
035c svchost.exe                0 0    0
0370 svchost.exe                0 0    0
0384 fontdrvhost.exe            0 0    0
0388 fontdrvhost.exe            1 0    0
03ec svchost.exe                0 0    0
0134 svchost.exe                0 0    0
0180 dwm.exe                    1 0    0
0414 svchost.exe                0 0    0
0468 svchost.exe                0 0    0
04b4 svchost.exe                0 0    0
04bc WUDFHost.exe               0 0    0
04e8 svchost.exe                0 0    0
04f4 svchost.exe                0 0    0
0520 svchost.exe                0 0    0
052c svchost.exe                0 0    0
0534 svchost.exe                0 0    0
05ac svchost.exe                0 0    0
05f4 svchost.exe                0 0    0
0608 svchost.exe                0 0    0
0670 svchost.exe                0 0    0
06f8 svchost.exe                0 0    0
0738 svchost.exe                0 0    0
07c0 svchost.exe                0 0    0
0578 svchost.exe                0 0    0
083c svchost.exe                0 0    0
084c svchost.exe                0 0    0
0894 svchost.exe                0 0    0
08ac svchost.exe                0 0    0
08b4 svchost.exe                0 0    0
0914 svchost.exe                0 0    0
0950 svchost.exe                0 0    0
0958 svchost.exe                0 0    0
0960 svchost.exe                0 0    0
09c4 svchost.exe                0 0    0
0a0c svchost.exe                0 0    0
0a54 spoolsv.exe                0 0    0
0aa0 svchost.exe                0 0    0
0b48 audiodg.exe                0 0    0
0bd0 svchost.exe                0 0    0
0bd8 svchost.exe                0 0    0
0be4 DbxSvc.exe                 0 0    0
0bec svchost.exe                0 0    0
0bf8 armsvc.exe                 0 0    0
0748 AGSService.exe             0 0    0
08d0 svchost.exe                0 0    0
0924 svchost.exe                0 0    0
0980 PMBDeviceInfoProvider.exe  0 0    0
0700 SecUPDUtilSvc.exe          0 0    0
0ad0 svchost.exe                0 0    0
0454 Service_KMS.exe            0 0    0
0c04 svchost.exe                0 0    0
0c20 svchost.exe                0 0    0
0c28 svchost.exe                0 0    0
0c30 SecurityHealthService.exe  0 0    0
0c5c svchost.exe                0 0    0
0c64 TeamViewer_Service.exe     0 0    0
0c80 svchost.exe                0 0    0
0c90 MsMpEng.exe                0 0    0
0c98 svchost.exe                0 0    0
0dd0 svchost.exe                0 0    0
0de4 svchost.exe                0 0    0
0e84 dasHost.exe                0 0    0
0ec4 Memory Compression         0 0    0
10f0 svchost.exe                0 0    0
10f8 svchost.exe                0 0    0
115c svchost.exe                0 0    0
1284 svchost.exe                0 0    0
12e0 svchost.exe                0 0    0
13a0 NisSrv.exe                 0 0    0
0548 sihost.exe                 1 4    20   normal       C:\Windows\System32
0558 svchost.exe                1 4    1    normal       C:\Windows\System32
0b58 svchost.exe                1 4    8    normal       C:\Windows\System32
181c svchost.exe                0 0    0
18fc TeamViewer.exe             1 294  135  normal       C:\Program Files (x86)\TeamViewer
1924 explorer.exe               1 2693 1349 normal       C:\Windows
195c DropboxUpdate.exe          0 0    0
1988 taskhostw.exe              1 13   14   normal       C:\Windows\System32
1afc ClassicStartMenu.exe       1 4    5    normal       C:\Program Files\Classic Shell
1894 ShellExperienceHost.exe    1 13   89   normal       C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy
1c80 svchost.exe                0 0    0
1ca8 SearchIndexer.exe          0 0    0
1d60 RuntimeBroker.exe          1 44   73   normal       C:\Windows\System32
1e60 SpeechRuntime.exe          1 9    28   normal       C:\Windows\System32\Speech_OneCore\common
1e88 SkypeHost.exe              1 4    17   normal       C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.820.0_x64__kzf8qxf38zg5c
1ef4 svchost.exe                0 0    0
2188 svchost.exe                0 0    0
27c8 SettingSyncHost.exe        1 39   4    below normal C:\Windows\System32
27d4 tv_w32.exe                 1 0    0
27e0 tv_x64.exe                 1 0    0
2cd8 svchost.exe                1 4    1    normal       C:\Windows\System32
2890 MSASCuiL.exe               1 7    6    normal       C:\Program Files\Windows Defender
332c Monitor.exe                1 16   22   normal       C:\Windows\PixArt\Pac7302
3378 OneDrive.exe               1 59   40   normal       C:\Users\usuario\AppData\Local\Microsoft\OneDrive
33bc Spotify.exe                1 53   64   normal       C:\Users\usuario\AppData\Roaming\Spotify
331c Spotify.exe                1 16   5    normal       C:\Users\usuario\AppData\Roaming\Spotify
2008 SpotifyWebHelper.exe       1 9    4    normal       C:\Users\usuario\AppData\Roaming\Spotify
3548 Dropbox.exe                1 66   80   normal       C:\Program Files (x86)\Dropbox\Client
3558 Dropbox.exe                1 4    4    normal       C:\Program Files (x86)\Dropbox\Client
357c Dropbox.exe                1 4    1    normal       C:\Program Files (x86)\Dropbox\Client
3614 Spotify.exe                1 16   5    normal       C:\Users\usuario\AppData\Roaming\Spotify
3754 CSISYN~1.EXE               1 35   13   normal       C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE16
17bc acrotray.exe               1 61   39   normal       C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat
2308 BrotherHelp.exe            1 52   23   normal       C:\Program Files (x86)\Brother\Brother Help
22cc BrCtrlCntr.exe             1 17   1    normal       C:\Program Files (x86)\ControlCenter4
254c BrCcUxSys.exe              1 27   10   normal       C:\Program Files (x86)\ControlCenter4
2528 BrYNSvc.exe                0 0    0
2484 PMBVolumeWatcher.exe       1 36   14   normal       C:\Program Files (x86)\Sony\PlayMemories Home
03fc ducservice.exe             0 0    0
0f94 svchost.exe                0 0    0
0464 WUDFHost.exe               0 0    0
34ac chrome.exe                 1 267  117  normal       C:\Program Files (x86)\Google\Chrome\Application
09e4 chrome.exe                 1 4    4    normal       C:\Program Files (x86)\Google\Chrome\Application
157c chrome.exe                 1 4    4    normal       C:\Program Files (x86)\Google\Chrome\Application
333c chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
3388 chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
3380 chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
01d0 dllhost.exe                1 4    3    normal       C:\Windows\System32
1e0c svchost.exe                0 0    0
2974 svchost.exe                0 0    0
2b18 opera.exe                  1 122  68   normal       C:\Program Files (x86)\Opera\46.0.2597.57
2b24 opera_crashreporter.exe    1 4    1    normal       C:\Program Files (x86)\Opera\46.0.2597.57
07b8 opera.exe                  1 0    0    idle         C:\Program Files (x86)\Opera\46.0.2597.57
13f0 opera.exe                  1 0    0    normal       C:\Program Files (x86)\Opera\46.0.2597.57
1e48 opera.exe                  1 13   30   normal       C:\Program Files (x86)\Opera\46.0.2597.57
1b74 chrome.exe                 1 21   17   normal       C:\Program Files (x86)\Google\Chrome\Application
16e8 atiesrxx.exe               0 0    0
0904 atieclxx.exe               1 0    0
1710 chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
2b20 Steam.exe                  1 649  112  normal       C:\Program Files (x86)\Steam
0c58 steamwebhelper.exe         1 9    17   normal       C:\Program Files (x86)\Steam\bin\cef\cef.win7
2f70 SteamService.exe           0 0    0
0dd8 steamwebhelper.exe         1 0    0    normal       C:\Program Files (x86)\Steam\bin\cef\cef.win7
1f34 Skype.exe                  1 184  129  normal       C:\Program Files (x86)\Skype\Phone
0e00 SkypeBrowserHost.exe       1 53   46   normal       C:\Program Files (x86)\Skype\Browser
2ce0 ApplicationFrameHost.exe   1 121  104  normal       C:\Windows\System32
2e54 WinStore.App.exe           1 4    21   normal       C:\Program Files\WindowsApps\Microsoft.WindowsStore_11706.1001.26.0_x64__8wekyb3d8bbwe
2180 RemindersServer.exe        1 4    1    normal       C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
2328 Video.UI.exe               1 4    15   normal       C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17062.12911.0_x64__8wekyb3d8bbwe
0348 svchost.exe                0 0    0
2628 rundll32.exe               1 4    2    normal       C:\Windows\System32
06c8 Spotify.exe                1 20   9    normal       C:\Users\usuario\AppData\Roaming\Spotify
23ec BrStMonW.exe               1 347  73   normal       C:\Program Files (x86)\Browny02\Brother
219c Origin.exe                 1 236  256  normal       X:\Archivos de Programa (x86)\Origin
077c OriginWebHelperService.exe 0 0    0
32f4 OriginClientService.exe    0 0    0
25ec QtWebEngineProcess.exe     1 4    1    normal       X:\Archivos de Programa (x86)\Origin
1ecc QtWebEngineProcess.exe     1 4    1    normal       X:\Archivos de Programa (x86)\Origin
138c svchost.exe                0 0    0
2efc P2PClient.exe              1 566  1095 normal       C:\Program Files (x86)\HiP2P Client
0798 svchost.exe                0 0    0
174c splwow64.exe               1 4    2    normal       C:\Windows
2764 PnkBstrA.exe               0 0    0
0210 taskhostw.exe              1 0    0
22bc opera.exe                  1 0    0    normal       C:\Program Files (x86)\Opera\46.0.2597.57
30c0 svchost.exe                0 0    0
47b8 WSHelper.exe               1 65   48   normal       C:\PROGRA~2\COMMON~1\WONDER~1\WONDER~1
245c Microsoft.Photos.exe       1 22   109  normal       C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.18062.13720.0_x64__8wekyb3d8bbwe
0f54 SystemSettings.exe         1 11   40   normal       C:\Windows\ImmersiveControlPanel
2058 chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
3b3c chrome.exe                 1 4    1    normal       C:\Program Files (x86)\Google\Chrome\Application
3f5c Photoshop.exe              1 896  2356 normal       C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)
24e0 dynamiclinkmanager.exe     1 4    5    normal       C:\Program Files (x86)\Common Files\Adobe\dynamiclink\CS6
3d14 CS6ServiceManager.exe      1 4    5    normal       C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager
407c Calculator.exe             1 6    19   normal       C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1706.1862.0_x64__8wekyb3d8bbwe
0554 BitTorrent.exe             1 242  147  normal       C:\Users\usuario\AppData\Roaming\BitTorrent
4b40 bittorrentie.exe           1 25   42   normal       C:\Users\usuario\AppData\Roaming\BitTorrent\updates\7.10.0_43917
1e54 bittorrentie.exe           1 23   43   normal       C:\Users\usuario\AppData\Roaming\BitTorrent\updates\7.10.0_43917
4868 WmiPrvSE.exe               0 0    0
49a4 chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
30fc cmd.exe                    1 0    0    normal       C:\Windows\System32
44c4 conhost.exe                1 23   21   normal       C:\Windows\System32
2c38 opera.exe                  1 0    0    idle         C:\Program Files (x86)\Opera\46.0.2597.57
427c SearchUI.exe               1 23   78   normal       C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
3e2c svchost.exe                0 0    0
19e8 notepad++.exe              1 262  221  normal       C:\Program Files\Notepad++
34f8 chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
2a28 firefox.exe                1 38   72   normal       C:\Program Files (x86)\Mozilla Firefox
48e0 chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
2f3c chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
17f4 SnippingTool.exe           1 119  54   normal       C:\Windows\System32
1aac smartscreen.exe            1 4    2    normal       C:\Windows\System32
07f4 SearchProtocolHost.exe     0 0    0
4bf8 svchost.exe                0 0    0
2fa8 svchost.exe                0 0    0
0a8c msdt.exe                   1 106  76   normal       C:\Windows\System32
19f8 sdiagnhost.exe             1 4    4    normal       C:\Windows\System32
07a4 conhost.exe                1 14   9    normal       C:\Windows\System32
4960 vmark.exe                  1 425  320  normal       C:\Program Files (x86)\Visual Watermark
3018 SearchFilterHost.exe       0 0    0
2ef8 vmark.exe                  1 213  206  normal       C:\Program Files (x86)\Visual Watermark
2b64 wermgr.exe                 0 0    0

hardware:
+ {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
  - Adobe PDF
  - Brother MFC-J480DW Printer
  - Brother PC-FAX v.3.2
  - Cola de impresi?n ra?z
  - Enviar a OneNote 16
  - Fax
  - Microsoft Print to PDF
  - Microsoft XPS Document Writer
+ {36fc9e60-c465-11cf-8056-444553540000}
  - Concentrador ra?z USB
  - Concentrador ra?z USB
  - Controladora de host mejorada USB de la familia Chipset Intel(R) serie 5/serie 3400 - 3B34
  - Controladora de host mejorada USB de la familia Chipset Intel(R) serie 5/serie 3400 - 3B3C
  - Dispositivo compuesto USB
  - Dispositivo compuesto USB
  - Dispositivo de almacenamiento USB
  - Generic USB Hub
  - Generic USB Hub
  - Generic USB Hub
  - Microsoft Mouse and Keyboard Detection Driver (USB)
+ {4d36e965-e325-11ce-bfc1-08002be10318}
  - hp BDDVDRW CH28N
+ {4d36e966-e325-11ce-bfc1-08002be10318}
  - Equipo basado en x64 ACPI
+ {4d36e967-e325-11ce-bfc1-08002be10318}
  - Generic STORAGE DEVICE USB Device
  - Samsung SSD 850 EVO 120GB
  - WDC WD20EZRZ-00Z5HB0
+ {4d36e968-e325-11ce-bfc1-08002be10318}
  - AMD Radeon R7 200 Series (driver 22.19.162.4)
+ {4d36e96a-e325-11ce-bfc1-08002be10318}
  - Controladora SATA AHCI est?ndar
+ {4d36e96b-e325-11ce-bfc1-08002be10318}
  - Teclado PS/2 est?ndar
  - Wireless Keyboard Filter Device
+ {4d36e96c-e325-11ce-bfc1-08002be10318}
  - AMD High Definition Audio Device (driver 10.0.1.0)
  - C-Media USB Headphone Set
  - Dispositivo de audio USB
  - Dispositivo de High Definition Audio
+ {4d36e96e-e325-11ce-bfc1-08002be10318}
  - AOC 2369 (driver 1.0.0.0)
  - Monitor genérico que no es PnP
+ {4d36e96f-e325-11ce-bfc1-08002be10318}
  - Mouse compatible con HID
  - Mouse compatible PS/2
+ {4d36e972-e325-11ce-bfc1-08002be10318}
  - Intel(R) 82578DM Gigabit Network Connection
+ {4d36e978-e325-11ce-bfc1-08002be10318}
  - Puerto de comunicaciones (COM1)
+ {4d36e97b-e325-11ce-bfc1-08002be10318}
  - Controladora de espacios de almacenamiento de Microsoft
+ {4d36e97d-e325-11ce-bfc1-08002be10318}
  - Administrador de vol?menes
  - Altavoz del sistema
  - Bot?n de caracter?stica fija ACPI
  - Bot?n de inicio/apagado ACPI
  - Complejo ra?z PCI Express
  - Controlador BIOS de Microsoft System Management
  - Controlador de pantalla b?sica de Microsoft
  - Controlador de representaci?n b?sica de Microsoft
  - Controladora de acceso directo a memoria
  - Controladora de High Definition Audio
  - Controladora de memoria
  - Controladora LPC
  - Controladora programable avanzada de interrupciones
  - Controladora programable de interrupciones
  - Enumerador de adaptador de red virtual NDIS
  - Enumerador de bus compuesto
  - Enumerador de bus ra?z de UMBus
  - Enumerador de dispositivos de software Plug and Play
  - Enumerador de unidades virtuales de Microsoft
  - High Definition Audio Bus (driver 16.40.0.0)
  - Intel(R) Management Engine Interface (driver 6.0.0.1179)
  - Intel(R) Management Engine Interface (driver 1.0.0.0)
  - Interfaz de administraci?n para ACPI de Microsoft Windows
  - Placa del sistema
  - Procesador de datos numéricos
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Recursos de la placa base
  - Recursos de la placa base
  - Recursos de la placa base
  - Remote Desktop Device Redirector Bus
  - Sistema CMOS/reloj en tiempo real
  - Sistema Microsoft compatible con ACPI
  - Temporizador de eventos de alta precisi?n
  - Temporizador del sistema
  - Wireless Device
+ {50127dc3-0f36-415e-a6cc-4cb3be910b65}
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
+ {62f9c741-b25a-46ce-b54c-9bccce08b6f2}
  - Bus adaptador de transici?n IPv4 IPv6 de Microsoft
  - Microsoft Device Association Root Enumerator
  - Microsoft Radio Device Enumeration Bus
  - Sintetizador por software GS de tabla de onda de
+ {6bdd1fc6-810f-11d0-bec7-08002be2092f}
  - Brother MFC-J480DW LAN (driver 1.0.2.3)
  - Eye 312 (driver 1.0.0.14)
+ {745a17a0-74d3-11d0-b6fe-00a0c90f57da}
  - Controlador del sistema compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de entrada USB
  - Dispositivo de entrada USB
  - Dispositivo definido por el proveedor compatible con HID
  - Microsoft Hardware USB Keyboard
  - Microsoft Hardware USB Mouse
+ {c166523c-fe0c-4a94-a586-f1a80cfbbf3e}
  - Altavoces (2- Dispositivo de High Definition Audio)
  - Altavoces (C-Media USB Headphone Set  )
  - Micr?fono (C-Media USB Headphone Set  )
  - Micr?fono (Dispositivo de audio USB)
+ {d94ee5d8-d189-4994-83d2-f68d7d41b0e6}
  - M?dulo de plataforma segura 1.2
+ {eec5ad98-8080-425f-922a-dabf3de3f69a}
  - E:\

