按?精? 2014.01.14314版
Environment = 1440x900|32|Windows 7 Home Premium
Type = 0xC0000005
Address = 0x4EF850
LineNum = 0(0)
Registers:
EAX=00000000 EBX=004EF830 ECX=00000000 EDX=00000000
ESI=00000000 EDI=0635FFB0 ESP=0018FC0C EBP=0018FCC0
Current Modules:
==>
Name = 琿??BY.exe, Base = 0x400000, Top = 0x13E8000, Size = 16678912
Name = ntdll.dll, Base = 0x77160000, Top = 0x772E0000, Size = 1572864
Name = kernel32.dll, Base = 0x768C0000, Top = 0x769D0000, Size = 1114112
Name = KERNELBASE.dll, Base = 0x76BC0000, Top = 0x76C07000, Size = 290816
Name = comctl32.dll, Base = 0x71C30000, Top = 0x71DCE000, Size = 1695744
Name = msvcrt.dll, Base = 0x74BC0000, Top = 0x74C6C000, Size = 704512
Name = GDI32.dll, Base = 0x767A0000, Top = 0x76830000, Size = 589824
Name = USER32.dll, Base = 0x74D10000, Top = 0x74E10000, Size = 1048576
Name = ADVAPI32.dll, Base = 0x74C70000, Top = 0x74D10000, Size = 655360
Name = sechost.dll, Base = 0x766F0000, Top = 0x76709000, Size = 102400
Name = RPCRT4.dll, Base = 0x76C70000, Top = 0x76D60000, Size = 983040
Name = SspiCli.dll, Base = 0x74AF0000, Top = 0x74B50000, Size = 393216
Name = CRYPTBASE.dll, Base = 0x74AE0000, Top = 0x74AEC000, Size = 49152
Name = LPK.dll, Base = 0x74BB0000, Top = 0x74BBA000, Size = 40960
Name = USP10.dll, Base = 0x76AA0000, Top = 0x76B3D000, Size = 643072
Name = SHLWAPI.dll, Base = 0x76840000, Top = 0x76897000, Size = 356352
Name = apphelp.dll, Base = 0x71B00000, Top = 0x71B4C000, Size = 311296
Name = AlLayer.DLL, Base = 0x23000000, Top = 0x23018000, Size = 98304
Name = AcLayers.dll, Base = 0x73130000, Top = 0x731BD000, Size = 577536
Name = SHELL32.dll, Base = 0x750B0000, Top = 0x75CFB000, Size = 12890112
Name = ole32.dll, Base = 0x76060000, Top = 0x761BC000, Size = 1425408
Name = OLEAUT32.dll, Base = 0x75D00000, Top = 0x75D8F000, Size = 585728
Name = USERENV.dll, Base = 0x76740000, Top = 0x76757000, Size = 94208
Name = profapi.dll, Base = 0x74B50000, Top = 0x74B5B000, Size = 45056
Name = WINSPOOL.DRV, Base = 0x749B0000, Top = 0x74A01000, Size = 331776
Name = MPR.dll, Base = 0x73B70000, Top = 0x73B82000, Size = 73728
Name = AcGenral.DLL, Base = 0x6A480000, Top = 0x6A698000, Size = 2195456
Name = UxTheme.dll, Base = 0x71BA0000, Top = 0x71C20000, Size = 524288
Name = WINMM.dll, Base = 0x73B00000, Top = 0x73B32000, Size = 204800
Name = samcli.dll, Base = 0x6A470000, Top = 0x6A47F000, Size = 61440
Name = MSACM32.dll, Base = 0x6A450000, Top = 0x6A464000, Size = 81920
Name = VERSION.dll, Base = 0x74A10000, Top = 0x74A19000, Size = 36864
Name = sfc.dll, Base = 0x6A440000, Top = 0x6A443000, Size = 12288
Name = sfc_os.DLL, Base = 0x6A430000, Top = 0x6A43D000, Size = 53248
Name = dwmapi.dll, Base = 0x71AC0000, Top = 0x71AD3000, Size = 77824
Name = SETUPAPI.dll, Base = 0x74E10000, Top = 0x74FAD000, Size = 1691648
Name = CFGMGR32.dll, Base = 0x76760000, Top = 0x76787000, Size = 159744
Name = DEVOBJ.dll, Base = 0x76720000, Top = 0x76732000, Size = 73728
Name = urlmon.dll, Base = 0x76590000, Top = 0x766DB000, Size = 1355776
Name = api-ms-win-downlevel-ole32-l1-1-0.dll, Base = 0x76710000, Top = 0x76714000, Size = 16384
Name = api-ms-win-downlevel-shlwapi-l1-1-0.dll, Base = 0x77130000, Top = 0x77134000, Size = 16384
Name = api-ms-win-downlevel-advapi32-l1-1-0.dll, Base = 0x76050000, Top = 0x76055000, Size = 20480
Name = api-ms-win-downlevel-user32-l1-1-0.dll, Base = 0x766E0000, Top = 0x766E4000, Size = 16384
Name = api-ms-win-downlevel-version-l1-1-0.dll, Base = 0x76830000, Top = 0x76834000, Size = 16384
Name = api-ms-win-downlevel-normaliz-l1-1-0.dll, Base = 0x75D90000, Top = 0x75D93000, Size = 12288
Name = normaliz.DLL, Base = 0x76790000, Top = 0x76793000, Size = 12288
Name = iertutil.dll, Base = 0x762F0000, Top = 0x76522000, Size = 2301952
Name = WININET.dll, Base = 0x75DA0000, Top = 0x75F75000, Size = 1921024
Name = AcXtrnal.DLL, Base = 0x6A1D0000, Top = 0x6A429000, Size = 2461696
Name = SHUNIMPL.DLL, Base = 0x6A1C0000, Top = 0x6A1C6000, Size = 24576
Name = SortServer2003Compat.dll, Base = 0x6A1B0000, Top = 0x6A1BD000, Size = 53248
Name = IMM32.DLL, Base = 0x76530000, Top = 0x76590000, Size = 393216
