https://bugs.winehq.org/show_bug.cgi?id=47266
--- Comment #1 from exposight exposight@gmail.com --- Last thing it does is ntdll.NtReadFile before entering the exception loop:
002d:Call ntdll.LdrRegisterDllNotification(00000000,140238d10,00000000,09e2cf18) ret=1400cc5ba 002d:Ret ntdll.LdrRegisterDllNotification() retval=00000000 ret=1400cc5ba 002d:Call ntdll.NtCreateFile(09e2c7f8,00120089,09e2c978,09e2c968,00000000,00000000,00000001,00000001,00000020,00000000,00000000) ret=1400d321d 002d:trace:ntdll:FILE_CreateFile handle=0x9e2c7f8 access=00120089 name=L"\??\C:\windows\system32\ntdll.dll" objattr=00000040 root=(nil) sec=(nil) io=0x9e2c968 alloc_size=(nil) attr=00000000 sharing=00000001 disp=1 options=00000020 ea=(nil).0x00000000 002d:Ret ntdll.NtCreateFile() retval=00000000 ret=1400d321d 002d:Call ntdll.NtQueryInformationFile(000000fc,09e2c9c0,09e2c9a8,00000018,00000005) ret=1400d38e1 002d:trace:ntdll:NtQueryInformationFile (0xfc,0x9e2c9c0,0x9e2c9a8,0x00000018,0x00000005) 002d:Ret ntdll.NtQueryInformationFile() retval=00000000 ret=1400d38e1 002d:Call ntdll.NtAllocateVirtualMemory(ffffffffffffffff,09e2c7f0,00000000,09e2c920,00001000,00000040) ret=1400d3ed6 002d:Ret ntdll.NtAllocateVirtualMemory() retval=00000000 ret=1400d3ed6 002d:Call ntdll.NtReadFile(000000fc,00000000,00000000,00000000,09e2c968,09e30000,00001000,00000000,00000000) ret=1400d430a 002d:trace:ntdll:NtReadFile (0xfc,(nil),(nil),(nil),0x9e2c968,0x9e30000,0x00001000,(nil),(nil)) 002d:trace:ntdll:NtReadFile = SUCCESS (2476) 002d:Ret ntdll.NtReadFile() retval=00000000 ret=1400d430a 002d:trace:seh:NtRaiseException code=c0000005 flags=0 addr=(nil) ip=0 tid=002d