stack dump:
0019d348  a0 b7 b1 76 de fa ed 0e - 01 00 00 00 07 00 00 00  ...v............
0019d358  5c d3 19 00 19 d4 5f 00 - 30 53 76 03 d0 53 76 03  \....._.0Sv..Sv.
0019d368  b0 22 77 03 ff ff 76 03 - 90 d3 19 00 78 d3 19 00  ."w...v.....x...
0019d378  94 0f 78 03 d0 53 76 03 - 01 d3 19 00 b0 22 77 03  ..x..Sv......"w.
0019d388  0b d3 6d 00 52 00 62 00 - b8 d3 19 00 95 d3 5f 00  ..m.R.b......._.
0019d398  00 00 00 00 ff ff 76 03 - c4 d3 19 00 e7 05 62 00  ......v.......b.
0019d3a8  b8 d3 19 00 d0 53 76 03 - 30 ad 65 00 a8 d3 6d 00  .....Sv.0.e...m.
0019d3b8  f0 d3 19 00 08 87 43 00 - ff ff 00 00 10 d4 19 00  ......C.........
0019d3c8  c7 ab 69 00 44 d3 6e 00 - c4 d3 19 00 00 00 00 00  ..i.D.n.........
0019d3d8  db ea 61 00 a8 d3 6d 00 - 00 00 00 00 38 d4 19 00  ..a...m.....8...
0019d3e8  00 00 00 00 30 ad 65 00 - f8 d3 19 00 ac 84 43 00  ....0.e.......C.
0019d3f8  3c d4 19 00 24 6a 40 00 - 80 69 65 03 4c d4 19 00  <...$j@..ie.L...
0019d408  80 69 65 03 80 69 65 03 - e0 d5 19 00 c7 ab 69 00  .ie..ie.......i.
0019d418  50 34 6d 00 00 d4 19 00 - 00 00 00 00 38 d4 19 00  P4m.........8...
0019d428  80 69 65 03 00 00 00 00 - 68 d4 19 00 00 00 00 00  .ie.....h.......
0019d438  00 00 00 00 68 d4 19 00 - 4d ad 65 00 80 69 65 03  ....h...M.e..ie.
0019d448  86 e2 65 00 01 d5 65 00 - 80 69 65 03 10 d6 19 00  ..e...e..ie.....
0019d458  49 d5 65 00 e8 cd 40 00 - 10 d6 19 00 80 69 65 03  I.e...@......ie.
0019d468  90 d5 19 00 db 06 67 00 - 94 0f 78 03 10 d6 19 00  ......g...x.....
0019d478  80 69 65 03 e5 f2 ad 4f - fe ff ff ff c4 d4 19 00  .ie....O........

disassembling:
004386cc    public basefilter.cpp.vwm.SaveStyles:  ; function entry point
004386cc 75   push    ebp
004386cd      mov     ebp, esp
004386cf      add     esp, -$2c
004386d2      mov     eax, $6ed344
004386d7      call    +$2624a4 ($69ab80)     ; __InitExceptBlockLDTC
004386d7
004386dc 77   mov     word ptr [ebp-$1c], $14
004386e2      push    $ffff
004386e7      lea     eax, [ebp-8]
004386ea      call    -$368b3 ($401e3c)      ; dstring.h.System.AnsiString.Create
004386ea
004386ef      inc     dword ptr [ebp-$10]
004386f2      call    -$3db ($43831c)        ; basefilter.cpp.vwm.StylesFileName
004386f2
004386f7      lea     ecx, [ebp-8]
004386fa      mov     ecx, [ecx]
004386fc      mov     dl, 1
004386fe      mov     eax, [$5f7b78]
00438703    > call    +$1c4c68 ($5fd370)     ; Classes.TFileStream.Create
00438703
00438708      push    eax
00438709      lea     eax, [ebp-4]
0043870c      push    eax
0043870d      call    -$162 ($4385b0)        ; stl/_auto_ptr.h._STL.auto_ptr
0043870d
00438712      add     esp, 8
00438715      inc     dword ptr [ebp-$10]
00438718      dec     dword ptr [ebp-$10]
0043871b      lea     eax, [ebp-8]
0043871e      mov     edx, 2
00438723      call    +$296810 ($6cef38)     ; System.AnsiString.Destroy
00438723
00438728      mov     word ptr [ebp-$1c], 8
0043872e 78   push    0
00438730      push    0
00438732      lea     ecx, [ebp-4]
00438735      push    ecx
00438736      call    +$3d ($438778)         ; stl/_auto_ptr.h._STL.auto_ptr
00438736
0043873b      pop     ecx
0043873c      call    +$1c4797 ($5fced8)     ; Classes.TStream.SetSize64
0043873c
00438741 79   lea     eax, [ebp-4]
00438744      push    eax
00438745      call    -$fa ($438650)         ; stl/_auto_ptr.h._STL.auto_ptr
00438745
0043874a      pop     ecx
0043874b      mov     edx, eax
0043874d      mov     eax, $739690
00438752      call    +$1455 ($439bac)       ; basefilter.cpp.vwm.TStyles.SaveToStream
00438752
00438757 80   dec     dword ptr [ebp-$10]
0043875a      push    2
0043875c      lea     edx, [ebp-4]
0043875f      push    edx
00438760      call    -$17d ($4385e8)        ; stl/_auto_ptr.h._STL.auto_ptr
00438760
00438765      add     esp, 8
00438768      mov     ecx, [ebp-$2c]
0043876b      mov     fs:[0], ecx
00438772      mov     esp, ebp
00438774      pop     ebp
00438775      ret

date/time         : 2017-07-28, 22:22:57, 193ms
computer name     : DRAGON
user name         : usuario
registered owner  : Usuario de Windows
operating system  : Windows NT New x64 build 9200
system language   : Spanish
system up time    : 2 days 3 hours
program up time   : 1 minute 5 seconds
processors        : 4x Intel(R) Core(TM) i5 CPU 650 @ 3.20GHz
physical memory   : 2381/8055 MB (free/total)
free disk space   : (C:) 29.22 GB
display mode      : 1600x1200, 32 bit
process id        : $33fc
allocated memory  : 89.18 MB
executable        : vmark.exe
exec. date/time   : 2010-06-21 12:20
compiled with     : BCB6
madExcept version : 3.0k
callstack crc     : $c548905e, $ea7b454e, $1a16b477
count             : 2
exception number  : 1
exception class   : EFCreateError
exception message : Cannot create file C:\ProgramData\Visual Watermark\.styles.

main thread ($13f0):
005fd414 +060 vmark.exe    Classes                TFileStream.Create
005fd390 +020 vmark.exe    Classes                TFileStream.Create
00438703 +037 vmark.exe    basefilter.cpp  77  +2 vwm.SaveStyles
004384a7 +003 vmark.exe    basefilter.cpp  59  +2 vwm.CloseFilters
00406a1f +087 vmark.exe    Unit1.cpp      540  +5 TForm1.FormClose
0065ad47 +017 vmark.exe    Forms                  TCustomForm.DoClose
0065e281 +055 vmark.exe    Forms                  TCustomForm.Close
0065d544 +000 vmark.exe    Forms                  TCustomForm.WMClose
0040cde3 +02f vmark.exe    Unit1.h        189  +2 TForm1.Dispatch
006706d8 +188 vmark.exe    Controls               TControl.WndProc
00673637 +157 vmark.exe    Controls               TWinControl.WndProc
0065b511 +421 vmark.exe    Forms                  TCustomForm.WndProc
006732b4 +02c vmark.exe    Controls               TWinControl.MainWndProc
00603fe0 +014 vmark.exe    Classes                _17260
7759411b +04b ntdll.dll                           KiUserCallbackDispatcher
00674c53 +09f vmark.exe    Controls               TWinControl.WMSysCommand
0065d625 +055 vmark.exe    Forms                  TCustomForm.WMSysCommand
0040cde3 +02f vmark.exe    Unit1.h        189  +2 TForm1.Dispatch
006706d8 +188 vmark.exe    Controls               TControl.WndProc
00673637 +157 vmark.exe    Controls               TWinControl.WndProc
0065b511 +421 vmark.exe    Forms                  TCustomForm.WndProc
006732b4 +02c vmark.exe    Controls               TWinControl.MainWndProc
00603fe0 +014 vmark.exe    Classes                _17260
7759411b +04b ntdll.dll                           KiUserCallbackDispatcher
006709b5 +015 vmark.exe    Controls               TControl.WMNCLButtonDown
0065d355 +085 vmark.exe    Forms                  TCustomForm.WMNCLButtonDown
0040cde3 +02f vmark.exe    Unit1.h        189  +2 TForm1.Dispatch
006706d8 +188 vmark.exe    Controls               TControl.WndProc
00673637 +157 vmark.exe    Controls               TWinControl.WndProc
0065b511 +421 vmark.exe    Forms                  TCustomForm.WndProc
006732b4 +02c vmark.exe    Controls               TWinControl.MainWndProc
00603fe0 +014 vmark.exe    Classes                _17260
745dfd8b +00b USER32.dll                          DispatchMessageA
006617d7 +083 vmark.exe    Forms                  TApplication.ProcessMessage
0066180e +00a vmark.exe    Forms                  TApplication.HandleMessage
00661a2e +096 vmark.exe    Forms                  TApplication.Run
004023f3 +21f vmark.exe    vmark.cpp       77 +35 WinMain
006a2f24 +14c vmark.exe                           __startup
745ed9b4 +134 USER32.dll                          GetWindow
7759411b +04b ntdll.dll                           KiUserCallbackDispatcher
766a8742 +022 KERNEL32.DLL                        BaseThreadInitThunk
775973eb +06b ntdll.dll                           bsearch

thread $48f8: <priority:-1>
76b22bed +fd KERNELBASE.dll  WaitForMultipleObjectsEx
76b22ad3 +13 KERNELBASE.dll  WaitForMultipleObjects
766a8742 +22 KERNEL32.DLL    BaseThreadInitThunk

thread $3bb8:
766a8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $28b4:
766a8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $2b00:
76b22bed +fd KERNELBASE.dll           WaitForMultipleObjectsEx
005a2429 +0d vmark.exe      madExcept _17188
005a2493 +37 vmark.exe      madExcept _17189
766a8742 +22 KERNEL32.DLL             BaseThreadInitThunk
>> created by main thread ($13f0) at:
7410c282 +00 combase.dll

thread $1a04: <priority:2>
005a2429 +0d vmark.exe    madExcept _17188
005a2493 +37 vmark.exe    madExcept _17189
766a8742 +22 KERNEL32.DLL           BaseThreadInitThunk
>> created by main thread ($13f0) at:
71eb31bb +00 WINMM.DLL

thread $246c:
766a8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $1bb4:
766a8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $29bc (TImageLoaderThread): <suspended> <priority:-1>
76b036bd +00d KERNELBASE.dll                     SuspendThread
00602e93 +00b vmark.exe      Classes             TThread.Suspend
00417fd2 +152 vmark.exe      ilthread.cpp 45 +23 TImageLoaderThread.Execute
005a2547 +02b vmark.exe      madExcept           _17190
00602ab4 +034 vmark.exe      Classes             _17119
00620ab8 +028 vmark.exe      System              _16726
005a2429 +00d vmark.exe      madExcept           _17188
005a2493 +037 vmark.exe      madExcept           _17189
766a8742 +022 KERNEL32.DLL                       BaseThreadInitThunk
>> created by main thread ($13f0) at:
00417e0f +033 vmark.exe      ilthread.cpp 15  +1 TImageLoaderThread.Create

