date/time         : 2011-06-26, 02:06:53, 953ms
computer name     : 20110625-1633
user name         : Administrator <admin>
registered owner  : ΢û / ΢й
operating system  : Windows XP Service Pack 3 (5.1.2600) build 2600
system language   : Chinese
system up time    : 6 hours 19 minutes
program up time   : 3 hours 52 minutes
processors        : 2x Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz
physical memory   : 1600/2046 MB (free/total)
free disk space   : (C:) 17.79 GB (F:) 48.16 GB
display mode      : 1280x800, 32 bit
process id        : $1048
allocated memory  : 18.23 MB
executable        : FlashFXP.exe
exec. date/time   : 2011-03-08 22:10
executable hash   : EBF9591E30DAFE2A9F8E05B39F791BAC
version           : 4.0.0.1543
language          : chinese simplified
callstack crc     : $eb093fce, $638e1169, $638e1169
count             : 2
exception number  : 2
exception class   : EAccessViolation
exception message : Access violation at address 004D0D25 in module 'FlashFXP.exe'. ȡ of address 0000002C.

main thread ($104c):
004d0d25 +0035 FlashFXP.exe IniFiles32  937   +7 TIniFile32.ReadString
00706d6b +0083 FlashFXP.exe Update      875   +3 TFrmUpdate.FormDestroy
00445c7d +0031 FlashFXP.exe Forms      2755   +3 TCustomForm.DoDestroy
00445ae1 +005d FlashFXP.exe Forms      2719   +7 TCustomForm.BeforeDestruction
00403771 +0009 FlashFXP.exe System               @BeforeDestruction
00445aee +0006 FlashFXP.exe Forms      2723   +0 TCustomForm.Destroy
0041c412 +001e FlashFXP.exe Classes              TComponent.DestroyComponents
0041c24a +004e FlashFXP.exe Classes              TComponent.Destroy
00452059 +0095 FlashFXP.exe Controls             TControl.Destroy
00454f13 +00bb FlashFXP.exe Controls             TWinControl.Destroy
00444f30 +0028 FlashFXP.exe Forms      2259   +3 TScrollingWinControl.Destroy
00445b9f +00b7 FlashFXP.exe Forms      2734  +11 TCustomForm.Destroy
0041c412 +001e FlashFXP.exe Classes              TComponent.DestroyComponents
004436cb +002f FlashFXP.exe Forms      1261   +3 DoneApplication
0040a9be +0026 FlashFXP.exe SysUtils             DoExitProc
00403f50 +0028 FlashFXP.exe System               @Halt0
007992b7 +1ccb FlashFXP.exe FlashFXP    940 +650 initialization

thread $460:
7c92df58 +00a ntdll.dll              NtWaitForSingleObject
7c8025d5 +085 kernel32.dll           WaitForSingleObjectEx
7c80253d +00d kernel32.dll           WaitForSingleObject
004bd48d +ed1 FlashFXP.exe madExcept Ebp
004bd4fc +f40 FlashFXP.exe madExcept Ebp
>> created by thread $a1c at:
71a2d374 +000 WS2_32.dll

thread $120c: <priority:1>
7c92da48 +00a ntdll.dll              NtRemoveIoCompletion
004bd48d +ed1 FlashFXP.exe madExcept Ebp
004bd4f7 +f3b FlashFXP.exe madExcept Ebp
>> created by thread $a1c at:
719cd926 +000 mswsock.dll

