Tainted code in User32?