I think I have found the solution.
The crash is due to the wrong permission settings of the file "user32.dll" under "c:\windows\system32\" after the patch is applied.
You can still apply the patch to remove the watermark. Then you need to correct the permission of the file.
Go to "user32.dll", right click and select "Properties", under "Security" tab, correct the following permission settings.
System - only "read and execute" and "read"
Administrators - only "read and execute" and "read"
Users - only "read and execute" and "read"
TrustedInstaller - "Full Control"
File Owner - TrustedInstaller
Reminders: to add "TrustedInstaller", you need to type "NT Service\TrustedInstaller" without the quote.