按键精灵 2014.01.14314版
Environment = 1366x768|32|Windows 7 Ultimate
Type = 0xC0000005
Address = 0x52F4FB
LineNum = -1(-1)

Registers:
EAX=05726F40 EBX=0029DE48 ECX=05712540 EDX=00000000
ESI=05712540 EDI=0029DE48 ESP=0018FE64 EBP=0018FE70

Current Modules:
==>
Name = 多段宏按键BY幽明.exe, Base = 0x400000, Top = 0x13E8000, Size = 16678912
Name = ntdll.dll, Base = 0x772F0000, Top = 0x77470000, Size = 1572864
Name = kernel32.dll, Base = 0x75370000, Top = 0x75480000, Size = 1114112
Name = KERNELBASE.dll, Base = 0x758A0000, Top = 0x758E7000, Size = 290816
Name = comctl32.dll, Base = 0x73560000, Top = 0x736FE000, Size = 1695744
Name = msvcrt.dll, Base = 0x765B0000, Top = 0x7665C000, Size = 704512
Name = GDI32.dll, Base = 0x76060000, Top = 0x760F0000, Size = 589824
Name = USER32.dll, Base = 0x75560000, Top = 0x75660000, Size = 1048576
Name = ADVAPI32.dll, Base = 0x762B0000, Top = 0x76350000, Size = 655360
Name = sechost.dll, Base = 0x75FE0000, Top = 0x75FF9000, Size = 102400
Name = RPCRT4.dll, Base = 0x75D40000, Top = 0x75E30000, Size = 983040
Name = SspiCli.dll, Base = 0x74520000, Top = 0x74580000, Size = 393216
Name = CRYPTBASE.dll, Base = 0x74510000, Top = 0x7451C000, Size = 49152
Name = LPK.dll, Base = 0x75360000, Top = 0x7536A000, Size = 40960
Name = USP10.dll, Base = 0x75AF0000, Top = 0x75B8D000, Size = 643072
Name = SHLWAPI.dll, Base = 0x74580000, Top = 0x745D7000, Size = 356352
Name = IMM32.DLL, Base = 0x76000000, Top = 0x76060000, Size = 393216
Name = MSCTF.dll, Base = 0x75480000, Top = 0x7554C000, Size = 835584
Name = nvinit.dll, Base = 0x72EF0000, Top = 0x72F25000, Size = 217088
Name = winmm.dll, Base = 0x75AB0000, Top = 0x75AE2000, Size = 204800
Name = MSIMG32.dll, Base = 0x705E0000, Top = 0x705E5000, Size = 20480
Name = COMDLG32.dll, Base = 0x74610000, Top = 0x7468B000, Size = 503808
Name = SHELL32.dll, Base = 0x74710000, Top = 0x7535B000, Size = 12890112
Name = WINSPOOL.DRV, Base = 0x6E9D0000, Top = 0x6EA21000, Size = 331776
Name = ole32.dll, Base = 0x75E80000, Top = 0x75FDC000, Size = 1425408
Name = OLEAUT32.dll, Base = 0x75CB0000, Top = 0x75D3F000, Size = 585728
Name = oledlg.dll, Base = 0x721A0000, Top = 0x721BC000, Size = 114688
Name = urlmon.dll, Base = 0x75780000, Top = 0x7589A000, Size = 1155072
Name = iertutil.dll, Base = 0x760F0000, Top = 0x762AB000, Size = 1814528
Name = WININET.dll, Base = 0x75980000, Top = 0x75A9B000, Size = 1159168
Name = Normaliz.dll, Base = 0x76660000, Top = 0x76663000, Size = 12288
Name = gdiplus.dll, Base = 0x73160000, Top = 0x732F0000, Size = 1638400
Name = DINPUT8.dll, Base = 0x72170000, Top = 0x721A0000, Size = 196608
Name = WS2_32.dll, Base = 0x76870000, Top = 0x768A5000, Size = 217088