Name = MSCTF.dll, Base = 0x74FB0000, Top = 0x7507C000, Size = 835584
Name = nvinit.dll, Base = 0x74980000, Top = 0x749AE000, Size = 188416
Name = MSIMG32.dll, Base = 0x70A00000, Top = 0x70A05000, Size = 20480
Name = COMDLG32.dll, Base = 0x76B40000, Top = 0x76BBB000, Size = 503808
Name = oledlg.dll, Base = 0x53F10000, Top = 0x53F2C000, Size = 114688
Name = gdiplus.dll, Base = 0x71220000, Top = 0x713B0000, Size = 1638400
Name = DINPUT8.dll, Base = 0x6A6A0000, Top = 0x6A6D0000, Size = 196608
Name = WS2_32.dll, Base = 0x76010000, Top = 0x76045000, Size = 217088
Name = NSI.dll, Base = 0x76A60000, Top = 0x76A66000, Size = 24576
Name = dbghelp.dll, Base = 0x64370000, Top = 0x6445B000, Size = 962560
Name = Syntconv.dll, Base = 0x10000000, Top = 0x10053000, Size = 339968
Name = MFC42.DLL, Base = 0x53670000, Top = 0x5378C000, Size = 1163264
Name = ODBC32.dll, Base = 0x53820000, Top = 0x538AC000, Size = 573440
Name = MSVCP60.dll, Base = 0x537B0000, Top = 0x53816000, Size = 417792
Name = odbcint.dll, Base = 0x53ED0000, Top = 0x53F08000, Size = 229376
Name = refs.dll, Base = 0x534D0000, Top = 0x53666000, Size = 1662976
Name = OLEACC.dll, Base = 0x698F0000, Top = 0x6992C000, Size = 245760
Name = CRYPTSP.dll, Base = 0x73690000, Top = 0x736A7000, Size = 94208
Name = rsaenh.dll, Base = 0x73650000, Top = 0x7368B000, Size = 241664
Name = asycfilt.dll, Base = 0x55A00000, Top = 0x55A14000, Size = 81920
Name = Secur32.dll, Base = 0x6AE20000, Top = 0x6AE28000, Size = 32768
Name = api-ms-win-downlevel-advapi32-l2-1-0.dll, Base = 0x6AE10000, Top = 0x6AE14000, Size = 16384
Name = CLBCatQ.DLL, Base = 0x769D0000, Top = 0x76A53000, Size = 536576
Name = IMTCTIP.DLL, Base = 0x6A110000, Top = 0x6A1A8000, Size = 622592
Name = imetip.dll, Base = 0x6A0B0000, Top = 0x6A10E000, Size = 385024
Name = IMTCCORE.DLL, Base = 0x69B90000, Top = 0x69C18000, Size = 557056
Name = IMTCCFG.DLL, Base = 0x6A6E0000, Top = 0x6A70D000, Size = 184320
Name = api-ms-win-downlevel-shlwapi-l2-1-0.dll, Base = 0x6A6D0000, Top = 0x6A6D4000, Size = 16384
Name = mswsock.dll, Base = 0x72060000, Top = 0x7209C000, Size = 245760
Name = wship6.dll, Base = 0x73BE0000, Top = 0x73BE6000, Size = 24576
Name = IPHLPAPI.DLL, Base = 0x73700000, Top = 0x7371C000, Size = 114688
Name = WINNSI.DLL, Base = 0x736C0000, Top = 0x736C7000, Size = 28672
Name = DNSAPI.dll, Base = 0x734E0000, Top = 0x73524000, Size = 278528
Name = wshtcpip.dll, Base = 0x71B90000, Top = 0x71B95000, Size = 20480
Name = rasadhlp.dll, Base = 0x73480000, Top = 0x73486000, Size = 24576
Name = fwpuclnt.dll, Base = 0x73490000, Top = 0x734C8000, Size = 229376
Name = ieframe.dll, Base = 0x66030000, Top = 0x66C72000, Size = 12853248
Name = api-ms-win-downlevel-shell32-l1-1-0.dll, Base = 0x66020000, Top = 0x66024000, Size = 16384
Name = SXS.DLL, Base = 0x70B40000, Top = 0x70B9F000, Size = 389120
Name = msscript.ocx, Base = 0x53EB0000, Top = 0x53ECA000, Size = 106496
Name = RpcRtRemote.dll, Base = 0x73640000, Top = 0x7364E000, Size = 57344
Name = qdisp.dll, Base = 0x51F60000, Top = 0x520FB000, Size = 1683456
Name = vbscript.dll, Base = 0x53450000, Top = 0x534CF000, Size = 520192
Name = WindowsCodecs.dll, Base = 0x71950000, Top = 0x71A81000, Size = 1249280
Name = imecfm.dll, Base = 0x66DC0000, Top = 0x66DCB000, Size = 45056
Name = MSHTML.dll, Base = 0x673E0000, Top = 0x686B8000, Size = 19759104
Name = cfgdll.dll, Base = 0x9CC0000, Top = 0x9CCF000, Size = 61440
Name = MLANG.dll, Base = 0x73AC0000, Top = 0x73AEE000, Size = 188416
Name = PROPSYS.dll, Base = 0x69C20000, Top = 0x69D15000, Size = 1003520
Name = CloudHelper.dll, Base = 0x531E0000, Top = 0x53441000, Size = 2494464
Name = msimtf.dll, Base = 0x66FA0000, Top = 0x66FAB000, Size = 45056
Name = msls31.dll, Base = 0x6A730000, Top = 0x6A761000, Size = 200704
Name = jscript9.dll, Base = 0x66FB0000, Top = 0x673D2000, Size = 4333568
Name = Flash32_17_0_0_134.ocx, Base = 0x60580000, Top = 0x616A2000, Size = 17965056
Name = CRYPT32.dll, Base = 0x761C0000, Top = 0x762E1000, Size = 1183744
Name = MSASN1.dll, Base = 0x768B0000, Top = 0x768BC000, Size = 49152
Name = DSOUND.dll, Base = 0x69440000, Top = 0x694B2000, Size = 466944
