0028:trace:shell:SHELL32_GetItemAttributes 0x40000000
0028:trace:shell:HCR_GetFolderAttributes (pidlFolder=0x7bc6ec58, pdwAttributes=0x7b964c8c)
0028:Call ole32.StringFromCLSID(7bc6ec5c,7b964bcc) ret=7b82c9e8
0028:Call kernel32.MultiByteToWideChar(00000000,00000000,7b964a90 "{4B876A40-4EE8-11D1-811E-00C04FB98EEC}",ffffffff,00000000,00000000) ret=7b751772
0028:Ret  kernel32.MultiByteToWideChar() retval=00000027 ret=7b751772
0028:Call ntdll.RtlAllocateHeap(7bbf0000,00000000,0000004e) ret=7b7628c3
0028:Ret  ntdll.RtlAllocateHeap() retval=7bc974b8 ret=7b7628c3
0028:Call kernel32.MultiByteToWideChar(00000000,00000000,7b964a90 "{4B876A40-4EE8-11D1-811E-00C04FB98EEC}",ffffffff,7bc974b8,00000027) ret=7b751797
0028:Ret  kernel32.MultiByteToWideChar() retval=00000027 ret=7b751797
0028:Ret  ole32.StringFromCLSID() retval=00000000 ret=7b82c9e8
0028:Call ole32.CoTaskMemFree(7bc974b8) ret=7b82ca17
0028:Call ntdll.RtlFreeHeap(7bbf0000,00000000,7bc974b8) ret=7b762c00
0028:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b762c00
0028:Ret  ole32.CoTaskMemFree() retval=00000000 ret=7b82ca17
0028:Call advapi32.RegOpenKeyExW(80000000,7b964bd0 L"CLSID\\{4B876A40-4EE8-11D1-811E-00C04FB98EEC}\\ShellFolder",00000000,00020019,7b964bc8) ret=7b82c8d0
0028:Call ntdll.RtlInitUnicodeString(7b964aa8,7b964bd0 L"CLSID\\{4B876A40-4EE8-11D1-811E-00C04FB98EEC}\\ShellFolder") ret=7b700d9e
0028:Ret  ntdll.RtlInitUnicodeString() retval=00000072 ret=7b700d9e
0028:Call ntdll.NtOpenKey(7b964bc8,00020019,7b964ab0) ret=7b700db2
0028:Ret  ntdll.NtOpenKey() retval=c0000034 ret=7b700db2
0028:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b700dba
0028:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b700dba
0028:Ret  advapi32.RegOpenKeyExW() retval=00000002 ret=7b82c8d0
0028:trace:shell:SHGetPathFromIDListW (pidl=0x7bc6ec58,0x7befeeee)
0028:trace:shell:SHBindToParent pidl=0x7bc6ec58
0028:trace:shell:SHGetDesktopFolder 
0028:trace:shell:ISF_Desktop_Constructor unkOut=(nil) 
	{000214e6-0000-0000-c000-000000000046} (IID_IShellFolder)
0028:trace:shell:SHGetFolderPathW (nil),0x7b964890,nFolder=0x8010
0028:trace:shell:_SHGetUserProfilePath (nil),0x00000000,0x10,0x7b964400
0028:trace:shell:_SHGetUserShellFolderPath 0x80000001,(null),L"Desktop",0x7b964400
0028:Call advapi32.RegCreateKeyExW(80000001,7b879400 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",00000000,00000000,00000000,000f003f,00000000,7b964038,7b96403c) ret=7b84b9a4
0028:Call ntdll.RtlInitUnicodeString(7b963ee8,7b879400 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders") ret=7b700ac3
0028:Ret  ntdll.RtlInitUnicodeString() retval=00000082 ret=7b700ac3
0028:Call ntdll.RtlInitUnicodeString(7b963ee0,00000000) ret=7b700ad0
0028:Ret  ntdll.RtlInitUnicodeString() retval=00000002 ret=7b700ad0
0028:Call ntdll.NtCreateKey(7b964038,000f003f,7b963ef0,00000000,7b963ee0,00000000,7b96403c) ret=7b700aec
0028:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b700aec
0028:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b700af4
