EAX=00E1FDDC EBX=BFF7427F ECX=0000000D EDX=78037174 ESI=8162687B |
EDI=00000000 EBP=00E1FE38 ESP=00E1FDAC EIP=00F64C10 o d I s Z a P c |
CS=0167 DS=016F SS=016F ES=016F FS=386F GS=37F6 |
-------------------------------------------------------------------------PROT32- |
0167:00F641C6 F5 CMC ^ |
0167:00F641C7 BFBF24F5BF MOV EDI,USER32!PostQuitMessage ^ |
0167:00F641CC A4 MOVSB |
0167:00F641CD 20F5 AND CH,DH |
0167:00F641CF BF3658F5BF MOV EDI,USER32!SendMessageA |
0167:00F641D4 204FF6 AND [EDI-0A],CL |
0167:00F641D7 0030 ADD [EAX],DH |
0167:00F641D9 42 INC EDX |
0167:00F641DA F60000 TEST BYTE PTR [EAX],00 |
0167:00F641DD 0000 ADD [EAX],AL |
0167:00F641DF 00FF ADD BH,BH |
0167:00F641E1 250041F600 AND EAX,USER32!wvsprintfA |
0167:00F641E6 FF250441F600 JMP [USER32!SetCursorPos] |
0167:00F641EC FF250841F600 JMP [USER32!GetForegroundWindow] |
0167:00F641F2 FF250C41F600 JMP [USER32!LoadCursorA] |
0167:00F641F8 FF251041F600 JMP [USER32!GetDesktopWindow] v |
0167:00F641FE FF251441F600 JMP [USER32!ShowCursor] < > v |
-------------------------------------------------------------------------------- |
WINICE: Load32 Obj=0004 Add=016F:7FBDC000 Len=00001000 Mod=RPCRT4 |
WINICE: Load32 Obj=0005 Add=016F:7FBDD000 Len=00001000 Mod=RPCRT4 |
WINICE: Load32 Obj=0006 Add=016F:7FBDE000 Len=00001000 Mod=RPCRT4 |
WINICE: Load32 Obj=0007 Add=016F:7FBDF000 Len=00003000 Mod=RPCRT4 |
Break due to BPX #0167:004F5E60 (ET=753.08 milliseconds) |
:bc* |
:lines 35 |
:codeon |
:pagein n |
Screen dumper set to mode 2 |
:pagein n c:\user.html |
|
PAGEIN address Wa |