Name = NSI.dll, Base = 0x75550000, Top = 0x75556000, Size = 24576
Name = dbghelp.dll, Base = 0x72630000, Top = 0x7271B000, Size = 962560
Name = Syntconv.dll, Base = 0x10000000, Top = 0x10053000, Size = 339968
Name = MFC42.DLL, Base = 0x704C0000, Top = 0x705DC000, Size = 1163264
Name = ODBC32.dll, Base = 0x720E0000, Top = 0x7216C000, Size = 573440
Name = MSVCP60.dll, Base = 0x70450000, Top = 0x704B6000, Size = 417792
Name = odbcint.dll, Base = 0x720A0000, Top = 0x720D8000, Size = 229376
Name = refs.dll, Base = 0x702B0000, Top = 0x70446000, Size = 1662976
Name = OLEACC.dll, Base = 0x70610000, Top = 0x7064C000, Size = 245760
Name = UxTheme.dll, Base = 0x6F7B0000, Top = 0x6F830000, Size = 524288
Name = dwmapi.dll, Base = 0x74690000, Top = 0x746A3000, Size = 77824
Name = profapi.dll, Base = 0x73E50000, Top = 0x73E5B000, Size = 45056
Name = apphelp.dll, Base = 0x70720000, Top = 0x7076C000, Size = 311296
Name = SOGOUPY.IME, Base = 0x6180000, Top = 0x6661000, Size = 5115904
Name = ntmarta.dll, Base = 0x6F950000, Top = 0x6F971000, Size = 135168
Name = WLDAP32.dll, Base = 0x75E30000, Top = 0x75E75000, Size = 282624
Name = VERSION.dll, Base = 0x73E90000, Top = 0x73E99000, Size = 36864
Name = CRYPTSP.dll, Base = 0x70700000, Top = 0x70716000, Size = 90112
Name = PicFace.dll, Base = 0x6ED10000, Top = 0x6EE9B000, Size = 1617920
Name = rsaenh.dll, Base = 0x706C0000, Top = 0x706FB000, Size = 241664
Name = asycfilt.dll, Base = 0x72080000, Top = 0x72094000, Size = 81920
Name = Secur32.dll, Base = 0x739D0000, Top = 0x739D8000, Size = 32768
Name = Resource.dll, Base = 0x9DE0000, Top = 0x9EBD000, Size = 905216
Name = PSAPI.DLL, Base = 0x756F0000, Top = 0x756F5000, Size = 20480
Name = dnsapi.DLL, Base = 0x73880000, Top = 0x738C4000, Size = 278528
Name = iphlpapi.DLL, Base = 0x73C50000, Top = 0x73C6C000, Size = 114688
Name = WINNSI.DLL, Base = 0x73C40000, Top = 0x73C47000, Size = 28672
Name = RASAPI32.dll, Base = 0x72580000, Top = 0x725D2000, Size = 335872
Name = rasman.dll, Base = 0x72560000, Top = 0x72575000, Size = 86016
Name = rtutils.dll, Base = 0x737F0000, Top = 0x737FD000, Size = 53248
Name = sensapi.dll, Base = 0x6D250000, Top = 0x6D256000, Size = 24576
Name = xunyount.dll, Base = 0xD150000, Top = 0xD172000, Size = 139264
Name = dhcpcsvc.DLL, Base = 0x739B0000, Top = 0x739C2000, Size = 73728
Name = mswsock.dll, Base = 0x73720000, Top = 0x7375C000, Size = 245760
Name = wshtcpip.dll, Base = 0x72500000, Top = 0x72505000, Size = 20480
Name = peerdist.dll, Base = 0x70930000, Top = 0x70955000, Size = 151552
Name = USERENV.dll, Base = 0x73E60000, Top = 0x73E77000, Size = 94208
Name = AUTHZ.dll, Base = 0x70D10000, Top = 0x70D2B000, Size = 110592