Name = POWRPROF.dll, Base = 0x69AD0000, Top = 0x69AF5000, Size = 151552
Name = mscms.dll, Base = 0x693C0000, Top = 0x69439000, Size = 495616
Name = d2d1.dll, Base = 0x65CD0000, Top = 0x66017000, Size = 3436544
Name = DWrite.dll, Base = 0x66E20000, Top = 0x66F55000, Size = 1265664
Name = dxgi.dll, Base = 0x66DD0000, Top = 0x66E1C000, Size = 311296
Name = WINTRUST.dll, Base = 0x76A70000, Top = 0x76A9F000, Size = 192512
Name = d3d11.dll, Base = 0x65B50000, Top = 0x65CC5000, Size = 1527808
Name = D3D10Warp.dll, Base = 0x65960000, Top = 0x65B49000, Size = 2002944
Name = windowscodecsext.dll, Base = 0x66F60000, Top = 0x66F97000, Size = 225280
Name = msxml6.dll, Base = 0x70BA0000, Top = 0x70CF7000, Size = 1404928
Name = uiautomationcore.dll, Base = 0x69B00000, Top = 0x69B8C000, Size = 573440
Name = PSAPI.DLL, Base = 0x768A0000, Top = 0x768A5000, Size = 20480
Name = XmlLite.dll, Base = 0x73450000, Top = 0x7347F000, Size = 192512
Name = bcrypt.dll, Base = 0x70AE0000, Top = 0x70AF7000, Size = 94208
Name = bcryptprimitives.dll, Base = 0x70AA0000, Top = 0x70ADD000, Size = 249856
Name = MMDevAPI.DLL, Base = 0x64C30000, Top = 0x64C69000, Size = 233472
Name = wdmaud.drv, Base = 0x64BC0000, Top = 0x64BF0000, Size = 196608
Name = ksuser.dll, Base = 0x64BB0000, Top = 0x64BB4000, Size = 16384
Name = AVRT.dll, Base = 0x64BA0000, Top = 0x64BA7000, Size = 28672
Name = msacm32.drv, Base = 0x64340000, Top = 0x64348000, Size = 32768
Name = midimap.dll, Base = 0x642F0000, Top = 0x642F7000, Size = 28672
Name = AUDIOSES.DLL, Base = 0x642B0000, Top = 0x642E6000, Size = 221184
Name = InputHook.dll, Base = 0x6A940000, Top = 0x6A954000, Size = 81920
Name = MSVCR90.dll, Base = 0x6A770000, Top = 0x6A813000, Size = 667648
Name = MSVCP90.dll, Base = 0x6A820000, Top = 0x6A8AE000, Size = 581632
Name = Overlay.dll, Base = 0x6A9C0000, Top = 0x6AC1C000, Size = 2473984
Name = PluginKernel.dll, Base = 0x5FE0000, Top = 0x5FF3000, Size = 77824
Name = CommonLib.dll, Base = 0x73A00000, Top = 0x73A1E000, Size = 122880
Name = Access.dll, Base = 0x6040000, Top = 0x604B000, Size = 45056
Name = bgkms6_10.dll, Base = 0x52E90000, Top = 0x52EA6000, Size = 90112
Name = Bkgnd.dll, Base = 0x6090000, Top = 0x609B000, Size = 45056
Name = BkgndColor.dll, Base = 0x60A0000, Top = 0x60A9000, Size = 36864
Name = Color.dll, Base = 0x60B0000, Top = 0x60BB000, Size = 45056
Name = ColorEx.dll, Base = 0x60C0000, Top = 0x60CC000, Size = 49152
Name = Console.dll, Base = 0x60D0000, Top = 0x60D8000, Size = 32768
Name = Encrypt.dll, Base = 0x60E0000, Top = 0x60EA000, Size = 40960
Name = File.dll, Base = 0x60F0000, Top = 0x60FB000, Size = 45056
Name = GetSysInfo.dll, Base = 0x6100000, Top = 0x6108000, Size = 32768
Name = Media.dll, Base = 0x6110000, Top = 0x6119000, Size = 36864
Name = Memory.dll, Base = 0x6120000, Top = 0x612B000, Size = 45056
Name = Msg.dll, Base = 0x6130000, Top = 0x613B000, Size = 45056
Name = Net.dll, Base = 0x6140000, Top = 0x6147000, Size = 28672
Name = MSVBVM60.DLL, Base = 0x72940000, Top = 0x72A93000, Size = 1388544
Name = Office.dll, Base = 0x6150000, Top = 0x6159000, Size = 36864
Name = Oracle.dll, Base = 0x6160000, Top = 0x616B000, Size = 45056
Name = Pic.dll, Base = 0x6170000, Top = 0x6178000, Size = 32768
Name = SQLServer.dll, Base = 0x6190000, Top = 0x619B000, Size = 45056
Name = Sys.dll, Base = 0x61A0000, Top = 0x61A9000, Size = 36864
Name = Web.dll, Base = 0x61B0000, Top = 0x61BF000, Size = 61440
Name = Window.dll, Base = 0x61C0000, Top = 0x61CC000, Size = 49152
Name = ntmarta.dll, Base = 0x74950000, Top = 0x74971000, Size = 135168
Name = WLDAP32.dll, Base = 0x74B60000, Top = 0x74BA5000, Size = 282624
Code Before:
F9 03 00 85 C0 74 0B 8B 10 8B C8 8B 42 74 FF D0 EB 02 33 C0
Current Code:
8B 48 20 56 8B 35 A0 B9 7E 00 6A 00 68 27 80 00 00 68 11 01
Call Stack:
00531A90 ===> 琿??BY.exe
Current Stack:
[0018FC0C] = 00536C68
[0018FC10] = 00000000
[0018FC14] = 00000000
[0018FC18] = A2B7D596
[0018FC1C] = 000007F0
[0018FC20] = 0635FFB0
[0018FC24] = 01562FC8
[0018FC28] = 74D90230
[0018FC2C] = 00000020
[0018FC30] = 0018FC98
[0018FC34] = 74D26D91
[0018FC38] = 74D26D51
[0018FC3C] = A2997D32
