HtmlHelp() call doesn't drop system privileges.
vulners.com/securityvulns/securityvulns:doc:5288
vulners.com/securityvulns/securityvulns:doc:5626