modules:
00400000 vmark.exe                                  C:\Program Files (x86)\Visual Watermark
03110000 FREEIMAGE.DLL                              C:\Program Files (x86)\Visual Watermark
10000000 ZLIB1.DLL                                  C:\Program Files (x86)\Visual Watermark
577c0000 SHFOLDER.DLL           6.2.15063.0         C:\WINDOWS\SYSTEM32
64ab0000 thumbcache.dll         6.2.15063.447       C:\Windows\System32
6c460000 msxml3.dll             8.110.15063.483     C:\WINDOWS\System32
6ea70000 Windows.UI.dll         6.2.15063.483       C:\Windows\System32
6eb40000 CoreUIComponents.dll   6.2.15063.483       C:\WINDOWS\System32
6ed70000 CoreMessaging.dll      6.2.15063.483       C:\WINDOWS\System32
705e0000 usermgrcli.dll         6.2.15063.0         C:\WINDOWS\SYSTEM32
705f0000 TextInputFramework.dll 6.2.15063.0         C:\WINDOWS\System32
70c30000 Bcp47Langs.dll         6.2.15063.0         C:\Windows\System32
70c80000 MrmCoreR.dll           6.2.15063.0         C:\Windows\System32
70ff0000 wintypes.dll           6.2.15063.0         C:\WINDOWS\SYSTEM32
71900000 WindowsCodecs.dll      6.2.15063.483       C:\WINDOWS\SYSTEM32
71a80000 msimg32.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
71a90000 iertutil.dll           11.0.15063.483      C:\Windows\System32
71cb0000 urlmon.dll             11.0.15063.483      C:\WINDOWS\SYSTEM32
71e80000 winmmbase.dll          6.2.15063.0         C:\WINDOWS\SYSTEM32
71eb0000 WINMM.DLL              6.2.15063.0         C:\WINDOWS\SYSTEM32
72150000 GDIPLUS.DLL            6.2.15063.483       C:\WINDOWS\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.15063.483_none_9e9856e456d5e776
72720000 oleacc.dll             7.2.15063.447       C:\WINDOWS\SYSTEM32
727c0000 WSOCK32.DLL            6.2.15063.0         C:\WINDOWS\SYSTEM32
72860000 olepro32.dll           6.2.15063.447       C:\WINDOWS\SYSTEM32
72ac0000 dwmapi.dll             6.2.15063.483       C:\WINDOWS\system32
72af0000 secur32.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
72b00000 uxtheme.dll            6.2.15063.0         C:\WINDOWS\system32
72cc0000 COMCTL32.DLL           6.10.15063.0        C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8
73580000 ntmarta.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
735b0000 propsys.dll            7.0.15063.0         C:\WINDOWS\system32
73b30000 bcrypt.dll             6.2.15063.0         C:\WINDOWS\SYSTEM32
73b50000 VERSION.DLL            6.2.15063.0         C:\WINDOWS\SYSTEM32
73b60000 WINSPOOL.DRV           6.2.15063.138       C:\WINDOWS\SYSTEM32
73fe0000 CRYPTBASE.dll          6.2.15063.0         C:\WINDOWS\System32
73ff0000 SspiCli.dll            6.2.15063.0         C:\WINDOWS\System32
74010000 combase.dll            6.2.15063.447       C:\WINDOWS\System32
74250000 clbcatq.dll            2001.12.10941.16384 C:\WINDOWS\System32
742e0000 advapi32.dll           6.2.15063.0         C:\WINDOWS\System32
74360000 WS2_32.dll             6.2.15063.0         C:\WINDOWS\System32
743d0000 cfgmgr32.dll           6.2.15063.0         C:\WINDOWS\System32
744f0000 IMM32.DLL              6.2.15063.0         C:\WINDOWS\System32
745c0000 USER32.dll             6.2.15063.0         C:\WINDOWS\System32
74700000 win32u.dll             6.2.15063.0         C:\WINDOWS\System32
748a0000 gdi32full.dll          6.2.15063.413       C:\WINDOWS\System32
74a00000 powrprof.dll           6.2.15063.0         C:\WINDOWS\System32
74a50000 kernel.appcore.dll     6.2.15063.0         C:\WINDOWS\System32
74ae0000 msvcp_win.dll          6.2.15063.0         C:\WINDOWS\System32
74b60000 COMDLG32.DLL           6.2.15063.483       C:\WINDOWS\System32
74c50000 profapi.dll            6.2.15063.0         C:\WINDOWS\System32
74c60000 bcryptPrimitives.dll   6.2.15063.138       C:\WINDOWS\System32
74cc0000 MSCTF.dll              6.2.15063.332       C:\WINDOWS\System32
74e10000 shlwapi.dll            6.2.15063.0         C:\WINDOWS\System32
75280000 msvcrt.dll             7.0.15063.0         C:\WINDOWS\System32
75340000 SHELL32.dll            6.2.15063.483       C:\WINDOWS\System32
76690000 KERNEL32.DLL           6.2.15063.296       C:\WINDOWS\System32
76760000 ole32.dll              6.2.15063.483       C:\WINDOWS\System32
769e0000 sechost.dll            6.2.15063.0         C:\WINDOWS\System32
76a30000 KERNELBASE.dll         6.2.15063.483       C:\WINDOWS\System32
76c00000 shcore.dll             6.2.15063.0         C:\WINDOWS\System32
76c90000 windows.storage.dll    6.2.15063.483       C:\WINDOWS\System32
77220000 oleaut32.dll           6.2.15063.332       C:\WINDOWS\System32
77310000 RPCRT4.dll             6.2.15063.447       C:\WINDOWS\System32
773d0000 GDI32.dll              6.2.15063.483       C:\WINDOWS\System32
77400000 ucrtbase.dll           6.2.15063.447       C:\WINDOWS\System32
77520000 ntdll.dll              6.2.15063.447       C:\WINDOWS\SYSTEM32

processes:
0000 Idle                            0 0    0
0004 System                          0 0    0
0150 smss.exe                        0 0    0
01c4 csrss.exe                       0 0    0
0248 wininit.exe                     0 0    0
0250 csrss.exe                       1 0    0
029c services.exe                    0 0    0
02a8 lsass.exe                       0 0    0
0300 winlogon.exe                    1 0    0
035c svchost.exe                     0 0    0
0370 svchost.exe                     0 0    0
0384 fontdrvhost.exe                 0 0    0
0388 fontdrvhost.exe                 1 0    0
03ec svchost.exe                     0 0    0
0134 svchost.exe                     0 0    0
0180 dwm.exe                         1 0    0
0414 svchost.exe                     0 0    0
0468 svchost.exe                     0 0    0
04b4 svchost.exe                     0 0    0
04bc WUDFHost.exe                    0 0    0
04e8 svchost.exe                     0 0    0
04f4 svchost.exe                     0 0    0
0520 svchost.exe                     0 0    0
052c svchost.exe                     0 0    0
0534 svchost.exe                     0 0    0
05ac svchost.exe                     0 0    0
05f4 svchost.exe                     0 0    0
0608 svchost.exe                     0 0    0
0670 svchost.exe                     0 0    0
06f8 svchost.exe                     0 0    0
0738 svchost.exe                     0 0    0
07c0 svchost.exe                     0 0    0
0578 svchost.exe                     0 0    0
083c svchost.exe                     0 0    0
084c svchost.exe                     0 0    0
0894 svchost.exe                     0 0    0
08ac svchost.exe                     0 0    0
08b4 svchost.exe                     0 0    0
0914 svchost.exe                     0 0    0
0950 svchost.exe                     0 0    0
0958 svchost.exe                     0 0    0
0960 svchost.exe                     0 0    0
09c4 svchost.exe                     0 0    0
0a0c svchost.exe                     0 0    0
0a54 spoolsv.exe                     0 0    0
0aa0 svchost.exe                     0 0    0
0b48 audiodg.exe                     0 0    0
0bd0 svchost.exe                     0 0    0
0bd8 svchost.exe                     0 0    0
0be4 DbxSvc.exe                      0 0    0
0bec svchost.exe                     0 0    0
0bf8 armsvc.exe                      0 0    0
0748 AGSService.exe                  0 0    0
08d0 svchost.exe                     0 0    0
0924 svchost.exe                     0 0    0
0980 PMBDeviceInfoProvider.exe       0 0    0
0700 SecUPDUtilSvc.exe               0 0    0
0ad0 svchost.exe                     0 0    0
0454 Service_KMS.exe                 0 0    0
0c04 svchost.exe                     0 0    0
0c20 svchost.exe                     0 0    0
0c28 svchost.exe                     0 0    0
0c30 SecurityHealthService.exe       0 0    0
0c5c svchost.exe                     0 0    0
0c64 TeamViewer_Service.exe          0 0    0
0c80 svchost.exe                     0 0    0
0c90 MsMpEng.exe                     0 0    0
0c98 svchost.exe                     0 0    0
0dd0 svchost.exe                     0 0    0
0de4 svchost.exe                     0 0    0
0e84 dasHost.exe                     0 0    0
0ec4 Memory Compression              0 0    0
10f0 svchost.exe                     0 0    0
10f8 svchost.exe                     0 0    0
115c svchost.exe                     0 0    0
1284 svchost.exe                     0 0    0
12e0 svchost.exe                     0 0    0
13a0 NisSrv.exe                      0 0    0
0548 sihost.exe                      1 4    24   normal       C:\Windows\System32
0558 svchost.exe                     1 4    1    normal       C:\Windows\System32
0b58 svchost.exe                     1 4    8    normal       C:\Windows\System32
181c svchost.exe                     0 0    0
18fc TeamViewer.exe                  1 297  136  normal       C:\Program Files (x86)\TeamViewer
1924 explorer.exe                    1 2934 1425 normal       C:\Windows
195c DropboxUpdate.exe               0 0    0
1988 taskhostw.exe                   1 13   14   normal       C:\Windows\System32
1afc ClassicStartMenu.exe            1 4    5    normal       C:\Program Files\Classic Shell
1894 ShellExperienceHost.exe         1 13   91   normal       C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy
1c80 svchost.exe                     0 0    0
1ca8 SearchIndexer.exe               0 0    0
1d60 RuntimeBroker.exe               1 44   101  normal       C:\Windows\System32
1e60 SpeechRuntime.exe               1 9    30   normal       C:\Windows\System32\Speech_OneCore\common
1e88 SkypeHost.exe                   1 4    17   normal       C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.820.0_x64__kzf8qxf38zg5c
1ef4 svchost.exe                     0 0    0
2188 svchost.exe                     0 0    0
27c8 SettingSyncHost.exe             1 39   5    below normal C:\Windows\System32
27d4 tv_w32.exe                      1 0    0
27e0 tv_x64.exe                      1 0    0
2cd8 svchost.exe                     1 4    1    normal       C:\Windows\System32
2890 MSASCuiL.exe                    1 7    6    normal       C:\Program Files\Windows Defender
332c Monitor.exe                     1 16   22   normal       C:\Windows\PixArt\Pac7302
3378 OneDrive.exe                    1 59   41   normal       C:\Users\usuario\AppData\Local\Microsoft\OneDrive
2008 SpotifyWebHelper.exe            1 9    4    normal       C:\Users\usuario\AppData\Roaming\Spotify
3548 Dropbox.exe                     1 66   80   normal       C:\Program Files (x86)\Dropbox\Client
3558 Dropbox.exe                     1 4    4    normal       C:\Program Files (x86)\Dropbox\Client
357c Dropbox.exe                     1 4    1    normal       C:\Program Files (x86)\Dropbox\Client
3754 CSISYN~1.EXE                    1 35   14   normal       C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE16
17bc acrotray.exe                    1 61   39   normal       C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat
2308 BrotherHelp.exe                 1 52   23   normal       C:\Program Files (x86)\Brother\Brother Help
22cc BrCtrlCntr.exe                  1 17   1    normal       C:\Program Files (x86)\ControlCenter4
254c BrCcUxSys.exe                   1 27   10   normal       C:\Program Files (x86)\ControlCenter4
2528 BrYNSvc.exe                     0 0    0
2484 PMBVolumeWatcher.exe            1 36   14   normal       C:\Program Files (x86)\Sony\PlayMemories Home
03fc ducservice.exe                  0 0    0
0f94 svchost.exe                     0 0    0
0464 WUDFHost.exe                    0 0    0
34ac chrome.exe                      1 249  128  normal       C:\Program Files (x86)\Google\Chrome\Application
09e4 chrome.exe                      1 4    4    normal       C:\Program Files (x86)\Google\Chrome\Application
157c chrome.exe                      1 4    4    normal       C:\Program Files (x86)\Google\Chrome\Application
333c chrome.exe                      1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
3388 chrome.exe                      1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
3380 chrome.exe                      1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
01d0 dllhost.exe                     1 4    3    normal       C:\Windows\System32
1e0c svchost.exe                     0 0    0
2974 svchost.exe                     0 0    0
1b74 chrome.exe                      1 18   17   normal       C:\Program Files (x86)\Google\Chrome\Application
16e8 atiesrxx.exe                    0 0    0
0904 atieclxx.exe                    1 0    0
2b20 Steam.exe                       1 648  112  normal       C:\Program Files (x86)\Steam
0c58 steamwebhelper.exe              1 9    17   normal       C:\Program Files (x86)\Steam\bin\cef\cef.win7
2f70 SteamService.exe                0 0    0
0dd8 steamwebhelper.exe              1 0    0    normal       C:\Program Files (x86)\Steam\bin\cef\cef.win7
1f34 Skype.exe                       1 179  129  normal       C:\Program Files (x86)\Skype\Phone
0e00 SkypeBrowserHost.exe            1 53   44   normal       C:\Program Files (x86)\Skype\Browser
2ce0 ApplicationFrameHost.exe        1 153  145  normal       C:\Windows\System32
2e54 WinStore.App.exe                1 4    21   normal       C:\Program Files\WindowsApps\Microsoft.WindowsStore_11706.1001.26.0_x64__8wekyb3d8bbwe
2180 RemindersServer.exe             1 4    1    normal       C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
2328 Video.UI.exe                    1 4    15   normal       C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17062.12911.0_x64__8wekyb3d8bbwe
0348 svchost.exe                     0 0    0
2628 rundll32.exe                    1 4    2    normal       C:\Windows\System32
23ec BrStMonW.exe                    1 351  73   normal       C:\Program Files (x86)\Browny02\Brother
219c Origin.exe                      1 236  256  normal       X:\Archivos de Programa (x86)\Origin
077c OriginWebHelperService.exe      0 0    0
32f4 OriginClientService.exe         0 0    0
25ec QtWebEngineProcess.exe          1 4    1    normal       X:\Archivos de Programa (x86)\Origin
1ecc QtWebEngineProcess.exe          1 4    1    normal       X:\Archivos de Programa (x86)\Origin
138c svchost.exe                     0 0    0
2efc P2PClient.exe                   1 566  1095 normal       C:\Program Files (x86)\HiP2P Client
0798 svchost.exe                     0 0    0
2764 PnkBstrA.exe                    0 0    0
0210 taskhostw.exe                   1 0    0
30c0 svchost.exe                     0 0    0
47b8 WSHelper.exe                    1 65   48   normal       C:\PROGRA~2\COMMON~1\WONDER~1\WONDER~1
0f54 SystemSettings.exe              1 11   40   normal       C:\Windows\ImmersiveControlPanel
2058 chrome.exe                      1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
3b3c chrome.exe                      1 4    1    normal       C:\Program Files (x86)\Google\Chrome\Application
0554 BitTorrent.exe                  1 242  146  normal       C:\Users\usuario\AppData\Roaming\BitTorrent
4b40 bittorrentie.exe                1 25   42   normal       C:\Users\usuario\AppData\Roaming\BitTorrent\updates\7.10.0_43917
1e54 bittorrentie.exe                1 23   43   normal       C:\Users\usuario\AppData\Roaming\BitTorrent\updates\7.10.0_43917
4868 WmiPrvSE.exe                    0 0    0
30fc cmd.exe                         1 0    0    normal       C:\Windows\System32
44c4 conhost.exe                     1 23   21   normal       C:\Windows\System32
19e8 notepad++.exe                   1 262  221  normal       C:\Program Files\Notepad++
3e28 taskhostw.exe                   0 0    0
45e0 SearchUI.exe                    1 23   82   normal       C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
4a04 svchost.exe                     0 0    0
0970 Spotify.exe                     1 52   63   normal       C:\Users\usuario\AppData\Roaming\Spotify
14a4 Spotify.exe                     1 16   5    normal       C:\Users\usuario\AppData\Roaming\Spotify
3880 Spotify.exe                     1 20   9    normal       C:\Users\usuario\AppData\Roaming\Spotify
39ac Spotify.exe                     1 16   5    normal       C:\Users\usuario\AppData\Roaming\Spotify
4144 chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
13d0 chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
334c chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
1d14 chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
1104 chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
1454 chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
2ebc chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
30d8 SnippingTool.exe                1 271  76   normal       C:\Windows\System32
29c0 chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
24c0 Calculator.exe                  1 6    19   normal       C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1706.1862.0_x64__8wekyb3d8bbwe
36f8 Microsoft.Photos.exe            1 18   175  normal       C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.18062.13720.0_x64__8wekyb3d8bbwe
3688 chrome.exe                      1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
44e0 chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
469c chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
41e8 Photoshop.exe                   1 973  2380 normal       C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)
4a7c dynamiclinkmanager.exe          1 4    5    normal       C:\Program Files (x86)\Common Files\Adobe\dynamiclink\CS6
31a0 CS6ServiceManager.exe           1 4    5    normal       C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager
35b0 chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
1db4 svchost.exe                     0 0    0
25d0 chrome.exe                      1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
42a8 svchost.exe                     0 0    0
3448 smartscreen.exe                 1 4    2    normal       C:\Windows\System32
037c backgroundTaskHost.exe          1 4    2    normal       C:\Windows\System32
0484 SearchProtocolHost.exe          0 0    0
26f8 SearchFilterHost.exe            0 0    0
33fc vmark.exe                       1 255  229  normal       C:\Program Files (x86)\Visual Watermark
3770 svchost.exe                     0 0    0
3e54 LocationNotificationWindows.exe 1 10   9    below normal C:\Windows\System32
3e78 wermgr.exe                      0 0    0