[0018FC40] = 00008002
[0018FC44] = 6746CE10
[0018FC48] = 00000000
[0018FC4C] = 00000024
[0018FC50] = 00000001
[0018FC54] = 0018FDD4
[0018FC58] = 01565F24
[0018FC5C] = 00000070
[0018FC60] = FFE7022B
[0018FC64] = FEA9A0DB
[0018FC68] = 74D26CE9
[0018FC6C] = 74D26D91
[0018FC70] = 0C8C9FC8
[0018FC74] = 00000007
[0018FC78] = 00000000
[0018FC7C] = 000506CE
[0018FC80] = 00000000
[0018FC84] = 0018FCD8
[0018FC88] = 0018FD68
[0018FC8C] = 74D8A61E
[0018FC90] = 00000000
[0018FC94] = 00AB4820
[0018FC98] = 01562FC8
[0018FC9C] = 00AB483C
[0018FCA0] = 00AB4820
[0018FCA4] = 0018FCBC
[0018FCA8] = 00AB2D48
[0018FCAC] = 7FFFFFFF
[0018FCB0] = 00000000
[0018FCB4] = 0018FD48
[0018FCB8] = 007C87CE
[0018FCBC] = 00000000
[0018FCC0] = 0018FCE0
[0018FCC4] = 00531A90
[0018FCC8] = 000007F0
[0018FCCC] = 00000000
[0018FCD0] = 00A9AB80
[0018FCD4] = 0018FCDC
[0018FCD8] = 0635FFB0
[0018FCDC] = 00000000
[0018FCE0] = 0018FD54
[0018FCE4] = 00534F83
[0018FCE8] = 000007F0
[0018FCEC] = 00000000
[0018FCF0] = 00000000
[0018FCF4] = A2B7D402
[0018FCF8] = 00000000
[0018FCFC] = 000E05D6
[0018FD00] = 00000000
[0018FD04] = 00000000
[0018FD08] = 00000000
[0018FD0C] = 00000000
[0018FD10] = 00000000
[0018FD14] = 00000000
[0018FD18] = 00000000
[0018FD1C] = 00000000
[0018FD20] = 007CF75E
[0018FD24] = FFFFFFFF
[0018FD28] = 01562FC8
[0018FD2C] = 00000000
[0018FD30] = 00000000
[0018FD34] = 00000000
[0018FD38] = 00000000
[0018FD3C] = 00000000
[0018FD40] = A2B7D402
[0018FD44] = 0018FCF4
[0018FD48] = 0018FE08
[0018FD4C] = 007C8692
[0018FD50] = 00000000
[0018FD54] = 0018FD74
[0018FD58] = 00535012
[0018FD5C] = 0635FFB0
[0018FD60] = 000E05D6
[0018FD64] = 000007F0
[0018FD68] = 00000000
[0018FD6C] = 00000000
[0018FD70] = 00534FDC
[0018FD74] = 0018FDA0
[0018FD78] = 74D262FA
[0018FD7C] = 000E05D6
[0018FD80] = 000007F0
[0018FD84] = 00000000
[0018FD88] = 00000000
[0018FD8C] = 00534FDC
[0018FD90] = DCBAABCD
[0018FD94] = 00000000
[0018FD98] = 00000000
[0018FD9C] = 00534FDC
[0018FDA0] = 0018FE18
[0018FDA4] = 74D26D3A
[0018FDA8] = 00534FDC
[0018FDAC] = 000E05D6
[0018FDB0] = 000007F0
[0018FDB4] = 00000000
[0018FDB8] = 00000000
[0018FDBC] = A2997FB2
[0018FDC0] = 01563000
[0018FDC4] = 01562FF8
[0018FDC8] = 01F25530
[0018FDCC] = 00000024
[0018FDD0] = 00000001
[0018FDD4] = 00000000
[0018FDD8] = 01565F24
[0018FDDC] = 00000020
[0018FDE0] = FFFFFFFF
[0018FDE4] = FEA9A0DB
[0018FDE8] = 74D26CE9
[0018FDEC] = 00000000
[0018FDF0] = 00170578
[0018FDF4] = 00000001
[0018FDF8] = 00000000
[0018FDFC] = 00000000
[0018FE00] = 0018FDBC
[0018FE04] = 0018F658
[0018FE08] = 0018FE68
[0018FE0C] = 74D8A61E
[0018FE10] = D653ECF2
[0018FE14] = 00000000
[0018FE18] = 0018FE78
[0018FE1C] = 74D277C4
[0018FE20] = 01565F24
[0018FE24] = 00534FDC
[0018FE28] = 000E05D6
[0018FE2C] = 000007F0
[0018FE30] = 00000000
[0018FE34] = 00000000
[0018FE38] = 01F25558
[0018FE3C] = 00000001
[0018FE40] = A2997FD2
[0018FE44] = 01562FF8
[0018FE48] = 01562FC8
[0018FE4C] = 01562FF8
[0018FE50] = 01562FF8
[0018FE54] = 00000000
[0018FE58] = 00000000
[0018FE5C] = 0052F4D7
[0018FE60] = 0018FE40
[0018FE64] = 0018F658
[0018FE68] = 0018FF4C
[0018FE6C] = 74D8A61E
[0018FE70] = D653F642
[0018FE74] = FFFFFFFE
[0018FE78] = 0018FE88
[0018FE7C] = 74D27BCA
[0018FE80] = 00534FDC
[0018FE84] = 00000001
[0018FE88] = 0018FEB8
[0018FE8C] = 0052F717
[0018FE90] = 01562FF8
[0018FE94] = 00000000
[0018FE98] = 00AADC30
[0018FE9C] = 0052F3A5
[0018FEA0] = 00AADC30
[0018FEA4] = 00AADC30
[0018FEA8] = FFFFFFFF
[0018FEAC] = 01562FC8
[0018FEB0] = 00000000
[0018FEB4] = 00000001
[0018FEB8] = 0018FECC
[0018FEBC] = 007A6E4C
[0018FEC0] = FF776000
[0018FEC4] = 00000000
[0018FEC8] = 0018FF5C
[0018FECC] = 0018FF5C
[0018FED0] = 006597EC
[0018FED4] = 00400000
[0018FED8] = 00000000
[0018FEDC] = 014B2C77
[0018FEE0] = 0000000A
[0018FEE4] = A2B7D60A
[0018FEE8] = FF776000
[0018FEEC] = 00000000
[0018FEF0] = 0018FF5C
[0018FEF4] = 00000044
[0018FEF8] = 014B1AF4
[0018FEFC] = 014B1AD4
[0018FF00] = 014B1A60
[0018FF04] = 00000000
[0018FF08] = 00000000
[0018FF0C] = 00000000
[0018FF10] = 00000000
[0018FF14] = 00000000
[0018FF18] = 00000000
[0018FF1C] = 00000000
[0018FF20] = 00000000
[0018FF24] = 00000000
[0018FF28] = 00000000