Name = NLAapi.dll, Base = 0x72550000, Top = 0x72560000, Size = 65536
Name = rasadhlp.dll, Base = 0x72490000, Top = 0x72496000, Size = 24576
Name = wship6.dll, Base = 0x724A0000, Top = 0x724A6000, Size = 24576
Name = fwpuclnt.dll, Base = 0x72450000, Top = 0x72488000, Size = 229376
Name = CLBCatQ.DLL, Base = 0x75660000, Top = 0x756E3000, Size = 536576
Name = ieframe.dll, Base = 0x6A7E0000, Top = 0x6B130000, Size = 9764864
Name = SXS.DLL, Base = 0x6C410000, Top = 0x6C46F000, Size = 389120
Name = msscript.ocx, Base = 0x70290000, Top = 0x702AA000, Size = 106496
Name = RpcRtRemote.dll, Base = 0x73BB0000, Top = 0x73BBE000, Size = 57344
Name = qdisp.dll, Base = 0x65800000, Top = 0x6599B000, Size = 1683456
Name = vbscript.dll, Base = 0x70220000, Top = 0x7028A000, Size = 434176
Name = WindowsCodecs.dll, Base = 0x6CCB0000, Top = 0x6CDE0000, Size = 1245184
Name = MSHTML.dll, Base = 0x5F960000, Top = 0x60536000, Size = 12410880
Name = cfgdll.dll, Base = 0xE120000, Top = 0xE12F000, Size = 61440
Name = MLANG.dll, Base = 0x6D100000, Top = 0x6D12E000, Size = 188416
Name = CloudHelper.dll, Base = 0x65590000, Top = 0x657F1000, Size = 2494464
Name = msimtf.dll, Base = 0x707A0000, Top = 0x707AB000, Size = 45056
Name = msls31.dll, Base = 0x701F0000, Top = 0x7021B000, Size = 176128
Name = jscript9.dll, Base = 0x61620000, Top = 0x617DE000, Size = 1826816
Name = CRYPT32.dll, Base = 0x75B90000, Top = 0x75CB0000, Size = 1179648
Name = MSASN1.dll, Base = 0x772C0000, Top = 0x772CC000, Size = 49152
Name = DSOUND.dll, Base = 0x75700000, Top = 0x75772000, Size = 466944
Name = POWRPROF.dll, Base = 0x746B0000, Top = 0x746D5000, Size = 151552
Name = SETUPAPI.dll, Base = 0x766D0000, Top = 0x7686D000, Size = 1691648
Name = CFGMGR32.dll, Base = 0x746E0000, Top = 0x74707000, Size = 159744
Name = DEVOBJ.dll, Base = 0x768B0000, Top = 0x768C2000, Size = 73728
Name = PROPSYS.dll, Base = 0x73460000, Top = 0x73555000, Size = 1003520
Name = d2d1.dll, Base = 0x5F610000, Top = 0x5F957000, Size = 3436544
Name = DWrite.dll, Base = 0x5F4D0000, Top = 0x5F606000, Size = 1269760
Name = dxgi.dll, Base = 0x62500000, Top = 0x6254C000, Size = 311296
Name = WINTRUST.dll, Base = 0x76580000, Top = 0x765AE000, Size = 188416
Name = d3d10_1.dll, Base = 0x624D0000, Top = 0x624FC000, Size = 180224
Name = d3d10_1core.dll, Base = 0x615D0000, Top = 0x61611000, Size = 266240
Name = d3d11.dll, Base = 0x5F350000, Top = 0x5F4C5000, Size = 1527808
Name = D3D10Warp.dll, Base = 0x5F160000, Top = 0x5F349000, Size = 2002944
Name = XmlLite.dll, Base = 0x71D00000, Top = 0x71D2F000, Size = 192512
Name = ieproxy.dll, Base = 0x6D0C0000, Top = 0x6D0F3000, Size = 208896
Name = windowscodecsext.dll, Base = 0x6D080000, Top = 0x6D0B7000, Size = 225280