hardware:
+ {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
  - Adobe PDF
  - Brother MFC-J480DW Printer
  - Brother PC-FAX v.3.2
  - Cola de impresi?n ra?z
  - Enviar a OneNote 16
  - Fax
  - Microsoft Print to PDF
  - Microsoft XPS Document Writer
+ {36fc9e60-c465-11cf-8056-444553540000}
  - Concentrador ra?z USB
  - Concentrador ra?z USB
  - Controladora de host mejorada USB de la familia Chipset Intel(R) serie 5/serie 3400 - 3B34
  - Controladora de host mejorada USB de la familia Chipset Intel(R) serie 5/serie 3400 - 3B3C
  - Dispositivo compuesto USB
  - Dispositivo compuesto USB
  - Dispositivo de almacenamiento USB
  - Generic USB Hub
  - Generic USB Hub
  - Generic USB Hub
  - Microsoft Mouse and Keyboard Detection Driver (USB)
+ {4d36e965-e325-11ce-bfc1-08002be10318}
  - hp BDDVDRW CH28N
+ {4d36e966-e325-11ce-bfc1-08002be10318}
  - Equipo basado en x64 ACPI
+ {4d36e967-e325-11ce-bfc1-08002be10318}
  - Generic STORAGE DEVICE USB Device
  - Samsung SSD 850 EVO 120GB
  - WDC WD20EZRZ-00Z5HB0
+ {4d36e968-e325-11ce-bfc1-08002be10318}
  - AMD Radeon R7 200 Series (driver 22.19.162.4)
+ {4d36e96a-e325-11ce-bfc1-08002be10318}
  - Controladora SATA AHCI est?ndar
+ {4d36e96b-e325-11ce-bfc1-08002be10318}
  - Teclado PS/2 est?ndar
  - Wireless Keyboard Filter Device
+ {4d36e96c-e325-11ce-bfc1-08002be10318}
  - AMD High Definition Audio Device (driver 10.0.1.0)
  - C-Media USB Headphone Set
  - Dispositivo de audio USB
  - Dispositivo de High Definition Audio
+ {4d36e96e-e325-11ce-bfc1-08002be10318}
  - AOC 2369 (driver 1.0.0.0)
  - Monitor genérico que no es PnP
+ {4d36e96f-e325-11ce-bfc1-08002be10318}
  - Mouse compatible con HID
  - Mouse compatible PS/2
+ {4d36e972-e325-11ce-bfc1-08002be10318}
  - Intel(R) 82578DM Gigabit Network Connection
+ {4d36e978-e325-11ce-bfc1-08002be10318}
  - Puerto de comunicaciones (COM1)
+ {4d36e97b-e325-11ce-bfc1-08002be10318}
  - Controladora de espacios de almacenamiento de Microsoft
+ {4d36e97d-e325-11ce-bfc1-08002be10318}
  - Administrador de vol?menes
  - Altavoz del sistema
  - Bot?n de caracter?stica fija ACPI
  - Bot?n de inicio/apagado ACPI
  - Complejo ra?z PCI Express
  - Controlador BIOS de Microsoft System Management
  - Controlador de pantalla b?sica de Microsoft
  - Controlador de representaci?n b?sica de Microsoft
  - Controladora de acceso directo a memoria
  - Controladora de High Definition Audio
  - Controladora de memoria
  - Controladora LPC
  - Controladora programable avanzada de interrupciones
  - Controladora programable de interrupciones
  - Enumerador de adaptador de red virtual NDIS
  - Enumerador de bus compuesto
  - Enumerador de bus ra?z de UMBus
  - Enumerador de dispositivos de software Plug and Play
  - Enumerador de unidades virtuales de Microsoft
  - High Definition Audio Bus (driver 16.40.0.0)
  - Intel(R) Management Engine Interface (driver 6.0.0.1179)
  - Intel(R) Management Engine Interface (driver 1.0.0.0)
  - Interfaz de administraci?n para ACPI de Microsoft Windows
  - Placa del sistema
  - Procesador de datos numéricos
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Recursos de la placa base
  - Recursos de la placa base
  - Recursos de la placa base
  - Remote Desktop Device Redirector Bus
  - Sistema CMOS/reloj en tiempo real
  - Sistema Microsoft compatible con ACPI
  - Temporizador de eventos de alta precisi?n
  - Temporizador del sistema
  - Wireless Device
+ {50127dc3-0f36-415e-a6cc-4cb3be910b65}
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
+ {62f9c741-b25a-46ce-b54c-9bccce08b6f2}
  - Bus adaptador de transici?n IPv4 IPv6 de Microsoft
  - Microsoft Device Association Root Enumerator
  - Microsoft Radio Device Enumeration Bus
  - SANJUAN1: canales:
  - SANJUAN1: usuario:
  - Sintetizador por software GS de tabla de onda de
+ {6bdd1fc6-810f-11d0-bec7-08002be2092f}
  - Brother MFC-J480DW LAN (driver 1.0.2.3)
  - Eye 312 (driver 1.0.0.14)
+ {745a17a0-74d3-11d0-b6fe-00a0c90f57da}
  - Controlador del sistema compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de entrada USB
  - Dispositivo de entrada USB
  - Dispositivo definido por el proveedor compatible con HID
  - Microsoft Hardware USB Keyboard
  - Microsoft Hardware USB Mouse
+ {c166523c-fe0c-4a94-a586-f1a80cfbbf3e}
  - Altavoces (2- Dispositivo de High Definition Audio)
  - Altavoces (C-Media USB Headphone Set  )
  - Micr?fono (C-Media USB Headphone Set  )
  - Micr?fono (Dispositivo de audio USB)
+ {d94ee5d8-d189-4994-83d2-f68d7d41b0e6}
  - M?dulo de plataforma segura 1.2
+ {eec5ad98-8080-425f-922a-dabf3de3f69a}
  - E:\

stack dump:
0019d348  a0 b7 b1 76 de fa ed 0e - 01 00 00 00 07 00 00 00  ...v............
0019d358  5c d3 19 00 19 d4 5f 00 - 30 53 54 03 80 54 54 03  \....._.0ST..TT.
0019d368  e8 22 55 03 ff ff 54 03 - 90 d3 19 00 78 d3 19 00  ."U...T.....x...
0019d378  94 0f c5 02 80 54 54 03 - 01 d3 19 00 e8 22 55 03  .....TT......"U.
0019d388  0b d3 6d 00 52 00 62 00 - b8 d3 19 00 95 d3 5f 00  ..m.R.b......._.
0019d398  00 00 00 00 ff ff 54 03 - c4 d3 19 00 e7 05 62 00  ......T.......b.
0019d3a8  b8 d3 19 00 80 54 54 03 - 30 ad 65 00 a8 d3 6d 00  .....TT.0.e...m.
0019d3b8  f0 d3 19 00 08 87 43 00 - ff ff 00 00 10 d4 19 00  ......C.........
0019d3c8  c7 ab 69 00 44 d3 6e 00 - c4 d3 19 00 00 00 00 00  ..i.D.n.........
0019d3d8  db ea 61 00 a8 d3 6d 00 - 00 00 00 00 38 d4 19 00  ..a...m.....8...
0019d3e8  00 00 00 00 30 ad 65 00 - f8 d3 19 00 ac 84 43 00  ....0.e.......C.
0019d3f8  3c d4 19 00 24 6a 40 00 - 80 69 43 03 4c d4 19 00  <...$j@..iC.L...
0019d408  80 69 43 03 80 69 43 03 - e0 d5 19 00 c7 ab 69 00  .iC..iC.......i.
0019d418  50 34 6d 00 00 d4 19 00 - 00 00 00 00 38 d4 19 00  P4m.........8...
0019d428  80 69 43 03 00 00 00 00 - 68 d4 19 00 00 00 00 00  .iC.....h.......
0019d438  00 00 00 00 68 d4 19 00 - 4d ad 65 00 80 69 43 03  ....h...M.e..iC.
0019d448  86 e2 65 00 01 d5 65 00 - 80 69 43 03 10 d6 19 00  ..e...e..iC.....
0019d458  49 d5 65 00 e8 cd 40 00 - 10 d6 19 00 80 69 43 03  I.e...@......iC.
0019d468  90 d5 19 00 db 06 67 00 - 94 0f c5 02 10 d6 19 00  ......g.........
0019d478  80 69 43 03 b5 b7 ae 12 - fe ff ff ff c4 d4 19 00  .iC.............

disassembling:
004386cc    public basefilter.cpp.vwm.SaveStyles:  ; function entry point
004386cc 75   push    ebp
004386cd      mov     ebp, esp
004386cf      add     esp, -$2c
004386d2      mov     eax, $6ed344
004386d7      call    +$2624a4 ($69ab80)     ; __InitExceptBlockLDTC
004386d7
004386dc 77   mov     word ptr [ebp-$1c], $14
004386e2      push    $ffff
004386e7      lea     eax, [ebp-8]
004386ea      call    -$368b3 ($401e3c)      ; dstring.h.System.AnsiString.Create
004386ea
004386ef      inc     dword ptr [ebp-$10]
004386f2      call    -$3db ($43831c)        ; basefilter.cpp.vwm.StylesFileName
004386f2
004386f7      lea     ecx, [ebp-8]
004386fa      mov     ecx, [ecx]
004386fc      mov     dl, 1
004386fe      mov     eax, [$5f7b78]
00438703    > call    +$1c4c68 ($5fd370)     ; Classes.TFileStream.Create
00438703
00438708      push    eax
00438709      lea     eax, [ebp-4]
0043870c      push    eax
0043870d      call    -$162 ($4385b0)        ; stl/_auto_ptr.h._STL.auto_ptr
0043870d
00438712      add     esp, 8
00438715      inc     dword ptr [ebp-$10]
00438718      dec     dword ptr [ebp-$10]
0043871b      lea     eax, [ebp-8]
0043871e      mov     edx, 2
00438723      call    +$296810 ($6cef38)     ; System.AnsiString.Destroy
00438723
00438728      mov     word ptr [ebp-$1c], 8
0043872e 78   push    0
00438730      push    0
00438732      lea     ecx, [ebp-4]
00438735      push    ecx
00438736      call    +$3d ($438778)         ; stl/_auto_ptr.h._STL.auto_ptr
00438736
0043873b      pop     ecx
0043873c      call    +$1c4797 ($5fced8)     ; Classes.TStream.SetSize64
0043873c
00438741 79   lea     eax, [ebp-4]
00438744      push    eax
00438745      call    -$fa ($438650)         ; stl/_auto_ptr.h._STL.auto_ptr
00438745
0043874a      pop     ecx
0043874b      mov     edx, eax
0043874d      mov     eax, $739690
00438752      call    +$1455 ($439bac)       ; basefilter.cpp.vwm.TStyles.SaveToStream
00438752
00438757 80   dec     dword ptr [ebp-$10]
0043875a      push    2
0043875c      lea     edx, [ebp-4]
0043875f      push    edx
00438760      call    -$17d ($4385e8)        ; stl/_auto_ptr.h._STL.auto_ptr
00438760
00438765      add     esp, 8
00438768      mov     ecx, [ebp-$2c]
0043876b      mov     fs:[0], ecx
00438772      mov     esp, ebp
00438774      pop     ebp
00438775      ret

date/time         : 2017-08-05, 03:05:38, 190ms
computer name     : DRAGON
user name         : usuario
registered owner  : Usuario de Windows
operating system  : Windows NT New x64 build 9200
system language   : Spanish
system up time    : 3 days
program up time   : 2 minutes 3 seconds
processors        : 4x Intel(R) Core(TM) i5 CPU 650 @ 3.20GHz
physical memory   : 2581/8055 MB (free/total)
free disk space   : (C:) 25.94 GB
display mode      : 1600x1200, 32 bit
process id        : $1950
allocated memory  : 90.35 MB
executable        : vmark.exe
exec. date/time   : 2010-06-21 12:20
compiled with     : BCB6
madExcept version : 3.0k
callstack crc     : $773f1161, $345d5213, $84bdccd8
exception number  : 1
exception class   : EAccessViolation
exception message : Access violation at address 773F1161 in module 'ntdll.dll'. Read of address 00000000.

thread $2f20:
773f1161 +2c1 ntdll.dll
773f0ad2 +212 ntdll.dll              RtlFreeHeap
772be7e5 +015 ucrtbase.dll           _free_base
77409adf +11f ntdll.dll              RtlProcessFlsData
773eda30 +060 ntdll.dll              LdrShutdownThread
005a2429 +00d vmark.exe    madExcept _17188
005a2493 +037 vmark.exe    madExcept _17189
76cb8742 +022 KERNEL32.DLL           BaseThreadInitThunk
>> created by main thread ($1954) at:
74f2c282 +000 combase.dll

main thread ($1954):
006621a6 +0ee vmark.exe    Forms            TApplication.Idle
0066181b +017 vmark.exe    Forms            TApplication.HandleMessage
00661a2e +096 vmark.exe    Forms            TApplication.Run
004023f3 +21f vmark.exe    vmark.cpp 77 +35 WinMain
006a2f24 +14c vmark.exe                     __startup
76cb8742 +022 KERNEL32.DLL                  BaseThreadInitThunk
774273eb +06b ntdll.dll                     bsearch

thread $25c0: <priority:-1>
76882bed +fd KERNELBASE.dll  WaitForMultipleObjectsEx
76882ad3 +13 KERNELBASE.dll  WaitForMultipleObjects
76cb8742 +22 KERNEL32.DLL    BaseThreadInitThunk

thread $1e10:
76cb8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $c28:
76cb8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $340: <priority:2>
005a2429 +0d vmark.exe    madExcept _17188
005a2493 +37 vmark.exe    madExcept _17189
76cb8742 +22 KERNEL32.DLL           BaseThreadInitThunk
>> created by main thread ($1954) at:
727431bb +00 WINMM.DLL

thread $3b14:
76cb8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $8fc:
76cb8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $9a8 (TImageLoaderThread): <suspended> <priority:-1>
768636bd +00d KERNELBASE.dll                     SuspendThread
00602e93 +00b vmark.exe      Classes             TThread.Suspend
00417fd2 +152 vmark.exe      ilthread.cpp 45 +23 TImageLoaderThread.Execute
005a2547 +02b vmark.exe      madExcept           _17190
00602ab4 +034 vmark.exe      Classes             _17119
00620ab8 +028 vmark.exe      System              _16726
005a2429 +00d vmark.exe      madExcept           _17188
005a2493 +037 vmark.exe      madExcept           _17189
76cb8742 +022 KERNEL32.DLL                       BaseThreadInitThunk
>> created by main thread ($1954) at:
00417e0f +033 vmark.exe      ilthread.cpp 15  +1 TImageLoaderThread.Create