Environment = 1440x900|32|Windows 7 Home Premium
Type = 0xC0000005
Address = 0x4EF850
LineNum = 0(0)
Registers:
EAX=00000000 EBX=004EF830 ECX=00000000 EDX=00000000
ESI=00000000 EDI=0635FFB0 ESP=0018FC0C EBP=0018FCC0
Current Modules:
==>
Name = 琿??BY.exe, Base = 0x400000, Top = 0x13E8000, Size = 16678912
Name = ntdll.dll, Base = 0x77160000, Top = 0x772E0000, Size = 1572864
Name = kernel32.dll, Base = 0x768C0000, Top = 0x769D0000, Size = 1114112
Name = KERNELBASE.dll, Base = 0x76BC0000, Top = 0x76C07000, Size = 290816
Name = comctl32.dll, Base = 0x71C30000, Top = 0x71DCE000, Size = 1695744
Name = msvcrt.dll, Base = 0x74BC0000, Top = 0x74C6C000, Size = 704512
Name = GDI32.dll, Base = 0x767A0000, Top = 0x76830000, Size = 589824
Name = USER32.dll, Base = 0x74D10000, Top = 0x74E10000, Size = 1048576
Name = ADVAPI32.dll, Base = 0x74C70000, Top = 0x74D10000, Size = 655360
Name = sechost.dll, Base = 0x766F0000, Top = 0x76709000, Size = 102400
Name = RPCRT4.dll, Base = 0x76C70000, Top = 0x76D60000, Size = 983040
Name = SspiCli.dll, Base = 0x74AF0000, Top = 0x74B50000, Size = 393216
Name = CRYPTBASE.dll, Base = 0x74AE0000, Top = 0x74AEC000, Size = 49152
Name = LPK.dll, Base = 0x74BB0000, Top = 0x74BBA000, Size = 40960
Name = USP10.dll, Base = 0x76AA0000, Top = 0x76B3D000, Size = 643072
Name = SHLWAPI.dll, Base = 0x76840000, Top = 0x76897000, Size = 356352
Name = apphelp.dll, Base = 0x71B00000, Top = 0x71B4C000, Size = 311296
Name = AlLayer.DLL, Base = 0x23000000, Top = 0x23018000, Size = 98304
Name = AcLayers.dll, Base = 0x73130000, Top = 0x731BD000, Size = 577536
Name = SHELL32.dll, Base = 0x750B0000, Top = 0x75CFB000, Size = 12890112
Name = ole32.dll, Base = 0x76060000, Top = 0x761BC000, Size = 1425408
Name = OLEAUT32.dll, Base = 0x75D00000, Top = 0x75D8F000, Size = 585728
Name = USERENV.dll, Base = 0x76740000, Top = 0x76757000, Size = 94208
Name = profapi.dll, Base = 0x74B50000, Top = 0x74B5B000, Size = 45056
Name = WINSPOOL.DRV, Base = 0x749B0000, Top = 0x74A01000, Size = 331776
Name = MPR.dll, Base = 0x73B70000, Top = 0x73B82000, Size = 73728
Name = AcGenral.DLL, Base = 0x6A480000, Top = 0x6A698000, Size = 2195456
Name = UxTheme.dll, Base = 0x71BA0000, Top = 0x71C20000, Size = 524288
Name = WINMM.dll, Base = 0x73B00000, Top = 0x73B32000, Size = 204800
Name = samcli.dll, Base = 0x6A470000, Top = 0x6A47F000, Size = 61440
Name = MSACM32.dll, Base = 0x6A450000, Top = 0x6A464000, Size = 81920
Name = VERSION.dll, Base = 0x74A10000, Top = 0x74A19000, Size = 36864
Name = sfc.dll, Base = 0x6A440000, Top = 0x6A443000, Size = 12288
Name = sfc_os.DLL, Base = 0x6A430000, Top = 0x6A43D000, Size = 53248
Name = dwmapi.dll, Base = 0x71AC0000, Top = 0x71AD3000, Size = 77824
Name = SETUPAPI.dll, Base = 0x74E10000, Top = 0x74FAD000, Size = 1691648
Name = CFGMGR32.dll, Base = 0x76760000, Top = 0x76787000, Size = 159744
Name = DEVOBJ.dll, Base = 0x76720000, Top = 0x76732000, Size = 73728
Name = urlmon.dll, Base = 0x76590000, Top = 0x766DB000, Size = 1355776
Name = api-ms-win-downlevel-ole32-l1-1-0.dll, Base = 0x76710000, Top = 0x76714000, Size = 16384
Name = api-ms-win-downlevel-shlwapi-l1-1-0.dll, Base = 0x77130000, Top = 0x77134000, Size = 16384
Name = api-ms-win-downlevel-advapi32-l1-1-0.dll, Base = 0x76050000, Top = 0x76055000, Size = 20480
Name = api-ms-win-downlevel-user32-l1-1-0.dll, Base = 0x766E0000, Top = 0x766E4000, Size = 16384
Name = api-ms-win-downlevel-version-l1-1-0.dll, Base = 0x76830000, Top = 0x76834000, Size = 16384
Name = api-ms-win-downlevel-normaliz-l1-1-0.dll, Base = 0x75D90000, Top = 0x75D93000, Size = 12288
Name = normaliz.DLL, Base = 0x76790000, Top = 0x76793000, Size = 12288
Name = iertutil.dll, Base = 0x762F0000, Top = 0x76522000, Size = 2301952
Name = WININET.dll, Base = 0x75DA0000, Top = 0x75F75000, Size = 1921024
Name = AcXtrnal.DLL, Base = 0x6A1D0000, Top = 0x6A429000, Size = 2461696
Name = SHUNIMPL.DLL, Base = 0x6A1C0000, Top = 0x6A1C6000, Size = 24576
Name = SortServer2003Compat.dll, Base = 0x6A1B0000, Top = 0x6A1BD000, Size = 53248
Name = IMM32.DLL, Base = 0x76530000, Top = 0x76590000, Size = 393216
Name = MSCTF.dll, Base = 0x74FB0000, Top = 0x7507C000, Size = 835584