0028:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b700af4
0028:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7b84b9a4
0028:Call advapi32.RegCreateKeyExW(80000001,7b8794a0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",00000000,00000000,00000000,000f003f,00000000,7b964034,7b96403c) ret=7b84b9d4
0028:Call ntdll.RtlInitUnicodeString(7b963ee8,7b8794a0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") ret=7b700ac3
0028:Ret  ntdll.RtlInitUnicodeString() retval=0000008c ret=7b700ac3
0028:Call ntdll.RtlInitUnicodeString(7b963ee0,00000000) ret=7b700ad0
0028:Ret  ntdll.RtlInitUnicodeString() retval=00000002 ret=7b700ad0
0028:Call ntdll.NtCreateKey(7b964034,000f003f,7b963ef0,00000000,7b963ee0,00000000,7b96403c) ret=7b700aec
0028:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b700aec
0028:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b700af4
0028:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b700af4
0028:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7b84b9d4
0028:Call advapi32.RegQueryValueExW(00000068,7b8793a0 L"Desktop",00000000,7b96402c,7b964400,7b964030) ret=7b84ba06
0028:Call ntdll.RtlInitUnicodeString(7b963e28,7b8793a0 L"Desktop") ret=7b702a6a
0028:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7b702a6a
0028:Call ntdll.NtQueryValueKey(00000068,7b963e28,00000002,7b963e30,00000100,7b963e24) ret=7b702abe
0028:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7b702abe
0028:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b702b31
0028:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b702b31
0028:Ret  advapi32.RegQueryValueExW() retval=00000000 ret=7b84ba06
0028:Call advapi32.RegSetValueExW(00000064,7b8793a0 L"Desktop",00000000,00000001,7b964400,00000022) ret=7b84ba7e
0028:Call ntdll.RtlInitUnicodeString(7b963f30,7b8793a0 L"Desktop") ret=7b701f69
0028:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7b701f69
0028:Call ntdll.NtSetValueKey(00000064,7b963f30,00000000,00000001,7b964400,00000022) ret=7b701f81
0028:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b701f81
0028:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b701f8a
0028:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b701f8a
0028:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7b84ba7e
0028:Call advapi32.RegCloseKey(00000064) ret=7b84ba9f
0028:Call ntdll.NtClose(00000064) ret=7b701cb9
0028:Ret  ntdll.NtClose() retval=00000000 ret=7b701cb9
0028:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b701cbf
0028:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b701cbf
0028:Ret  advapi32.RegCloseKey() retval=00000000 ret=7b84ba9f
0028:Call advapi32.RegCloseKey(00000068) ret=7b84baab
0028:Call ntdll.NtClose(00000068) ret=7b701cb9
0028:Ret  ntdll.NtClose() retval=00000000 ret=7b701cb9
0028:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b701cbf
0028:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b701cbf
0028:Ret  advapi32.RegCloseKey() retval=00000000 ret=7b84baab
0028:trace:shell:_SHGetUserShellFolderPath returning 0x00000000