modules:
00400000 vmark.exe                                  C:\Program Files (x86)\Visual Watermark
03040000 FREEIMAGE.DLL                              C:\Program Files (x86)\Visual Watermark
10000000 ZLIB1.DLL                                  C:\Program Files (x86)\Visual Watermark
52570000 windowscodecsext.dll   6.2.15063.483       C:\WINDOWS\system32
52b20000 Bcp47Langs.dll         6.2.15063.0         C:\Windows\System32
5a360000 Windows.UI.dll         6.2.15063.483       C:\Windows\System32
67440000 SHFOLDER.DLL           6.2.15063.0         C:\WINDOWS\SYSTEM32
67450000 olepro32.dll           6.2.15063.447       C:\WINDOWS\SYSTEM32
68420000 msxml6.dll             6.30.15063.0        C:\Windows\System32
6c6f0000 thumbcache.dll         6.2.15063.447       C:\Windows\System32
6d230000 CoreUIComponents.dll   6.2.15063.483       C:\WINDOWS\System32
6e4c0000 msxml3.dll             8.110.15063.483     C:\WINDOWS\System32
6ec40000 CoreMessaging.dll      6.2.15063.483       C:\WINDOWS\System32
6f0b0000 usermgrcli.dll         6.2.15063.0         C:\WINDOWS\SYSTEM32
6f0c0000 TextInputFramework.dll 6.2.15063.0         C:\WINDOWS\System32
6f5f0000 oleacc.dll             7.2.15063.447       C:\WINDOWS\SYSTEM32
6f7e0000 MrmCoreR.dll           6.2.15063.0         C:\Windows\System32
6fca0000 msimg32.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
6ff60000 WindowsCodecs.dll      6.2.15063.483       C:\WINDOWS\SYSTEM32
700e0000 iertutil.dll           11.0.15063.483      C:\Windows\System32
70300000 urlmon.dll             11.0.15063.483      C:\WINDOWS\SYSTEM32
70780000 GDIPLUS.DLL            6.2.15063.483       C:\WINDOWS\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.15063.483_none_9e9856e456d5e776
70bf0000 secur32.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
70e10000 uxtheme.dll            6.2.15063.0         C:\WINDOWS\system32
71370000 wintypes.dll           6.2.15063.0         C:\WINDOWS\SYSTEM32
71460000 COMCTL32.DLL           6.10.15063.0        C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8
71950000 dwmapi.dll             6.2.15063.483       C:\WINDOWS\system32
71de0000 propsys.dll            7.0.15063.0         C:\WINDOWS\system32
71f50000 ntmarta.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
72270000 WINMMBASE.dll          6.2.15063.0         C:\WINDOWS\SYSTEM32
72740000 WINMM.DLL              6.2.15063.0         C:\WINDOWS\SYSTEM32
73c00000 WSOCK32.DLL            6.2.15063.0         C:\WINDOWS\SYSTEM32
73c40000 bcrypt.dll             6.2.15063.0         C:\WINDOWS\SYSTEM32
73d30000 VERSION.DLL            6.2.15063.0         C:\WINDOWS\SYSTEM32
73d40000 WINSPOOL.DRV           6.2.15063.138       C:\WINDOWS\SYSTEM32
73e70000 CRYPTBASE.dll          6.2.15063.0         C:\WINDOWS\System32
73e80000 SspiCli.dll            6.2.15063.0         C:\WINDOWS\System32
73ea0000 profapi.dll            6.2.15063.0         C:\WINDOWS\System32
73eb0000 USER32.dll             6.2.15063.0         C:\WINDOWS\System32
74470000 MSCTF.dll              6.2.15063.332       C:\WINDOWS\System32
745c0000 RPCRT4.dll             6.2.15063.447       C:\WINDOWS\System32
74800000 win32u.dll             6.2.15063.0         C:\WINDOWS\System32
74820000 windows.storage.dll    6.2.15063.483       C:\WINDOWS\System32
74e30000 combase.dll            6.2.15063.447       C:\WINDOWS\System32
75080000 WS2_32.dll             6.2.15063.0         C:\WINDOWS\System32
750f0000 cfgmgr32.dll           6.2.15063.0         C:\WINDOWS\System32
75130000 shlwapi.dll            6.2.15063.0         C:\WINDOWS\System32
75180000 gdi32full.dll          6.2.15063.413       C:\WINDOWS\System32
752e0000 sechost.dll            6.2.15063.0         C:\WINDOWS\System32
75330000 ole32.dll              6.2.15063.483       C:\WINDOWS\System32
75430000 SHELL32.dll            6.2.15063.483       C:\WINDOWS\System32
76790000 KERNELBASE.dll         6.2.15063.483       C:\WINDOWS\System32
76960000 clbcatq.dll            2001.12.10941.16384 C:\WINDOWS\System32
769f0000 oleaut32.dll           6.2.15063.332       C:\WINDOWS\System32
76a90000 GDI32.dll              6.2.15063.483       C:\WINDOWS\System32
76ac0000 COMDLG32.DLL           6.2.15063.483       C:\WINDOWS\System32
76ca0000 KERNEL32.DLL           6.2.15063.296       C:\WINDOWS\System32
76d70000 shcore.dll             6.2.15063.0         C:\WINDOWS\System32
76e00000 msvcrt.dll             7.0.15063.0         C:\WINDOWS\System32
77050000 bcryptPrimitives.dll   6.2.15063.138       C:\WINDOWS\System32
770b0000 advapi32.dll           6.2.15063.0         C:\WINDOWS\System32
77130000 IMM32.DLL              6.2.15063.0         C:\WINDOWS\System32
77160000 msvcp_win.dll          6.2.15063.0         C:\WINDOWS\System32
77230000 kernel.appcore.dll     6.2.15063.0         C:\WINDOWS\System32
77240000 powrprof.dll           6.2.15063.0         C:\WINDOWS\System32
77290000 ucrtbase.dll           6.2.15063.447       C:\WINDOWS\System32
773b0000 ntdll.dll              6.2.15063.447       C:\WINDOWS\SYSTEM32

processes:
0000 Idle                       0 0    0
0004 System                     0 0    0
0150 smss.exe                   0 0    0
01b8 csrss.exe                  0 0    0
0248 wininit.exe                0 0    0
0250 csrss.exe                  1 0    0
0298 services.exe               0 0    0
02a0 lsass.exe                  0 0    0
0308 winlogon.exe               1 0    0
0368 svchost.exe                0 0    0
037c svchost.exe                0 0    0
0390 fontdrvhost.exe            1 0    0
0398 fontdrvhost.exe            0 0    0
03fc svchost.exe                0 0    0
0178 svchost.exe                0 0    0
02dc dwm.exe                    1 0    0
0408 svchost.exe                0 0    0
0434 svchost.exe                0 0    0
0468 svchost.exe                0 0    0
0484 svchost.exe                0 0    0
04bc svchost.exe                0 0    0
04d4 WUDFHost.exe               0 0    0
0504 svchost.exe                0 0    0
051c svchost.exe                0 0    0
0528 svchost.exe                0 0    0
0598 svchost.exe                0 0    0
0608 svchost.exe                0 0    0
0610 atiesrxx.exe               0 0    0
0688 svchost.exe                0 0    0
06b0 svchost.exe                0 0    0
06f0 svchost.exe                0 0    0
0734 svchost.exe                0 0    0
0788 svchost.exe                0 0    0
07dc svchost.exe                0 0    0
081c svchost.exe                0 0    0
0824 svchost.exe                0 0    0
082c atieclxx.exe               1 0    0
0874 svchost.exe                0 0    0
0890 svchost.exe                0 0    0
0898 svchost.exe                0 0    0
08f0 svchost.exe                0 0    0
0960 svchost.exe                0 0    0
0968 svchost.exe                0 0    0
0974 svchost.exe                0 0    0
09c4 svchost.exe                0 0    0
0a08 svchost.exe                0 0    0
0a54 spoolsv.exe                0 0    0
0ab8 svchost.exe                0 0    0
0b6c svchost.exe                0 0    0
0bc8 audiodg.exe                0 0    0
0be4 svchost.exe                0 0    0
06f8 armsvc.exe                 0 0    0
079c svchost.exe                0 0    0
06e8 svchost.exe                0 0    0
0888 AGSService.exe             0 0    0
0c08 svchost.exe                0 0    0
0c10 svchost.exe                0 0    0
0c18 dasHost.exe                0 0    0
0c80 svchost.exe                0 0    0
0c90 PMBDeviceInfoProvider.exe  0 0    0
0cac svchost.exe                0 0    0
0cb8 PnkBstrA.exe               0 0    0
0cc0 SecUPDUtilSvc.exe          0 0    0
0cc8 Service_KMS.exe            0 0    0
0cec SecurityHealthService.exe  0 0    0
0d0c svchost.exe                0 0    0
0d30 svchost.exe                0 0    0
0d48 OriginWebHelperService.exe 0 0    0
0d54 TeamViewer_Service.exe     0 0    0
0d64 svchost.exe                0 0    0
0d78 svchost.exe                0 0    0
0d8c svchost.exe                0 0    0
0d9c MsMpEng.exe                0 0    0
0db4 svchost.exe                0 0    0
0f44 Memory Compression         0 0    0
0f64 svchost.exe                0 0    0
0ff4 svchost.exe                0 0    0
11a0 svchost.exe                0 0    0
1260 svchost.exe                0 0    0
1278 svchost.exe                0 0    0
148c NisSrv.exe                 0 0    0
1630 sihost.exe                 1 4    20   normal       C:\Windows\System32
1618 svchost.exe                1 4    1    normal       C:\Windows\System32
1538 svchost.exe                1 4    4    normal       C:\Windows\System32
158c svchost.exe                0 0    0
18a8 TeamViewer.exe             1 172  128  normal       C:\Program Files (x86)\TeamViewer
18e4 explorer.exe               1 1772 887  normal       C:\Windows
1910 DropboxUpdate.exe          0 0    0
1960 taskhostw.exe              1 13   14   normal       C:\Windows\System32
19fc ClassicStartMenu.exe       1 4    5    normal       C:\Program Files\Classic Shell
1b3c SearchIndexer.exe          0 0    0
1b70 ShellExperienceHost.exe    1 13   95   normal       C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy
1ca8 RuntimeBroker.exe          1 56   40   normal       C:\Windows\System32
1cd0 tv_w32.exe                 1 0    0
1cdc tv_x64.exe                 1 0    0
1d34 SpeechRuntime.exe          1 9    26   normal       C:\Windows\System32\Speech_OneCore\common
2610 SettingSyncHost.exe        1 36   5    below normal C:\Windows\System32
275c RadeonSettings.exe         1 42   41   normal       C:\Program Files\AMD\CNext\CNext
09f4 svchost.exe                0 0    0
2784 svchost.exe                0 0    0
28c0 svchost.exe                0 0    0
2ae0 svchost.exe                1 4    2    normal       C:\Windows\System32
28d0 MSASCuiL.exe               1 7    7    normal       C:\Program Files\Windows Defender
2c34 Monitor.exe                1 16   22   normal       C:\Windows\PixArt\Pac7302
2c94 OneDrive.exe               1 59   41   normal       C:\Users\usuario\AppData\Local\Microsoft\OneDrive
2e18 SpotifyWebHelper.exe       1 4    4    normal       C:\Users\usuario\AppData\Roaming\Spotify
2efc Steam.exe                  1 423  90   normal       C:\Program Files (x86)\Steam
2f70 Skype.exe                  1 138  127  normal       C:\Program Files (x86)\Skype\Phone
255c CSISYN~1.EXE               1 35   14   normal       C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE16
25e8 steamwebhelper.exe         1 9    15   normal       C:\Program Files (x86)\Steam\bin\cef\cef.win7
0b00 SteamService.exe           0 0    0
2390 acrotray.exe               1 56   24   normal       C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat
214c BrotherHelp.exe            1 52   23   normal       C:\Program Files (x86)\Brother\Brother Help
18dc BrCtrlCntr.exe             1 27   3    normal       C:\Program Files (x86)\ControlCenter4
1aa0 SkypeHost.exe              1 4    3    normal       C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.820.0_x64__kzf8qxf38zg5c
1e94 BrYNSvc.exe                0 0    0
0628 PMBVolumeWatcher.exe       1 36   14   normal       C:\Program Files (x86)\Sony\PlayMemories Home
0e60 BrCcUxSys.exe              1 27   10   normal       C:\Program Files (x86)\ControlCenter4
3068 WSHelper.exe               1 65   48   normal       C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact
3320 chrome.exe                 1 332  132  normal       C:\Program Files (x86)\Google\Chrome\Application
3358 chrome.exe                 1 4    4    normal       C:\Program Files (x86)\Google\Chrome\Application
3354 chrome.exe                 1 4    4    normal       C:\Program Files (x86)\Google\Chrome\Application
0834 chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
0844 chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
08a0 chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
22b8 ducservice.exe             0 0    0
33c4 svchost.exe                0 0    0
2180 svchost.exe                0 0    0
3248 svchost.exe                0 0    0
1730 dllhost.exe                1 4    3    normal       C:\Windows\System32
1cd8 SnippingTool.exe           1 3099 74   normal       C:\Windows\System32
0128 svchost.exe                0 0    0
3054 ApplicationFrameHost.exe   1 159  146  normal       C:\Windows\System32
1870 Video.UI.exe               1 4    15   normal       C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17062.12911.0_x64__8wekyb3d8bbwe
2e84 SystemSettings.exe         1 11   38   normal       C:\Windows\ImmersiveControlPanel
2ec0 svchost.exe                0 0    0
2478 opera.exe                  1 124  81   normal       C:\Program Files (x86)\Opera\46.0.2597.57
2494 opera_crashreporter.exe    1 4    1    normal       C:\Program Files (x86)\Opera\46.0.2597.57
27f0 opera.exe                  1 13   30   normal       C:\Program Files (x86)\Opera\46.0.2597.57
26b4 opera.exe                  1 0    0    idle         C:\Program Files (x86)\Opera\46.0.2597.57
0a78 opera.exe                  1 0    0    normal       C:\Program Files (x86)\Opera\46.0.2597.57
0654 firefox.exe                1 137  104  normal       C:\Program Files (x86)\Mozilla Firefox
09b4 RemindersServer.exe        1 4    3    normal       C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
1e2c chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
2e8c chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
3414 chrome.exe                 1 4    1    normal       C:\Program Files (x86)\Google\Chrome\Application
23d4 Photoshop.exe              1 1303 2342 normal       C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)
2b84 dynamiclinkmanager.exe     1 4    5    normal       C:\Program Files (x86)\Common Files\Adobe\dynamiclink\CS6
1da4 CS6ServiceManager.exe      1 4    5    normal       C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager
1d00 Bridge.exe                 1 182  88   normal       C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)
35f4 SwitchBoard.exe            1 4    4    normal       C:\Program Files (x86)\Common Files\Adobe\SwitchBoard
29a0 opera.exe                  1 0    0    idle         C:\Program Files (x86)\Opera\46.0.2597.57
3858 SearchUI.exe               1 23   75   normal       C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
39f8 MicrosoftEdge.exe          1 13   49   normal       C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
09d4 browser_broker.exe         1 4    3    normal       C:\Windows\System32
3704 MicrosoftEdgeCP.exe        1 4    20   normal       C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
355c MicrosoftEdgeCP.exe        1 16   101  normal       C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
3a84 InstallAgent.exe           1 4    1    normal       C:\Windows\System32
1908 chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
3724 chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
0e34 opera.exe                  1 0    0    normal       C:\Program Files (x86)\Opera\46.0.2597.57
2c20 opera.exe                  1 0    0    idle         C:\Program Files (x86)\Opera\46.0.2597.57
3550 svchost.exe                0 0    0
29d0 filezilla.exe              1 314  138  normal       X:\Program Files\FileZilla FTP Client
238c P2PClient.exe              1 567  1095 normal       C:\Program Files (x86)\HiP2P Client
1358 chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
0534 chrome.exe                 1 25   21   normal       C:\Program Files (x86)\Google\Chrome\Application
39f4 Spotify.exe                1 81   67   normal       C:\Users\usuario\AppData\Roaming\Spotify
3440 Spotify.exe                1 16   5    normal       C:\Users\usuario\AppData\Roaming\Spotify
36a8 Spotify.exe                1 20   8    normal       C:\Users\usuario\AppData\Roaming\Spotify
1568 Spotify.exe                1 16   5    idle         C:\Users\usuario\AppData\Roaming\Spotify
2500 notepad++.exe              1 275  279  normal       C:\Program Files\Notepad++
22cc WmiPrvSE.exe               0 0    0
3c48 opera.exe                  1 0    0    idle         C:\Program Files (x86)\Opera\46.0.2597.57
121c opera.exe                  1 0    0    idle         C:\Program Files (x86)\Opera\46.0.2597.57
1f14 chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
3740 rundll32.exe               1 4    2    normal       C:\Windows\System32
28ec chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
3970 DbxSvc.exe                 0 0    0
2b6c Dropbox.exe                1 66   77   normal       C:\Program Files (x86)\Dropbox\Client
03f4 Dropbox.exe                1 4    4    normal       C:\Program Files (x86)\Dropbox\Client
2a28 Dropbox.exe                1 4    1    normal       C:\Program Files (x86)\Dropbox\Client
3f04 chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
3d30 SkypeBrowserHost.exe       1 48   42   normal       C:\Program Files (x86)\Skype\Browser
0258 chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
0188 chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
29b8 Calculator.exe             1 6    99   normal       C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1706.1862.0_x64__8wekyb3d8bbwe
0934 chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
0e04 svchost.exe                0 0    0
187c chrome.exe                 1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
1f7c chrome.exe                 1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
2f30 SearchProtocolHost.exe     0 0    0
042c SearchFilterHost.exe       0 0    0
1950 vmark.exe                  1 251  228  normal       C:\Program Files (x86)\Visual Watermark
3bf0 backgroundTaskHost.exe     1 4    5    normal       C:\Windows\System32