Name = nvinit.dll, Base = 0x74980000, Top = 0x749AE000, Size = 188416
Name = MSIMG32.dll, Base = 0x70A00000, Top = 0x70A05000, Size = 20480
Name = COMDLG32.dll, Base = 0x76B40000, Top = 0x76BBB000, Size = 503808
Name = oledlg.dll, Base = 0x53F10000, Top = 0x53F2C000, Size = 114688
Name = gdiplus.dll, Base = 0x71220000, Top = 0x713B0000, Size = 1638400
Name = DINPUT8.dll, Base = 0x6A6A0000, Top = 0x6A6D0000, Size = 196608
Name = WS2_32.dll, Base = 0x76010000, Top = 0x76045000, Size = 217088
Name = NSI.dll, Base = 0x76A60000, Top = 0x76A66000, Size = 24576
Name = dbghelp.dll, Base = 0x64370000, Top = 0x6445B000, Size = 962560
Name = Syntconv.dll, Base = 0x10000000, Top = 0x10053000, Size = 339968
Name = MFC42.DLL, Base = 0x53670000, Top = 0x5378C000, Size = 1163264
Name = ODBC32.dll, Base = 0x53820000, Top = 0x538AC000, Size = 573440
Name = MSVCP60.dll, Base = 0x537B0000, Top = 0x53816000, Size = 417792
Name = odbcint.dll, Base = 0x53ED0000, Top = 0x53F08000, Size = 229376
Name = refs.dll, Base = 0x534D0000, Top = 0x53666000, Size = 1662976
Name = OLEACC.dll, Base = 0x698F0000, Top = 0x6992C000, Size = 245760
Name = CRYPTSP.dll, Base = 0x73690000, Top = 0x736A7000, Size = 94208
Name = rsaenh.dll, Base = 0x73650000, Top = 0x7368B000, Size = 241664
Name = asycfilt.dll, Base = 0x55A00000, Top = 0x55A14000, Size = 81920
Name = Secur32.dll, Base = 0x6AE20000, Top = 0x6AE28000, Size = 32768
Name = api-ms-win-downlevel-advapi32-l2-1-0.dll, Base = 0x6AE10000, Top = 0x6AE14000, Size = 16384
Name = CLBCatQ.DLL, Base = 0x769D0000, Top = 0x76A53000, Size = 536576
Name = IMTCTIP.DLL, Base = 0x6A110000, Top = 0x6A1A8000, Size = 622592
Name = imetip.dll, Base = 0x6A0B0000, Top = 0x6A10E000, Size = 385024
Name = IMTCCORE.DLL, Base = 0x69B90000, Top = 0x69C18000, Size = 557056
Name = IMTCCFG.DLL, Base = 0x6A6E0000, Top = 0x6A70D000, Size = 184320
Name = api-ms-win-downlevel-shlwapi-l2-1-0.dll, Base = 0x6A6D0000, Top = 0x6A6D4000, Size = 16384
Name = mswsock.dll, Base = 0x72060000, Top = 0x7209C000, Size = 245760
Name = wship6.dll, Base = 0x73BE0000, Top = 0x73BE6000, Size = 24576
Name = IPHLPAPI.DLL, Base = 0x73700000, Top = 0x7371C000, Size = 114688
Name = WINNSI.DLL, Base = 0x736C0000, Top = 0x736C7000, Size = 28672
Name = DNSAPI.dll, Base = 0x734E0000, Top = 0x73524000, Size = 278528
Name = wshtcpip.dll, Base = 0x71B90000, Top = 0x71B95000, Size = 20480
Name = rasadhlp.dll, Base = 0x73480000, Top = 0x73486000, Size = 24576
Name = fwpuclnt.dll, Base = 0x73490000, Top = 0x734C8000, Size = 229376
Name = ieframe.dll, Base = 0x66030000, Top = 0x66C72000, Size = 12853248
Name = api-ms-win-downlevel-shell32-l1-1-0.dll, Base = 0x66020000, Top = 0x66024000, Size = 16384
Name = SXS.DLL, Base = 0x70B40000, Top = 0x70B9F000, Size = 389120
Name = msscript.ocx, Base = 0x53EB0000, Top = 0x53ECA000, Size = 106496
Name = RpcRtRemote.dll, Base = 0x73640000, Top = 0x7364E000, Size = 57344
Name = qdisp.dll, Base = 0x51F60000, Top = 0x520FB000, Size = 1683456
Name = vbscript.dll, Base = 0x53450000, Top = 0x534CF000, Size = 520192
Name = WindowsCodecs.dll, Base = 0x71950000, Top = 0x71A81000, Size = 1249280
Name = imecfm.dll, Base = 0x66DC0000, Top = 0x66DCB000, Size = 45056
Name = MSHTML.dll, Base = 0x673E0000, Top = 0x686B8000, Size = 19759104
Name = cfgdll.dll, Base = 0x9CC0000, Top = 0x9CCF000, Size = 61440
Name = MLANG.dll, Base = 0x73AC0000, Top = 0x73AEE000, Size = 188416
Name = PROPSYS.dll, Base = 0x69C20000, Top = 0x69D15000, Size = 1003520
Name = CloudHelper.dll, Base = 0x531E0000, Top = 0x53441000, Size = 2494464
Name = msimtf.dll, Base = 0x66FA0000, Top = 0x66FAB000, Size = 45056
Name = msls31.dll, Base = 0x6A730000, Top = 0x6A761000, Size = 200704
Name = jscript9.dll, Base = 0x66FB0000, Top = 0x673D2000, Size = 4333568
Name = Flash32_17_0_0_134.ocx, Base = 0x60580000, Top = 0x616A2000, Size = 17965056
Name = CRYPT32.dll, Base = 0x761C0000, Top = 0x762E1000, Size = 1183744
Name = MSASN1.dll, Base = 0x768B0000, Top = 0x768BC000, Size = 49152
Name = DSOUND.dll, Base = 0x69440000, Top = 0x694B2000, Size = 466944