Name = msxml6.dll, Base = 0x65430000, Top = 0x65588000, Size = 1409024
Name = bcrypt.dll, Base = 0x6EB80000, Top = 0x6EB97000, Size = 94208
Name = bcryptprimitives.dll, Base = 0x6EB40000, Top = 0x6EB7D000, Size = 249856
Name = WINDOW.dll, Base = 0x8CD0000, Top = 0x8CDC000, Size = 49152
Name = BGKMS6_10.dll, Base = 0x52E90000, Top = 0x52EA6000, Size = 90112
Name = BKGND.dll, Base = 0x8CE0000, Top = 0x8CEB000, Size = 45056
Name = napinsp.dll, Base = 0x724F0000, Top = 0x72500000, Size = 65536
Name = pnrpnsp.dll, Base = 0x724D0000, Top = 0x724E2000, Size = 73728
Name = winrnr.dll, Base = 0x724C0000, Top = 0x724C8000, Size = 32768
Name = wshbth.dll, Base = 0x724B0000, Top = 0x724BD000, Size = 53248

Code Before:
26 48 00 00 8B C8 E8 FA 67 00 00 3B C6 74 0D 8B 06 57 8B CE
Current Code:
FF 90 0C 01 00 00 EB 02 33 C0 5E 5F 5D C3 8B FF 55 8B EC E8

Call Stack:
0052F6B7 ===> 多段宏按键BY幽明.exe

Current Stack:
[0018FE64] = 0029DE48
[0018FE68] = 0029DE18
[0018FE6C] = 0029DE48
[0018FE70] = 0018FE7C
[0018FE74] = 0052F6B7
[0018FE78] = 0029DE48
[0018FE7C] = 0018FE88
[0018FE80] = 0052F522
[0018FE84] = 0029DE48
[0018FE88] = 0018FEB8
[0018FE8C] = 0052F704
[0018FE90] = 0029DE48
[0018FE94] = 00000000
[0018FE98] = 00AADC30
[0018FE9C] = 0052F3A5
[0018FEA0] = 00AADC30
[0018FEA4] = 00AADC30
[0018FEA8] = FFFFFFFF
[0018FEAC] = 0029DE18
[0018FEB0] = 00000002
[0018FEB4] = 00000000
[0018FEB8] = 0018FECC
[0018FEBC] = 007A6E4C
[0018FEC0] = FF776000
[0018FEC4] = 00000000
[0018FEC8] = 0018FF5C
[0018FECC] = 0018FF5C
[0018FED0] = 006597EC
[0018FED4] = 00400000
[0018FED8] = 00000000
[0018FEDC] = 00242DB6
[0018FEE0] = 00000001
[0018FEE4] = 46848316
[0018FEE8] = FF776000
[0018FEEC] = 00000000
[0018FEF0] = 0018FF5C
[0018FEF4] = 00000044
[0018FEF8] = 00241B98
[0018FEFC] = 00241B78
[0018FF00] = 00241B1E
[0018FF04] = 00000000
[0018FF08] = 00000000
[0018FF0C] = 00000000
[0018FF10] = 00000000
[0018FF14] = 00000000
[0018FF18] = 00000000
[0018FF1C] = 00000000
[0018FF20] = 00000C01
[0018FF24] = 00000001
[0018FF28] = 00000000
[0018FF2C] = 00000000
[0018FF30] = 00010001
[0018FF34] = 00000000
[0018FF38] = C0000005
[0018FF3C] = 00000000
[0018FF40] = 00000000
[0018FF44] = 0018FEE4
[0018FF48] = 0018F8AC
[0018FF4C] = 0018FFC4
[0018FF50] = 00653860
[0018FF54] = 46346B1A
[0018FF58] = 00000000
[0018FF5C] = 765D4004
[0018FF60] = 0124921D
[0018FF64] = 00000000
[0018FF68] = 00000000
[0018FF6C] = 0018FF94
[0018FF70] = 0018FF84
[0018FF74] = 7EFDE000
[0018FF78] = 0018FF8C
[0018FF7C] = 00000000
[0018FF80] = BBB1706D
[0018FF84] = 0018FFC4
[0018FF88] = 010EAC5B
[0018FF8C] = 7538336A
[0018FF90] = 7EFDE000
[0018FF94] = 0018FFD4
[0018FF98] = 77329882
[0018FF9C] = 7EFDE000
