CmpWString(LPVOID item, LPVOID str)
{
    return (wcscmp(item, str) == 0) ? TRUE : FALSE;
}

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.