hardware:
+ {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
  - Adobe PDF
  - Brother MFC-J480DW Printer
  - Brother PC-FAX v.3.2
  - Cola de impresi?n ra?z
  - Enviar a OneNote 16
  - Fax
  - Microsoft Print to PDF
  - Microsoft XPS Document Writer
+ {36fc9e60-c465-11cf-8056-444553540000}
  - Concentrador ra?z USB
  - Concentrador ra?z USB
  - Controladora de host mejorada USB de la familia Chipset Intel(R) serie 5/serie 3400 - 3B34
  - Controladora de host mejorada USB de la familia Chipset Intel(R) serie 5/serie 3400 - 3B3C
  - Dispositivo compuesto USB
  - Dispositivo compuesto USB
  - Generic USB Hub
  - Generic USB Hub
  - Microsoft Mouse and Keyboard Detection Driver (USB)
+ {4d36e965-e325-11ce-bfc1-08002be10318}
  - hp BDDVDRW CH28N
+ {4d36e966-e325-11ce-bfc1-08002be10318}
  - Equipo basado en x64 ACPI
+ {4d36e967-e325-11ce-bfc1-08002be10318}
  - Samsung SSD 850 EVO 120GB
  - WDC WD20EZRZ-00Z5HB0
+ {4d36e968-e325-11ce-bfc1-08002be10318}
  - AMD Radeon R7 200 Series (driver 22.19.162.4)
+ {4d36e96a-e325-11ce-bfc1-08002be10318}
  - Controladora SATA AHCI est?ndar
+ {4d36e96b-e325-11ce-bfc1-08002be10318}
  - Teclado PS/2 est?ndar
  - Wireless Keyboard Filter Device
+ {4d36e96c-e325-11ce-bfc1-08002be10318}
  - AMD High Definition Audio Device (driver 10.0.1.0)
  - C-Media USB Headphone Set
  - Dispositivo de audio USB
  - Dispositivo de High Definition Audio
+ {4d36e96e-e325-11ce-bfc1-08002be10318}
  - AOC 2369 (driver 1.0.0.0)
  - Monitor genérico que no es PnP
+ {4d36e96f-e325-11ce-bfc1-08002be10318}
  - Mouse compatible con HID
  - Mouse compatible PS/2
+ {4d36e972-e325-11ce-bfc1-08002be10318}
  - Intel(R) 82578DM Gigabit Network Connection
+ {4d36e978-e325-11ce-bfc1-08002be10318}
  - Puerto de comunicaciones (COM1)
+ {4d36e97b-e325-11ce-bfc1-08002be10318}
  - Controladora de espacios de almacenamiento de Microsoft
+ {4d36e97d-e325-11ce-bfc1-08002be10318}
  - Administrador de vol?menes
  - Altavoz del sistema
  - Bot?n de caracter?stica fija ACPI
  - Bot?n de inicio/apagado ACPI
  - Complejo ra?z PCI Express
  - Controlador BIOS de Microsoft System Management
  - Controlador de pantalla b?sica de Microsoft
  - Controlador de representaci?n b?sica de Microsoft
  - Controladora de acceso directo a memoria
  - Controladora de High Definition Audio
  - Controladora de memoria
  - Controladora LPC
  - Controladora programable avanzada de interrupciones
  - Controladora programable de interrupciones
  - Enumerador de adaptador de red virtual NDIS
  - Enumerador de bus compuesto
  - Enumerador de bus ra?z de UMBus
  - Enumerador de dispositivos de software Plug and Play
  - Enumerador de unidades virtuales de Microsoft
  - High Definition Audio Bus (driver 16.40.0.0)
  - Intel(R) Management Engine Interface (driver 6.0.0.1179)
  - Intel(R) Management Engine Interface (driver 1.0.0.0)
  - Interfaz de administraci?n para ACPI de Microsoft Windows
  - Placa del sistema
  - Procesador de datos numéricos
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Recursos de la placa base
  - Recursos de la placa base
  - Recursos de la placa base
  - Remote Desktop Device Redirector Bus
  - Sistema CMOS/reloj en tiempo real
  - Sistema Microsoft compatible con ACPI
  - Temporizador de eventos de alta precisi?n
  - Temporizador del sistema
  - Wireless Device
+ {50127dc3-0f36-415e-a6cc-4cb3be910b65}
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
+ {62f9c741-b25a-46ce-b54c-9bccce08b6f2}
  - Bus adaptador de transici?n IPv4 IPv6 de Microsoft
  - Microsoft Device Association Root Enumerator
  - Microsoft Radio Device Enumeration Bus
  - SANJUAN1: canales:
  - SANJUAN1: usuario:
  - Sintetizador por software GS de tabla de onda de
+ {6bdd1fc6-810f-11d0-bec7-08002be2092f}
  - Brother MFC-J480DW LAN (driver 1.0.2.3)
  - Eye 312 (driver 1.0.0.14)
+ {745a17a0-74d3-11d0-b6fe-00a0c90f57da}
  - Controlador del sistema compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de entrada USB
  - Dispositivo de entrada USB
  - Dispositivo definido por el proveedor compatible con HID
  - Microsoft Hardware USB Keyboard
  - Microsoft Hardware USB Mouse
+ {c166523c-fe0c-4a94-a586-f1a80cfbbf3e}
  - Altavoces (2- Dispositivo de High Definition Audio)
  - Altavoces (C-Media USB Headphone Set  )
  - Micr?fono (C-Media USB Headphone Set  )
  - Micr?fono (Dispositivo de audio USB)
+ {d94ee5d8-d189-4994-83d2-f68d7d41b0e6}
  - M?dulo de plataforma segura 1.2

stack dump:
04fdfa60  e6 1d d0 37 90 9a c3 00 - 00 00 c0 00 00 00 00 00  ...7............
04fdfa70  48 11 92 76 00 00 00 00 - 00 00 00 00 e0 3c b3 02  H..v.........<..
04fdfa80  00 00 b3 02 60 1d f4 02 - d8 fb fd 04 b3 8f 40 77  ....`.........@w
04fdfa90  60 1d f4 02 00 00 b3 02 - 3d 00 00 3d ca 15 3f 77  `.......=..=..?w
04fdfaa0  26 1a d0 37 f8 77 3d 03 - 00 00 3d 03 00 00 04 03  &..7.w=...=.....
04fdfab0  52 ec 3d 77 01 00 00 00 - ff 07 00 00 50 20 00 00  R.=w........P...
04fdfac0  60 1d f4 02 00 00 b3 02 - 00 00 00 00 00 00 00 00  `...............
04fdfad0  6c d3 5c 10 13 00 00 00 - 00 00 b3 02 00 00 00 00  l.\.............
04fdfae0  00 00 c0 00 da 00 00 00 - 31 00 00 31 7f 07 00 00  ........1..1....
04fdfaf0  50 20 00 00 90 9a c3 00 - 50 20 00 00 00 00 f4 02  P.......P.......
04fdfb00  50 fb fd 00 50 fb fd 04 - 9d e6 3d 77 00 00 00 00  P...P.....=w....
04fdfb10  44 00 01 45 68 21 f4 02 - 01 00 00 00 00 00 00 00  D..Eh!..........
04fdfb20  00 00 00 00 44 00 00 00 - 60 1d f4 02 00 00 00 00  ....D...`.......
04fdfb30  1c a2 c0 00 01 00 00 00 - 44 00 00 00 00 00 00 00  ........D.......
04fdfb40  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
04fdfb50  c0 fc fd 04 27 19 3f 77 - 01 00 00 00 ca 15 3f 77  ....'.?w......?w
04fdfb60  00 00 00 00 60 1d 00 01 - 00 00 b3 02 6c 1d f4 02  ....`.......l...
04fdfb70  6c a5 c3 00 01 00 00 00 - 00 00 00 00 00 00 d3 02  l...............
04fdfb80  88 96 c3 00 02 00 00 00 - da 00 00 00 f9 56 40 77  .............V@w
04fdfb90  00 00 00 01 44 00 00 00 - 10 00 00 01 60 a1 c3 00  ....D.......`...

disassembling:
[...]
773f10dd   mov     ecx, [edi+$50]
773f10e0   xor     ecx, eax
773f10e2   mov     [ebp-$f0], ecx
773f10e8   mov     al, [ebp-$ee]
773f10ee   xor     al, [ebp-$ef]
773f10f4   xor     al, cl
773f10f6   shr     ecx, $18
773f10f9   cmp     cl, al
773f10fb   jnz     loc_774452ab
773f10fb
773f1101   mov     edx, [ebp-$38]
773f10fb
773f1104 loc_773f1104:
773f1104   mov     byte ptr [ebp-$5a], 1
773f1108   jmp     loc_773f1110
773f1108
773f1108 ; ---------------------------------------------------------
773f1108
773f1110 loc_773f1110:
773f1110   mov     eax, [edi+$4c]
773f1113   shr     eax, $14
773f1116   movzx   ecx, al
773f1119   movzx   eax, byte ptr [edi+$52]
773f111d   and     ecx, eax
773f111f   movzx   eax, byte ptr [esi+2]
773f1123   xor     ecx, eax
773f1125   and     ecx, 1
773f1128   jnz     loc_773f12db
773f1128
773f112e   cmp     [edi+$4c], ecx
773f1131   jz      loc_773f1149
773f1131
773f1133   mov     eax, [edi+$50]
773f1136   xor     [esi], eax
773f1138   mov     al, [esi+1]
773f113b   xor     al, [esi]
773f113d   xor     al, [esi+2]
773f1140   cmp     [esi+3], al
773f1143   jnz     loc_774452ca
773f1143
773f1149 loc_773f1149:
773f1149   cmp     byte ptr [ebp-$44], 0
773f114d   jnz     loc_774452d9
773f114d
773f1153 loc_773f1153:
773f1153   lea     ecx, [esi+8]
773f1156   mov     edx, [ecx]
773f1158   mov     [ebp-$50], edx
773f115b   mov     eax, [esi+$c]
773f115e   mov     [ebp-$1c], eax
773f1161 > mov     eax, [eax]
773f1163   mov     edx, [edx+4]
773f1166   cmp     eax, edx
773f1168   jnz     loc_77445683
773f1168
773f116e   cmp     eax, ecx
773f1170   jnz     loc_77445683
773f1170
773f1176   movzx   eax, word ptr [esi]
773f1179   sub     [edi+$74], eax
773f117c   mov     ecx, [edi+$b4]
773f1182   mov     [ebp-$34], ecx
773f1185   test    ecx, ecx
773f1187   jz      loc_773f1292
773f1187
773f118d   movzx   edx, word ptr [esi]
773f1187
773f1190 loc_773f1190:
773f1190   cmp     edx, [ecx+4]
773f1193   jnb     loc_773f160c
773f1193
773f1199 loc_773f1199:
773f1199   mov     [ebp-$84], edx
773f119f   movzx   eax, word ptr [esi]
773f11a2   mov     [ebp-$4c], eax
773f11a5   mov     eax, edx
773f11a7   sub     eax, [ecx+$14]
773f11aa   mov     [ebp-$2c], eax
773f11ad   cmp     dword ptr [ecx+8], 0
773f11b1   jnz     loc_7744558f
773f11b1
773f11b7 loc_773f11b7:
773f11b7   shl     eax, 2
773f11ba   mov     [ebp-$20], eax
773f11bd   mov     eax, [ecx+$20]
773f11c0   add     eax, [ebp-$20]
773f11c3   mov     [ebp-$3c], eax
773f11c6   mov     eax, [eax]
773f11c8   mov     [ebp-$54], eax
773f11cb   dec     dword ptr [ecx+$c]
773f11ce   mov     eax, [ecx+4]
773f11d1   mov     [ebp-$6c], eax
773f11d4   dec     eax
773f11d5   cmp     edx, eax
773f11d7   mov     esi, [ebp-$24]
773f11da   jz      loc_773f1996
773f11da
773f11e0 loc_773f11e0:
773f11e0   lea     eax, [esi+8]
773f11e3   cmp     [ebp-$54], eax
773f11e6   jnz     loc_773f1292
773f11e6
[...]

date/time         : 2017-10-08, 16:51:12, 361ms
computer name     : DRAGON
user name         : usuario
registered owner  : Usuario de Windows
operating system  : Windows NT New x64 build 9200
system language   : Spanish
system up time    : 2 hours 49 minutes
program up time   : 2 minutes 2 seconds
processors        : 4x Intel(R) Core(TM) i5 CPU 650 @ 3.20GHz
physical memory   : 2421/8055 MB (free/total)
free disk space   : (C:) 27.72 GB
display mode      : 1920x1080, 32 bit
process id        : $1478
allocated memory  : 94.52 MB
executable        : vmark.exe
exec. date/time   : 2010-06-21 12:20
compiled with     : BCB6
madExcept version : 3.0k
callstack crc     : $772f1161, $af3c8bab, $da8b8da2
exception number  : 1
exception class   : EAccessViolation
exception message : Access violation at address 772F1161 in module 'ntdll.dll'. Read of address 00000000.