[0018FFA0] = 771CF0E4
[0018FFA4] = 00000000
[0018FFA8] = 00000000
[0018FFAC] = 7EFDE000
[0018FFB0] = C0000005
[0018FFB4] = 753A76E7
[0018FFB8] = 753A76E7
[0018FFBC] = 0018FFA0
[0018FFC0] = 0018F8B0
[0018FFC4] = FFFFFFFF
[0018FFC8] = 77363145
[0018FFCC] = 0035CA70
[0018FFD0] = 00000000
[0018FFD4] = 0018FFEC
[0018FFD8] = 77329855
[0018FFDC] = 013E3000
[0018FFE0] = 7EFDE000
[0018FFE4] = 00000000
[0018FFE8] = 00000000
[0018FFEC] = 00000000
[0018FFF0] = 00000000
[0018FFF4] = 013E3000
[0018FFF8] = 7EFDE000
[0018FFFC] = 00000000
[00190000] = 78746341
[00190004] = 00000020
[00190008] = 00000001
[0019000C] = 0000330C
[00190010] = 000000DC
[00190014] = 00000000
[00190018] = 00000020
[0019001C] = 00000000
[00190020] = 00000014
[00190024] = 00000001
[00190028] = 00000007
[0019002C] = 00000034
[00190030] = 0000017C
[00190034] = 00000001
[00190038] = 00000000
[0019003C] = 00000000
[00190040] = 00000000
[00190044] = 00000000
[00190048] = 00000000
[0019004C] = 00000002
[00190050] = 1A26EF4E
[00190054] = 00000298
[00190058] = 00000044
[0019005C] = 000002E0
[00190060] = 00000260
[00190064] = 00000000
[00190068] = F33271BA
[0019006C] = 00000540
[00190070] = 0000004A
[00190074] = 0000058C
[00190078] = 0000031E
[0019007C] = 00000000
[00190080] = 2D59495B
[00190084] = 000008AC
[00190088] = 00000032
[0019008C] = 000008E0
[00190090] = 00000300
[00190094] = 00000000
[00190098] = 32CEEACD
[0019009C] = 00000BE0
[001900A0] = 00000042
[001900A4] = 00000C24
[001900A8] = 00000336
[001900AC] = 00000000
[001900B0] = 38505FC8
[001900B4] = 00000F5C
[001900B8] = 0000005E
[001900BC] = 00000FBC
[001900C0] = 00000368
[001900C4] = 00000000
[001900C8] = B1280544
[001900CC] = 00001324
[001900D0] = 00000056
[001900D4] = 0000137C
[001900D8] = 00000398
[001900DC] = 00000010
[001900E0] = 00000009
[001900E4] = 000000EC
[001900E8] = 00000002
[001900EC] = 00000001
[001900F0] = 0000017C
[001900F4] = 000015D0
[001900F8] = 00000001
[001900FC] = 00000002
[00190100] = 0000174C
[00190104] = 000007A0
[00190108] = 00000001
[0019010C] = 00000003
[00190110] = 00001EEC
[00190114] = 00000E8C
[00190118] = 00000001
[0019011C] = 00000004
[00190120] = 00002D78
[00190124] = 00000314
[00190128] = 00000002
[0019012C] = 00000005
[00190130] = 0000308C
[00190134] = 00000098
[00190138] = 00000002
[0019013C] = 00000006
[00190140] = 00003124
[00190144] = 000000CC
[00190148] = 00000002
[0019014C] = 00000007
[00190150] = 000031F0
[00190154] = 000000F0
[00190158] = 00000001
[0019015C] = 00000009
[00190160] = 000032E0
[00190164] = 00000028
[00190168] = 00000002
[0019016C] = 0000000B
[00190170] = 00003308
[00190174] = 00000004
[00190178] = 00000001
[0019017C] = 64487353
[00190180] = 0000002C