Name = POWRPROF.dll, Base = 0x69AD0000, Top = 0x69AF5000, Size = 151552
Name = mscms.dll, Base = 0x693C0000, Top = 0x69439000, Size = 495616
Name = d2d1.dll, Base = 0x65CD0000, Top = 0x66017000, Size = 3436544
Name = DWrite.dll, Base = 0x66E20000, Top = 0x66F55000, Size = 1265664
Name = dxgi.dll, Base = 0x66DD0000, Top = 0x66E1C000, Size = 311296
Name = WINTRUST.dll, Base = 0x76A70000, Top = 0x76A9F000, Size = 192512
Name = d3d11.dll, Base = 0x65B50000, Top = 0x65CC5000, Size = 1527808
Name = D3D10Warp.dll, Base = 0x65960000, Top = 0x65B49000, Size = 2002944
Name = windowscodecsext.dll, Base = 0x66F60000, Top = 0x66F97000, Size = 225280
Name = msxml6.dll, Base = 0x70BA0000, Top = 0x70CF7000, Size = 1404928
Name = uiautomationcore.dll, Base = 0x69B00000, Top = 0x69B8C000, Size = 573440
Name = PSAPI.DLL, Base = 0x768A0000, Top = 0x768A5000, Size = 20480
Name = XmlLite.dll, Base = 0x73450000, Top = 0x7347F000, Size = 192512
Name = bcrypt.dll, Base = 0x70AE0000, Top = 0x70AF7000, Size = 94208
Name = bcryptprimitives.dll, Base = 0x70AA0000, Top = 0x70ADD000, Size = 249856
Name = MMDevAPI.DLL, Base = 0x64C30000, Top = 0x64C69000, Size = 233472
Name = wdmaud.drv, Base = 0x64BC0000, Top = 0x64BF0000, Size = 196608
Name = ksuser.dll, Base = 0x64BB0000, Top = 0x64BB4000, Size = 16384
Name = AVRT.dll, Base = 0x64BA0000, Top = 0x64BA7000, Size = 28672
Name = msacm32.drv, Base = 0x64340000, Top = 0x64348000, Size = 32768
Name = midimap.dll, Base = 0x642F0000, Top = 0x642F7000, Size = 28672
Name = AUDIOSES.DLL, Base = 0x642B0000, Top = 0x642E6000, Size = 221184
Name = InputHook.dll, Base = 0x6A940000, Top = 0x6A954000, Size = 81920
Name = MSVCR90.dll, Base = 0x6A770000, Top = 0x6A813000, Size = 667648
Name = MSVCP90.dll, Base = 0x6A820000, Top = 0x6A8AE000, Size = 581632
Name = Overlay.dll, Base = 0x6A9C0000, Top = 0x6AC1C000, Size = 2473984
Name = PluginKernel.dll, Base = 0x5FE0000, Top = 0x5FF3000, Size = 77824
Name = CommonLib.dll, Base = 0x73A00000, Top = 0x73A1E000, Size = 122880
Name = Access.dll, Base = 0x6040000, Top = 0x604B000, Size = 45056
Name = bgkms6_10.dll, Base = 0x52E90000, Top = 0x52EA6000, Size = 90112
Name = Bkgnd.dll, Base = 0x6090000, Top = 0x609B000, Size = 45056
Name = BkgndColor.dll, Base = 0x60A0000, Top = 0x60A9000, Size = 36864
Name = Color.dll, Base = 0x60B0000, Top = 0x60BB000, Size = 45056
Name = ColorEx.dll, Base = 0x60C0000, Top = 0x60CC000, Size = 49152
Name = Console.dll, Base = 0x60D0000, Top = 0x60D8000, Size = 32768
Name = Encrypt.dll, Base = 0x60E0000, Top = 0x60EA000, Size = 40960
Name = File.dll, Base = 0x60F0000, Top = 0x60FB000, Size = 45056
Name = GetSysInfo.dll, Base = 0x6100000, Top = 0x6108000, Size = 32768
Name = Media.dll, Base = 0x6110000, Top = 0x6119000, Size = 36864
Name = Memory.dll, Base = 0x6120000, Top = 0x612B000, Size = 45056
Name = Msg.dll, Base = 0x6130000, Top = 0x613B000, Size = 45056
Name = Net.dll, Base = 0x6140000, Top = 0x6147000, Size = 28672
Name = MSVBVM60.DLL, Base = 0x72940000, Top = 0x72A93000, Size = 1388544
Name = Office.dll, Base = 0x6150000, Top = 0x6159000, Size = 36864
Name = Oracle.dll, Base = 0x6160000, Top = 0x616B000, Size = 45056
Name = Pic.dll, Base = 0x6170000, Top = 0x6178000, Size = 32768
Name = SQLServer.dll, Base = 0x6190000, Top = 0x619B000, Size = 45056
Name = Sys.dll, Base = 0x61A0000, Top = 0x61A9000, Size = 36864
Name = Web.dll, Base = 0x61B0000, Top = 0x61BF000, Size = 61440
Name = Window.dll, Base = 0x61C0000, Top = 0x61CC000, Size = 49152
Name = ntmarta.dll, Base = 0x74950000, Top = 0x74971000, Size = 135168
Name = WLDAP32.dll, Base = 0x74B60000, Top = 0x74BA5000, Size = 282624
Code Before:
F9 03 00 85 C0 74 0B 8B 10 8B C8 8B 42 74 FF D0 EB 02 33 C0
Current Code:
8B 48 20 56 8B 35 A0 B9 7E 00 6A 00 68 27 80 00 00 68 11 01
Call Stack:
00531A90 ===> 琿??BY.exe
Current Stack:
[0018FC0C] = 00536C68
[0018FC10] = 00000000
[0018FC14] = 00000000
[0018FC18] = A2B7D596
[0018FC1C] = 000007F0
[0018FC20] = 0635FFB0
[0018FC24] = 01562FC8
[0018FC28] = 74D90230
[0018FC2C] = 00000020
[0018FC30] = 0018FC98
[0018FC34] = 74D26D91
[0018FC38] = 74D26D51
[0018FC3C] = A2997D32
[0018FC40] = 00008002
[0018FC44] = 6746CE10