0028:trace:shell:_SHGetUserProfilePath returning 0x00000000 (output path is L"d:\\win98\\desktop")
0028:Call shlwapi.PathFileExistsW(7b964610 L"d:\\win98\\desktop") ret=7b84c217
0028:trace:shell:PathFileExistsW (L"d:\\win98\\desktop")
0028:Call kernel32.SetErrorMode(00000001) ret=7b7da151
0028:Ret  kernel32.SetErrorMode() retval=00000000 ret=7b7da151
0028:Call kernel32.GetFileAttributesW(7b964610 L"d:\\win98\\desktop") ret=7b7da159
0028:Call ntdll.RtlDosPathNameToNtPathName_U(7b964610 L"d:\\win98\\desktop",7b9641e8,00000000,00000000) ret=7bb35e6f
0028:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7bb35e6f
0028:Call ntdll.NtQueryAttributesFile(7b9641f0,7b964210) ret=7bb35ead
0028:Ret  ntdll.NtQueryAttributesFile() retval=00000000 ret=7bb35ead
0028:Call ntdll.RtlFreeUnicodeString(7b9641e8) ret=7bb35eb6
0028:Ret  ntdll.RtlFreeUnicodeString() retval=00000001 ret=7bb35eb6
0028:Ret  kernel32.GetFileAttributesW() retval=00000010 ret=7b7da159
0028:Call kernel32.SetErrorMode(00000000) ret=7b7da161
0028:Ret  kernel32.SetErrorMode() retval=00000001 ret=7b7da161
0028:Ret  shlwapi.PathFileExistsW() retval=00000001 ret=7b84c217
0028:trace:shell:SHGetFolderPathW returning 0x00000000 (final path is L"d:\\win98\\desktop")
0028:Call kernel32.LocalAlloc(00000040,0000001c) ret=7b850af9
0028:Call ntdll.RtlAllocateHeap(7bbf0000,00000008,0000001c) ret=7bb3be04
0028:Ret  ntdll.RtlAllocateHeap() retval=7bc974b8 ret=7bb3be04
0028:Ret  kernel32.LocalAlloc() retval=7bc974b8 ret=7b850af9
0028:Call ntdll.RtlAllocateHeap(7bbf0000,00000000,00000002) ret=7b7628c3
0028:Ret  ntdll.RtlAllocateHeap() retval=7bc974e0 ret=7b7628c3
0028:trace:shell:SHAlloc 2 bytes at 0x7bc974e0
0028:Call ntdll.RtlAllocateHeap(7bbf0000,00000000,00000022) ret=7b7628c3
0028:Ret  ntdll.RtlAllocateHeap() retval=7bc974f8 ret=7b7628c3
0028:trace:shell:SHAlloc 34 bytes at 0x7bc974f8
0028:trace:shell:ISF_Desktop_fnQueryInterface (0x7bc974b8)->(
	{000214e6-0000-0000-c000-000000000046} (IID_IShellFolder),0x7b964b08)
0028:trace:shell:ISF_Desktop_fnAddRef (0x7bc974b8)->(count=0)
0028:trace:shell:ISF_Desktop_fnQueryInterface -- Interface: (0x7b964b08)->(0x7bc974b8)
0028:trace:shell:ISF_Desktop_Constructor --(0x7bc974b8)
0028:trace:shell:SHGetDesktopFolder -- 0x7b964b08->(0x7bc974b8)
0028:trace:shell:ISF_Desktop_fnQueryInterface (0x7bc974b8)->(
	{000214e6-0000-0000-c000-000000000046} (IID_IShellFolder),0x7b964b38)
0028:trace:shell:ISF_Desktop_fnAddRef (0x7bc974b8)->(count=1)
0028:trace:shell:ISF_Desktop_fnQueryInterface -- Interface: (0x7b964b38)->(0x7bc974b8)
0028:trace:shell:ISF_Desktop_fnRelease (0x7bc974b8)->(count=2)
0028:trace:shell:SHBindToParent -- psf=0x7bc974b8 pidl=0x7bc6ec58 ret=0x00000000
0028:trace:shell:ISF_Desktop_fnGetAttributesOf (0x7bc974b8)->(cidl=1 apidl=0x7b964b3c mask=0x7b964b34 (0x40000000))
0028:trace:shell:SHELL32_GetItemAttributes 0x40000000
0028:trace:shell:HCR_GetFolderAttributes (pidlFolder=0x7bc6ec58, pdwAttributes=0x7b9647ac)
0028:Call ole32.StringFromCLSID(7bc6ec5c,7b9646ec) ret=7b82c9e8