thread $ea4:
772f1161 +2c1 ntdll.dll
772f0ad2 +212 ntdll.dll              RtlFreeHeap
746be7e5 +015 ucrtbase.dll           _free_base
77309adf +11f ntdll.dll              RtlProcessFlsData
772eda30 +060 ntdll.dll              LdrShutdownThread
005a2429 +00d vmark.exe    madExcept _17188
005a2493 +037 vmark.exe    madExcept _17189
745d8742 +022 KERNEL32.DLL           BaseThreadInitThunk
>> created by main thread ($3238) at:
76e5c282 +000 combase.dll

main thread ($3238):
006621a6 +0ee vmark.exe    Forms            TApplication.Idle
0066181b +017 vmark.exe    Forms            TApplication.HandleMessage
00661a2e +096 vmark.exe    Forms            TApplication.Run
004023f3 +21f vmark.exe    vmark.cpp 77 +35 WinMain
006a2f24 +14c vmark.exe                     __startup
745d8742 +022 KERNEL32.DLL                  BaseThreadInitThunk
773273eb +06b ntdll.dll                     bsearch

thread $20e0: <priority:-1>
741f2c1d +fd KERNELBASE.dll  WaitForMultipleObjectsEx
741f2b03 +13 KERNELBASE.dll  WaitForMultipleObjects
745d8742 +22 KERNEL32.DLL    BaseThreadInitThunk

thread $d2c:
745d8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $c70:
745d8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $28f8:
745d8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $2200: <priority:2>
005a2429 +0d vmark.exe    madExcept _17188
005a2493 +37 vmark.exe    madExcept _17189
745d8742 +22 KERNEL32.DLL           BaseThreadInitThunk
>> created by main thread ($3238) at:
6df531bb +00 WINMM.DLL

thread $26e4:
745d8742 +22 KERNEL32.DLL  BaseThreadInitThunk

thread $2a54 (TImageLoaderThread): <suspended> <priority:-1>
741d36ed +00d KERNELBASE.dll                     SuspendThread
00602e93 +00b vmark.exe      Classes             TThread.Suspend
00417fd2 +152 vmark.exe      ilthread.cpp 45 +23 TImageLoaderThread.Execute
005a2547 +02b vmark.exe      madExcept           _17190
00602ab4 +034 vmark.exe      Classes             _17119
00620ab8 +028 vmark.exe      System              _16726
005a2429 +00d vmark.exe      madExcept           _17188
005a2493 +037 vmark.exe      madExcept           _17189
745d8742 +022 KERNEL32.DLL                       BaseThreadInitThunk
>> created by main thread ($3238) at:
00417e0f +033 vmark.exe      ilthread.cpp 15  +1 TImageLoaderThread.Create

modules:
00400000 vmark.exe                                  C:\Program Files (x86)\Visual Watermark
02f30000 FREEIMAGE.DLL                              C:\Program Files (x86)\Visual Watermark
0f2e0000 Bcp47Langs.dll         6.2.15063.0         C:\Windows\System32
10000000 ZLIB1.DLL                                  C:\Program Files (x86)\Visual Watermark
52570000 windowscodecsext.dll   6.2.15063.483       C:\WINDOWS\system32
58470000 Windows.UI.dll         6.2.15063.502       C:\Windows\System32
60a70000 TextInputFramework.dll 6.2.15063.502       C:\Windows\System32
67ce0000 CoreMessaging.dll      6.2.15063.608       C:\Windows\System32
67d70000 CoreUIComponents.dll   6.2.15063.608       C:\Windows\System32
689b0000 MrmCoreR.dll           6.2.15063.0         C:\Windows\System32
68a90000 olepro32.dll           6.2.15063.608       C:\WINDOWS\SYSTEM32
68ab0000 SHFOLDER.DLL           6.2.15063.0         C:\WINDOWS\SYSTEM32
6afd0000 oleacc.dll             7.2.15063.447       C:\WINDOWS\SYSTEM32
6c2a0000 msxml6.dll             6.30.15063.0        C:\Windows\System32
6c740000 msxml3.dll             8.110.15063.483     C:\WINDOWS\System32
6ce10000 usermgrcli.dll         6.2.15063.0         C:\WINDOWS\SYSTEM32
6cf70000 wintypes.dll           6.2.15063.0         C:\WINDOWS\SYSTEM32
6d850000 uxtheme.dll            6.2.15063.0         C:\WINDOWS\system32
6d8d0000 COMCTL32.DLL           6.10.15063.0        C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8
6dbb0000 WindowsCodecs.dll      6.2.15063.483       C:\WINDOWS\SYSTEM32
6dd30000 urlmon.dll             11.0.15063.608      C:\WINDOWS\SYSTEM32
6df20000 WINMMBASE.dll          6.2.15063.0         C:\WINDOWS\SYSTEM32
6df50000 WINMM.DLL              6.2.15063.0         C:\WINDOWS\SYSTEM32
6e210000 GDIPLUS.DLL            6.2.15063.608       C:\WINDOWS\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.15063.608_none_9e9d5d4256d15def
6e390000 dwmapi.dll             6.2.15063.483       C:\WINDOWS\system32
6ee20000 aswhookx.dll           17.7.3.15075        C:\Program Files\AVAST Software\Avast
6f030000 msimg32.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
70b80000 propsys.dll            7.0.15063.0         C:\WINDOWS\system32
70f10000 ntmarta.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
71230000 secur32.dll            6.2.15063.0         C:\WINDOWS\SYSTEM32
71460000 WINSPOOL.DRV           6.2.15063.608       C:\WINDOWS\SYSTEM32
71ad0000 iertutil.dll           11.0.15063.608      C:\Windows\System32
72f90000 bcrypt.dll             6.2.15063.0         C:\WINDOWS\SYSTEM32
73670000 VERSION.DLL            6.2.15063.0         C:\WINDOWS\SYSTEM32
73a70000 WSOCK32.DLL            6.2.15063.0         C:\WINDOWS\SYSTEM32
73d70000 CRYPTBASE.dll          6.2.15063.0         C:\WINDOWS\System32
73d80000 SspiCli.dll            6.2.15063.0         C:\WINDOWS\System32
73f20000 sechost.dll            6.2.15063.0         C:\WINDOWS\System32
74000000 ole32.dll              6.2.15063.502       C:\WINDOWS\System32
74100000 KERNELBASE.dll         6.2.15063.608       C:\WINDOWS\System32
742e0000 msvcp_win.dll          6.2.15063.0         C:\WINDOWS\System32
74460000 profapi.dll            6.2.15063.0         C:\WINDOWS\System32
74470000 cfgmgr32.dll           6.2.15063.0         C:\WINDOWS\System32
74500000 RPCRT4.dll             6.2.15063.447       C:\WINDOWS\System32
745c0000 KERNEL32.DLL           6.2.15063.296       C:\WINDOWS\System32
74690000 ucrtbase.dll           6.2.15063.447       C:\WINDOWS\System32
747b0000 clbcatq.dll            2001.12.10941.16384 C:\WINDOWS\System32
74840000 shcore.dll             6.2.15063.608       C:\WINDOWS\System32
74cf0000 advapi32.dll           6.2.15063.0         C:\WINDOWS\System32
74d70000 MSCTF.dll              6.2.15063.332       C:\WINDOWS\System32
74ec0000 SHELL32.dll            6.2.15063.608       C:\WINDOWS\System32
76280000 gdi32full.dll          6.2.15063.608       C:\WINDOWS\System32
763e0000 kernel.appcore.dll     6.2.15063.0         C:\WINDOWS\System32
763f0000 COMDLG32.DLL           6.2.15063.502       C:\WINDOWS\System32
764e0000 msvcrt.dll             7.0.15063.0         C:\WINDOWS\System32
765a0000 shlwapi.dll            6.2.15063.502       C:\WINDOWS\System32
765f0000 WS2_32.dll             6.2.15063.0         C:\WINDOWS\System32
767d0000 windows.storage.dll    6.2.15063.608       C:\WINDOWS\System32
76d60000 combase.dll            6.2.15063.608       C:\WINDOWS\System32
76fa0000 GDI32.dll              6.2.15063.483       C:\WINDOWS\System32
76fd0000 win32u.dll             6.2.15063.608       C:\WINDOWS\System32
76ff0000 powrprof.dll           6.2.15063.0         C:\WINDOWS\System32
77040000 IMM32.DLL              6.2.15063.0         C:\WINDOWS\System32
77070000 oleaut32.dll           6.2.15063.332       C:\WINDOWS\System32
77110000 bcryptPrimitives.dll   6.2.15063.138       C:\WINDOWS\System32
77170000 USER32.dll             6.2.15063.608       C:\WINDOWS\System32
772b0000 ntdll.dll              6.2.15063.608       C:\WINDOWS\SYSTEM32
77490000 thumbcache.dll         6.2.15063.447       C:\Windows\System32

processes:
0000 Idle                      0 0    0
0004 System                    0 0    0
0180 smss.exe                  0 0    0
01e0 csrss.exe                 0 0    0
0270 wininit.exe               0 0    0
0278 csrss.exe                 1 0    0
02b4 services.exe              0 0    0
02bc lsass.exe                 0 0    0
032c svchost.exe               0 0    0
034c svchost.exe               0 0    0
0354 fontdrvhost.exe           0 0    0
0390 winlogon.exe              1 0    0
03c0 fontdrvhost.exe           1 0    0
03f4 svchost.exe               0 0    0
013c svchost.exe               0 0    0
01cc dwm.exe                   1 0    0
01d8 svchost.exe               0 0    0
0408 svchost.exe               0 0    0
0444 svchost.exe               0 0    0
0470 svchost.exe               0 0    0
0480 svchost.exe               0 0    0
0488 svchost.exe               0 0    0
049c svchost.exe               0 0    0
04a8 WUDFHost.exe              0 0    0
0540 svchost.exe               0 0    0
0548 svchost.exe               0 0    0
0564 svchost.exe               0 0    0
05bc svchost.exe               0 0    0
060c atiesrxx.exe              0 0    0
062c svchost.exe               0 0    0
0678 svchost.exe               0 0    0
069c svchost.exe               0 0    0
06f8 svchost.exe               0 0    0
0750 svchost.exe               0 0    0
07b8 svchost.exe               0 0    0
07c0 atieclxx.exe              1 0    0
07c8 svchost.exe               0 0    0
07fc svchost.exe               0 0    0
050c svchost.exe               0 0    0
05ac svchost.exe               0 0    0
0700 svchost.exe               0 0    0
0848 svchost.exe               0 0    0
088c svchost.exe               0 0    0
0894 svchost.exe               0 0    0
08e0 svchost.exe               0 0    0
0968 AvastSvc.exe              0 0    0
0970 svchost.exe               0 0    0
0978 svchost.exe               0 0    0
09dc svchost.exe               0 0    0
09f0 audiodg.exe               0 0    0
0a3c dasHost.exe               0 0    0
0a5c svchost.exe               0 0    0
0ad4 spoolsv.exe               0 0    0
0b08 svchost.exe               0 0    0
0b88 armsvc.exe                0 0    0
0b94 DbxSvc.exe                0 0    0
0b9c svchost.exe               0 0    0
0ba4 AGSService.exe            0 0    0
0bb0 svchost.exe               0 0    0
0bb8 svchost.exe               0 0    0
0bc0 svchost.exe               0 0    0
0bd0 svchost.exe               0 0    0
0bd8 svchost.exe               0 0    0
0bf4 PMBDeviceInfoProvider.exe 0 0    0
0850 SecUPDUtilSvc.exe         0 0    0
07e0 SecurityHealthService.exe 0 0    0
08ec Service_KMS.exe           0 0    0
0c20 svchost.exe               0 0    0
0c2c svchost.exe               0 0    0
0c44 TeamViewer_Service.exe    0 0    0
0c50 svchost.exe               0 0    0
0c5c svchost.exe               0 0    0
0c68 svchost.exe               0 0    0
0c80 svchost.exe               0 0    0
0d84 svchost.exe               0 0    0
0e08 Memory Compression        0 0    0
0e18 svchost.exe               0 0    0
0fd0 WmiPrvSE.exe              0 0    0
1030 svchost.exe               0 0    0
103c svchost.exe               0 0    0
12e0 aswidsagenta.exe          0 0    0
1314 svchost.exe               0 0    0
13cc svchost.exe               0 0    0
17e4 sihost.exe                1 4    21   normal       C:\Windows\System32
17ec svchost.exe               1 4    1    normal       C:\Windows\System32
0904 svchost.exe               1 4    7    normal       C:\Windows\System32
148c svchost.exe               0 0    0
0df4 TeamViewer.exe            1 171  129  normal       C:\Program Files (x86)\TeamViewer
1778 explorer.exe              1 2386 1102 normal       C:\Windows
1858 DropboxUpdate.exe         0 0    0
1874 taskhostw.exe             1 13   14   normal       C:\Windows\System32
18e0 ClassicStartMenu.exe      1 4    5    normal       C:\Program Files\Classic Shell
1a48 tv_w32.exe                1 0    0
1a50 tv_x64.exe                1 0    0
1aa8 ShellExperienceHost.exe   1 6    67   normal       C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy
1b5c SearchIndexer.exe         0 0    0
19ac RuntimeBroker.exe         1 53   79   normal       C:\Windows\System32
1cb8 SpeechRuntime.exe         1 4    24   normal       C:\Windows\System32\Speech_OneCore\common
1ce0 SkypeHost.exe             1 4    9    normal       C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.4.711.0_x64__kzf8qxf38zg5c
1e10 svchost.exe               0 0    0
1e40 svchost.exe               0 0    0
2618 RadeonSettings.exe        1 42   42   normal       C:\Program Files\AMD\CNext\CNext
2698 svchost.exe               0 0    0
27f0 RemindersServer.exe       1 4    2    normal       C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
10fc svchost.exe               0 0    0
2928 svchost.exe               0 0    0
29c0 svchost.exe               1 4    2    normal       C:\Windows\System32
2a44 dllhost.exe               1 4    3    normal       C:\Windows\System32
2aa4 MSASCuiL.exe              1 7    6    normal       C:\Program Files\Windows Defender
2c98 AvastUI.exe               1 143  81   normal       C:\Program Files\AVAST Software\Avast
2ce4 Spotify.exe               1 52   64   normal       C:\Users\usuario\AppData\Roaming\Spotify
2ec8 Spotify.exe               1 4    4    normal       C:\Users\usuario\AppData\Roaming\Spotify
2f80 Steam.exe                 1 419  87   normal       C:\Program Files (x86)\Steam
0360 Spotify.exe               1 8    5    normal       C:\Users\usuario\AppData\Roaming\Spotify
2b14 SpotifyWebHelper.exe      1 4    4    normal       C:\Users\usuario\AppData\Roaming\Spotify
300c Spotify.exe               1 0    0    normal       C:\Users\usuario\AppData\Roaming\Spotify
32b4 steamwebhelper.exe        1 9    14   normal       C:\Program Files (x86)\Steam\bin\cef\cef.win7
32e0 steamwebhelper.exe        1 4    4    normal       C:\Program Files (x86)\Steam\bin\cef\cef.win7
330c SteamService.exe          0 0    0
33e0 SpotifyWebHelper.exe      1 4    4    normal       C:\Users\usuario\AppData\Roaming\Spotify
31f4 Dropbox.exe               1 63   60   normal       C:\Program Files (x86)\Dropbox\Client
3200 Dropbox.exe               1 4    4    normal       C:\Program Files (x86)\Dropbox\Client
3230 Dropbox.exe               1 4    1    normal       C:\Program Files (x86)\Dropbox\Client
320c acrotray.exe              1 53   13   normal       C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat
31cc BrotherHelp.exe           1 52   23   normal       C:\Program Files (x86)\Brother\Brother Help
1d08 BrCtrlCntr.exe            1 17   1    normal       C:\Program Files (x86)\ControlCenter4
079c BrStMonW.exe              1 109  74   normal       C:\Program Files (x86)\Browny02\Brother
2afc BrYNSvc.exe               0 0    0
3418 PMBVolumeWatcher.exe      1 36   14   normal       C:\Program Files (x86)\Sony\PlayMemories Home
3488 BrCcUxSys.exe             1 27   10   normal       C:\Program Files (x86)\ControlCenter4
2410 chrome.exe                1 173  107  normal       C:\Program Files (x86)\Google\Chrome\Application
2504 chrome.exe                1 4    4    normal       C:\Program Files (x86)\Google\Chrome\Application
3124 chrome.exe                1 4    4    normal       C:\Program Files (x86)\Google\Chrome\Application
3588 chrome.exe                1 21   16   normal       C:\Program Files (x86)\Google\Chrome\Application
2ff8 chrome.exe                1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
3114 chrome.exe                1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
331c chrome.exe                1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
2d30 chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
3064 chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
3a64 chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
3a40 chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
2600 chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
201c svchost.exe               0 0    0
2240 svchost.exe               0 0    0
2008 Photoshop.exe             1 1217 2357 normal       C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)
1c48 dynamiclinkmanager.exe    1 4    5    normal       C:\Program Files (x86)\Common Files\Adobe\dynamiclink\CS6
28d0 CS6ServiceManager.exe     1 4    5    normal       C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager
306c SettingSyncHost.exe       1 4    5    below normal C:\Windows\System32
0d54 svchost.exe               0 0    0
3bdc chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
1e64 chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
3668 chrome.exe                1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
2cc8 chrome.exe                1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
0fd8 ApplicationFrameHost.exe  1 113  111  normal       C:\Windows\System32
1d44 WinStore.App.exe          1 9    21   normal       C:\Program Files\WindowsApps\Microsoft.WindowsStore_11708.1001.30.0_x64__8wekyb3d8bbwe
3b78 Calculator.exe            1 6    39   normal       C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1706.2271.0_x64__8wekyb3d8bbwe
2300 SearchUI.exe              1 23   74   normal       C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
1b74 chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
2478 svchost.exe               0 0    0
17bc chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
02f8 chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
1bb4 SystemSettingsBroker.exe  1 4    1    above normal C:\Windows\System32
09c8 rundll32.exe              1 4    2    normal       C:\Windows\System32
0d30 EXCEL.EXE                 1 314  127  normal       C:\Program Files\Microsoft Office\Office16
2de8 chrome.exe                1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
2968 chrome.exe                1 4    1    normal       C:\Program Files (x86)\Google\Chrome\Application
38a4 SnippingTool.exe          1 212  54   normal       C:\Windows\System32
2768 WUDFHost.exe              0 0    0
3984 svchost.exe               0 0    0
1444 Video.UI.exe              1 4    17   normal       C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17082.14121.0_x64__8wekyb3d8bbwe
382c Microsoft.Photos.exe      1 18   155  normal       C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe
1068 CamtasiaStudio.exe        1 588  482  normal       C:\Program Files (x86)\TechSmith\Camtasia Studio_8
0960 TscHelp.exe               1 9    4    normal       C:\Program Files (x86)\TechSmith\Camtasia Studio_8
09cc svchost.exe               0 0    0
1adc chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
3a08 chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
2434 chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
1734 chrome.exe                1 0    0    idle         C:\Program Files (x86)\Google\Chrome\Application
137c chrome.exe                1 0    0    normal       C:\Program Files (x86)\Google\Chrome\Application
0124 svchost.exe               0 0    0
18a0 svchost.exe               0 0    0
1478 vmark.exe                 1 252  225  normal       C:\Program Files (x86)\Visual Watermark