[0018FC48] = 00000000
[0018FC4C] = 00000024
[0018FC50] = 00000001
[0018FC54] = 0018FDD4
[0018FC58] = 01565F24
[0018FC5C] = 00000070
[0018FC60] = FFE7022B
[0018FC64] = FEA9A0DB
[0018FC68] = 74D26CE9
[0018FC6C] = 74D26D91
[0018FC70] = 0C8C9FC8
[0018FC74] = 00000007
[0018FC78] = 00000000
[0018FC7C] = 000506CE
[0018FC80] = 00000000
[0018FC84] = 0018FCD8
[0018FC88] = 0018FD68
[0018FC8C] = 74D8A61E
[0018FC90] = 00000000
[0018FC94] = 00AB4820
[0018FC98] = 01562FC8
[0018FC9C] = 00AB483C
[0018FCA0] = 00AB4820
[0018FCA4] = 0018FCBC
[0018FCA8] = 00AB2D48
[0018FCAC] = 7FFFFFFF
[0018FCB0] = 00000000
[0018FCB4] = 0018FD48
[0018FCB8] = 007C87CE
[0018FCBC] = 00000000
[0018FCC0] = 0018FCE0
[0018FCC4] = 00531A90
[0018FCC8] = 000007F0
[0018FCCC] = 00000000
[0018FCD0] = 00A9AB80
[0018FCD4] = 0018FCDC
[0018FCD8] = 0635FFB0
[0018FCDC] = 00000000
[0018FCE0] = 0018FD54
[0018FCE4] = 00534F83
[0018FCE8] = 000007F0
[0018FCEC] = 00000000
[0018FCF0] = 00000000
[0018FCF4] = A2B7D402
[0018FCF8] = 00000000
[0018FCFC] = 000E05D6
[0018FD00] = 00000000
[0018FD04] = 00000000
[0018FD08] = 00000000
[0018FD0C] = 00000000
[0018FD10] = 00000000
[0018FD14] = 00000000
[0018FD18] = 00000000
[0018FD1C] = 00000000
[0018FD20] = 007CF75E
[0018FD24] = FFFFFFFF
[0018FD28] = 01562FC8
[0018FD2C] = 00000000
[0018FD30] = 00000000
[0018FD34] = 00000000
[0018FD38] = 00000000
[0018FD3C] = 00000000
[0018FD40] = A2B7D402
[0018FD44] = 0018FCF4
[0018FD48] = 0018FE08
[0018FD4C] = 007C8692
[0018FD50] = 00000000
[0018FD54] = 0018FD74
[0018FD58] = 00535012
[0018FD5C] = 0635FFB0
[0018FD60] = 000E05D6
[0018FD64] = 000007F0
[0018FD68] = 00000000
[0018FD6C] = 00000000
[0018FD70] = 00534FDC
[0018FD74] = 0018FDA0
[0018FD78] = 74D262FA
[0018FD7C] = 000E05D6
[0018FD80] = 000007F0
[0018FD84] = 00000000
[0018FD88] = 00000000
[0018FD8C] = 00534FDC
[0018FD90] = DCBAABCD
[0018FD94] = 00000000
[0018FD98] = 00000000
[0018FD9C] = 00534FDC
[0018FDA0] = 0018FE18
[0018FDA4] = 74D26D3A
[0018FDA8] = 00534FDC
[0018FDAC] = 000E05D6
[0018FDB0] = 000007F0
[0018FDB4] = 00000000
[0018FDB8] = 00000000
[0018FDBC] = A2997FB2
[0018FDC0] = 01563000
[0018FDC4] = 01562FF8
[0018FDC8] = 01F25530
[0018FDCC] = 00000024
[0018FDD0] = 00000001
[0018FDD4] = 00000000
[0018FDD8] = 01565F24
[0018FDDC] = 00000020
[0018FDE0] = FFFFFFFF
[0018FDE4] = FEA9A0DB
[0018FDE8] = 74D26CE9
[0018FDEC] = 00000000
[0018FDF0] = 00170578
[0018FDF4] = 00000001
[0018FDF8] = 00000000
[0018FDFC] = 00000000
[0018FE00] = 0018FDBC
[0018FE04] = 0018F658
[0018FE08] = 0018FE68
[0018FE0C] = 74D8A61E
[0018FE10] = D653ECF2
[0018FE14] = 00000000
[0018FE18] = 0018FE78
[0018FE1C] = 74D277C4
[0018FE20] = 01565F24
[0018FE24] = 00534FDC
[0018FE28] = 000E05D6
[0018FE2C] = 000007F0
[0018FE30] = 00000000
[0018FE34] = 00000000
[0018FE38] = 01F25558
[0018FE3C] = 00000001
[0018FE40] = A2997FD2
[0018FE44] = 01562FF8
[0018FE48] = 01562FC8
[0018FE4C] = 01562FF8
[0018FE50] = 01562FF8
[0018FE54] = 00000000
[0018FE58] = 00000000
[0018FE5C] = 0052F4D7
[0018FE60] = 0018FE40
[0018FE64] = 0018F658
[0018FE68] = 0018FF4C
[0018FE6C] = 74D8A61E
[0018FE70] = D653F642
[0018FE74] = FFFFFFFE
[0018FE78] = 0018FE88
[0018FE7C] = 74D27BCA
[0018FE80] = 00534FDC
[0018FE84] = 00000001
[0018FE88] = 0018FEB8
[0018FE8C] = 0052F717
[0018FE90] = 01562FF8
[0018FE94] = 00000000
[0018FE98] = 00AADC30
[0018FE9C] = 0052F3A5
[0018FEA0] = 00AADC30
[0018FEA4] = 00AADC30
[0018FEA8] = FFFFFFFF
[0018FEAC] = 01562FC8
[0018FEB0] = 00000000
[0018FEB4] = 00000001
[0018FEB8] = 0018FECC
[0018FEBC] = 007A6E4C
[0018FEC0] = FF776000
[0018FEC4] = 00000000
[0018FEC8] = 0018FF5C
[0018FECC] = 0018FF5C
[0018FED0] = 006597EC
[0018FED4] = 00400000
[0018FED8] = 00000000
[0018FEDC] = 014B2C77
[0018FEE0] = 0000000A
[0018FEE4] = A2B7D60A
[0018FEE8] = FF776000
[0018FEEC] = 00000000
[0018FEF0] = 0018FF5C
[0018FEF4] = 00000044
[0018FEF8] = 014B1AF4
[0018FEFC] = 014B1AD4
[0018FF00] = 014B1A60
[0018FF04] = 00000000
[0018FF08] = 00000000
[0018FF0C] = 00000000
[0018FF10] = 00000000
[0018FF14] = 00000000
[0018FF18] = 00000000
[0018FF1C] = 00000000
[0018FF20] = 00000000
[0018FF24] = 00000000
[0018FF28] = 00000000
试一试@用户名 立即召唤神龙 小伙伴会收到通知喔：）无需加好友即可通知到