hardware:
+ {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
  - Adobe PDF
  - Brother MFC-J480DW Printer
  - Brother PC-FAX v.3.2
  - Cola de impresi?n ra?z
  - Enviar a OneNote 16
  - Fax
  - Microsoft Print to PDF
  - Microsoft XPS Document Writer
+ {36fc9e60-c465-11cf-8056-444553540000}
  - Concentrador ra?z USB
  - Concentrador ra?z USB
  - Controladora de host mejorada USB de la familia Chipset Intel(R) serie 5/serie 3400 - 3B34
  - Controladora de host mejorada USB de la familia Chipset Intel(R) serie 5/serie 3400 - 3B3C
  - Dispositivo compuesto USB
  - Dispositivo compuesto USB
  - Dispositivo compuesto USB
  - Dispositivo de almacenamiento USB
  - Generic USB Hub
  - Generic USB Hub
  - Generic USB Hub
  - Microsoft Mouse and Keyboard Detection Driver (USB)
+ {4d36e965-e325-11ce-bfc1-08002be10318}
  - hp BDDVDRW CH28N
+ {4d36e966-e325-11ce-bfc1-08002be10318}
  - Equipo basado en x64 ACPI
+ {4d36e967-e325-11ce-bfc1-08002be10318}
  - Generic STORAGE DEVICE USB Device
  - Samsung SSD 850 EVO 120GB
  - WDC WD20EZRZ-00Z5HB0
+ {4d36e968-e325-11ce-bfc1-08002be10318}
  - AMD Radeon R7 200 Series (driver 22.19.162.4)
+ {4d36e96a-e325-11ce-bfc1-08002be10318}
  - Controladora SATA AHCI est?ndar
+ {4d36e96b-e325-11ce-bfc1-08002be10318}
  - Teclado PS/2 est?ndar
  - Wireless Keyboard Filter Device
+ {4d36e96c-e325-11ce-bfc1-08002be10318}
  - AMD High Definition Audio Device (driver 10.0.1.0)
  - Dispositivo de High Definition Audio
  - HD Pro Webcam C920 (driver 13.80.853.0)
  - MicrosoftŽ LifeCam Studio(TM)
  - USB PnP Sound Device
+ {4d36e96e-e325-11ce-bfc1-08002be10318}
  - AOC 2369 (driver 1.0.0.0)
  - AOC 2369 (driver 1.0.0.0)
+ {4d36e96f-e325-11ce-bfc1-08002be10318}
  - Mouse compatible con HID
  - Mouse compatible PS/2
+ {4d36e972-e325-11ce-bfc1-08002be10318}
  - Intel(R) 82578DM Gigabit Network Connection
+ {4d36e978-e325-11ce-bfc1-08002be10318}
  - Puerto de comunicaciones (COM1)
+ {4d36e97b-e325-11ce-bfc1-08002be10318}
  - Controladora de espacios de almacenamiento de Microsoft
+ {4d36e97d-e325-11ce-bfc1-08002be10318}
  - Administrador de vol?menes
  - Altavoz del sistema
  - Bot?n de caracter?stica fija ACPI
  - Bot?n de inicio/apagado ACPI
  - Complejo ra?z PCI Express
  - Controlador BIOS de Microsoft System Management
  - Controlador de pantalla b?sica de Microsoft
  - Controlador de representaci?n b?sica de Microsoft
  - Controladora de acceso directo a memoria
  - Controladora de High Definition Audio
  - Controladora de memoria
  - Controladora LPC
  - Controladora programable avanzada de interrupciones
  - Controladora programable de interrupciones
  - Enumerador de adaptador de red virtual NDIS
  - Enumerador de bus compuesto
  - Enumerador de bus ra?z de UMBus
  - Enumerador de dispositivos de software Plug and Play
  - Enumerador de unidades virtuales de Microsoft
  - High Definition Audio Bus (driver 16.40.0.0)
  - Intel(R) Management Engine Interface (driver 6.0.0.1179)
  - Intel(R) Management Engine Interface (driver 1.0.0.0)
  - Interfaz de administraci?n para ACPI de Microsoft Windows
  - Placa del sistema
  - Procesador de datos numéricos
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Puente PCI a PCI
  - Recursos de la placa base
  - Recursos de la placa base
  - Recursos de la placa base
  - Remote Desktop Device Redirector Bus
  - Sistema CMOS/reloj en tiempo real
  - Sistema Microsoft compatible con ACPI
  - Temporizador de eventos de alta precisi?n
  - Temporizador del sistema
  - Wireless Device
+ {50127dc3-0f36-415e-a6cc-4cb3be910b65}
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
  - Intel(R) Core(TM) i5 CPU         650  @ 3.20GHz
+ {62f9c741-b25a-46ce-b54c-9bccce08b6f2}
  - Bus adaptador de transici?n IPv4 IPv6 de Microsoft
  - Microsoft Device Association Root Enumerator
  - Microsoft Radio Device Enumeration Bus
  - SANJUAN1: canales:
  - SANJUAN1: usuario:
  - Sintetizador por software GS de tabla de onda de
+ {6bdd1fc6-810f-11d0-bec7-08002be2092f}
  - Brother MFC-J480DW LAN (driver 1.0.2.3)
  - Logitech HD Pro Webcam C920 (driver 13.80.853.0)
  - Microsoft LifeCam Studio
+ {745a17a0-74d3-11d0-b6fe-00a0c90f57da}
  - Controlador del sistema compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de control del consumidor compatible con HID
  - Dispositivo de entrada USB
  - Dispositivo de entrada USB
  - Dispositivo de entrada USB
  - Dispositivo definido por el proveedor compatible con HID
  - Microsoft Hardware USB Keyboard
  - Microsoft Hardware USB Mouse
  - Teléfono compatible con HID
+ {c166523c-fe0c-4a94-a586-f1a80cfbbf3e}
  - Altavoces (2- Dispositivo de High Definition Audio)
  - Altavoces (USB PnP Sound Device)
  - Micr?fono (HD Pro Webcam C920)
  - Micr?fono (USB PnP Sound Device)
  - Micr?fono de escritorio (4- MicrosoftŽ LifeCam Studio(TM))
+ {d94ee5d8-d189-4994-83d2-f68d7d41b0e6}
  - M?dulo de plataforma segura 1.2
+ {eec5ad98-8080-425f-922a-dabf3de3f69a}
  - E:\

stack dump:
04d8fa60  08 27 4e 0e 20 b3 bb 00 - 00 00 b8 00 00 00 00 00  .'N.............
04d8fa70  48 11 29 74 00 00 00 00 - 00 00 00 00 e0 3c b4 02  H.)t.........<..
04d8fa80  00 00 b4 02 60 1d d3 02 - d8 fb d8 04 b3 8f 30 77  ....`.........0w
04d8fa90  60 1d d3 02 00 00 b4 02 - 3d 00 00 3d ca 15 2f 77  `.......=..=../w
04d8faa0  c8 20 4e 0e f8 77 1e 03 - 00 00 1e 03 00 00 f3 02  ..N..w..........
04d8fab0  52 ec 2d 77 01 00 00 00 - ff 07 00 00 50 20 00 00  R.-w........P...
04d8fac0  60 1d d3 02 00 00 b4 02 - 00 00 00 00 00 00 00 00  `...............
04d8fad0  08 67 da 2f 13 00 00 00 - 00 00 b4 02 00 00 00 00  .g./............
04d8fae0  00 00 b8 00 da 00 00 00 - 31 00 00 31 7f 07 00 00  ........1..1....
04d8faf0  50 20 00 00 20 b3 bb 00 - 50 20 00 00 00 00 d3 02  P.......P.......
04d8fb00  50 fb d8 00 50 fb d8 04 - 9d e6 2d 77 00 00 00 00  P...P.....-w....
04d8fb10  44 00 01 45 68 21 d3 02 - 01 00 00 00 00 00 00 00  D..Eh!..........
04d8fb20  00 00 00 00 44 00 00 00 - 60 1d d3 02 00 00 00 00  ....D...`.......
04d8fb30  a4 98 b8 00 01 00 00 00 - 44 00 00 00 00 00 00 00  ........D.......
04d8fb40  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
04d8fb50  c0 fc d8 04 27 19 2f 77 - 01 00 00 00 ca 15 2f 77  ....'./w....../w
04d8fb60  00 00 00 00 60 1d 00 01 - 00 00 b4 02 6c 1d d3 02  ....`.......l...
04d8fb70  fc bd bb 00 01 00 00 00 - 00 00 00 00 00 00 d2 02  ................
04d8fb80  10 b1 bb 00 02 00 00 00 - da 00 00 00 f9 56 30 77  .............V0w
04d8fb90  00 00 00 01 44 00 00 00 - 10 00 00 01 f0 b9 bb 00  ....D...........

disassembling:
[...]
772f10dd   mov     ecx, [edi+$50]
772f10e0   xor     ecx, eax
772f10e2   mov     [ebp-$f0], ecx
772f10e8   mov     al, [ebp-$ee]
772f10ee   xor     al, [ebp-$ef]
772f10f4   xor     al, cl
772f10f6   shr     ecx, $18
772f10f9   cmp     cl, al
772f10fb   jnz     loc_773452be
772f10fb
772f1101   mov     edx, [ebp-$38]
772f10fb
772f1104 loc_772f1104:
772f1104   mov     byte ptr [ebp-$5a], 1
772f1108   jmp     loc_772f1110
772f1108
772f1108 ; ---------------------------------------------------------
772f1108
772f1110 loc_772f1110:
772f1110   mov     eax, [edi+$4c]
772f1113   shr     eax, $14
772f1116   movzx   ecx, al
772f1119   movzx   eax, byte ptr [edi+$52]
772f111d   and     ecx, eax
772f111f   movzx   eax, byte ptr [esi+2]
772f1123   xor     ecx, eax
772f1125   and     ecx, 1
772f1128   jnz     loc_772f12db
772f1128
772f112e   cmp     [edi+$4c], ecx
772f1131   jz      loc_772f1149
772f1131
772f1133   mov     eax, [edi+$50]
772f1136   xor     [esi], eax
772f1138   mov     al, [esi+1]
772f113b   xor     al, [esi]
772f113d   xor     al, [esi+2]
772f1140   cmp     [esi+3], al
772f1143   jnz     loc_773452dd
772f1143
772f1149 loc_772f1149:
772f1149   cmp     byte ptr [ebp-$44], 0
772f114d   jnz     loc_773452ec
772f114d
772f1153 loc_772f1153:
772f1153   lea     ecx, [esi+8]
772f1156   mov     edx, [ecx]
772f1158   mov     [ebp-$50], edx
772f115b   mov     eax, [esi+$c]
772f115e   mov     [ebp-$1c], eax
772f1161 > mov     eax, [eax]
772f1163   mov     edx, [edx+4]
772f1166   cmp     eax, edx
772f1168   jnz     loc_77345696
772f1168
772f116e   cmp     eax, ecx
772f1170   jnz     loc_77345696
772f1170
772f1176   movzx   eax, word ptr [esi]
772f1179   sub     [edi+$74], eax
772f117c   mov     ecx, [edi+$b4]
772f1182   mov     [ebp-$34], ecx
772f1185   test    ecx, ecx
772f1187   jz      loc_772f1292
772f1187
772f118d   movzx   edx, word ptr [esi]
772f1187
772f1190 loc_772f1190:
772f1190   cmp     edx, [ecx+4]
772f1193   jnb     loc_772f160c
772f1193
772f1199 loc_772f1199:
772f1199   mov     [ebp-$84], edx
772f119f   movzx   eax, word ptr [esi]
772f11a2   mov     [ebp-$4c], eax
772f11a5   mov     eax, edx
772f11a7   sub     eax, [ecx+$14]
772f11aa   mov     [ebp-$2c], eax
772f11ad   cmp     dword ptr [ecx+8], 0
772f11b1   jnz     loc_773455a2
772f11b1
772f11b7 loc_772f11b7:
772f11b7   shl     eax, 2
772f11ba   mov     [ebp-$20], eax
772f11bd   mov     eax, [ecx+$20]
772f11c0   add     eax, [ebp-$20]
772f11c3   mov     [ebp-$3c], eax
772f11c6   mov     eax, [eax]
772f11c8   mov     [ebp-$54], eax
772f11cb   dec     dword ptr [ecx+$c]
772f11ce   mov     eax, [ecx+4]
772f11d1   mov     [ebp-$6c], eax
772f11d4   dec     eax
772f11d5   cmp     edx, eax
772f11d7   mov     esi, [ebp-$24]
772f11da   jz      loc_772f1996
772f11da
772f11e0 loc_772f11e0:
772f11e0   lea     eax, [esi+8]
772f11e3   cmp     [ebp-$54], eax
772f11e6   jnz     loc_772f1292
772f11e6
[...]