modules:
00400000 FlashFXP.exe          4.0.0.1543       F:\FlashFXP
01010000 safemon.dll           6.8.2.1010       C:\Program Files\360\360Safe\safemon
03010000 ssleay32.dll          1.0.0.4          F:\FlashFXP
07160000 audiodev.dll          5.2.5721.5262    C:\WINDOWS\system32
10000000 libeay32.dll          1.0.0.4          F:\FlashFXP
10930000 PortableDeviceApi.dll 5.2.5721.5262    C:\WINDOWS\system32
11c70000 WMASF.DLL             11.0.5721.5262   C:\WINDOWS\system32
15110000 WMVCore.DLL           11.0.5721.5275   C:\WINDOWS\system32
16500000 wpdshext.dll          5.2.5721.5262    C:\WINDOWS\system32
1f840000 odbcint.dll           3.525.1117.0     C:\WINDOWS\system32
4ae90000 gdiplus.dll           5.2.6002.22509   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22509_x-ww_c7dad023
5adc0000 uxtheme.dll           6.0.2900.5512    C:\WINDOWS\system32
5efe0000 olepro32.dll          5.1.2600.5512    C:\WINDOWS\system32
5fdd0000 NETAPI32.dll          5.1.2600.5694    C:\WINDOWS\system32
60fd0000 hnetcfg.dll           5.1.2600.5512    C:\WINDOWS\system32
62c20000 LPK.DLL               5.1.2600.5512    C:\WINDOWS\system32
68000000 rsaenh.dll            5.1.2600.5507    C:\WINDOWS\system32
68100000 dssenh.dll            5.1.2600.5507    C:\WINDOWS\system32
719c0000 mswsock.dll           5.1.2600.5625    C:\WINDOWS\system32
71a00000 wshtcpip.dll          5.1.2600.5512    C:\WINDOWS\System32
71a10000 WS2HELP.dll           5.1.2600.5512    C:\WINDOWS\system32
71a20000 WS2_32.dll            5.1.2600.5512    C:\WINDOWS\system32
71a40000 wsock32.dll           5.1.2600.5512    C:\WINDOWS\system32
71a90000 MPR.dll               5.1.2600.5512    C:\WINDOWS\system32
71b70000 SAMLIB.dll            5.1.2600.5512    C:\WINDOWS\system32
71b90000 ntlanman.dll          5.1.2600.5512    C:\WINDOWS\System32
71c00000 NETRAP.dll            5.1.2600.5512    C:\WINDOWS\System32
71c10000 NETUI1.dll            5.1.2600.5512    C:\WINDOWS\System32
71c50000 NETUI0.dll            5.1.2600.5512    C:\WINDOWS\System32
72240000 sensapi.dll           5.1.2600.5512    C:\WINDOWS\system32
72f70000 winspool.drv          5.1.2600.5512    C:\WINDOWS\system32
73540000 ODBC32.dll            3.525.3012.0     C:\WINDOWS\system32
73640000 msctfime.ime          5.1.2600.5768    C:\WINDOWS\system32
73ce0000 shgina.dll            6.0.2900.5512    C:\WINDOWS\system32
73fa0000 USP10.dll             1.420.2600.5969  C:\WINDOWS\system32
74680000 MSCTF.dll             5.1.2600.5512    C:\WINDOWS\system32
75430000 CRYPTUI.dll           5.131.2600.5512  C:\WINDOWS\system32
758d0000 MSGINA.dll            5.1.2600.5512    C:\WINDOWS\system32
759d0000 USERENV.dll           5.1.2600.5512    C:\WINDOWS\system32
75ed0000 drprov.dll            5.1.2600.5512    C:\WINDOWS\System32
75ee0000 davclnt.dll           5.1.2600.5512    C:\WINDOWS\System32
75ef0000 browseui.dll          6.0.2900.6104    C:\WINDOWS\system32
75ff0000 MSVCP60.dll           6.2.3104.0       C:\WINDOWS\system32
76060000 SETUPAPI.dll          5.1.2600.5512    C:\WINDOWS\system32
762d0000 WINSTA.dll            5.1.2600.5512    C:\WINDOWS\system32
76300000 IMM32.DLL             5.1.2600.5512    C:\WINDOWS\system32
76320000 comdlg32.dll          6.0.2900.5512    C:\WINDOWS\system32
765e0000 crypt32.dll           5.131.2600.5512  C:\WINDOWS\system32
76680000 WININET.dll           6.0.2900.6104    C:\WINDOWS\system32
76760000 cryptdll.dll          5.1.2600.5512    C:\WINDOWS\system32
76950000 LINKINFO.dll          5.1.2600.5512    C:\WINDOWS\system32
76960000 ntshrui.dll           5.1.2600.5512    C:\WINDOWS\system32
76990000 ole32.dll             5.1.2600.6010    C:\WINDOWS\system32
76af0000 ATL.DLL               3.5.2284.2       C:\WINDOWS\system32
76b10000 winmm.dll             5.1.2600.5512    C:\WINDOWS\system32
76bc0000 PSAPI.DLL             5.1.2600.5512    C:\WINDOWS\system32
76c00000 WINTRUST.dll          5.131.2600.5922  C:\WINDOWS\system32
76c60000 IMAGEHLP.dll          5.1.2600.5512    C:\WINDOWS\system32
76d30000 iphlpapi.dll          5.1.2600.5512    C:\WINDOWS\system32
76d70000 appHelp.dll           5.1.2600.5512    C:\WINDOWS\system32
76db0000 MSASN1.dll            5.1.2600.5875    C:\WINDOWS\system32
76e50000 rtutils.dll           5.1.2600.5512    C:\WINDOWS\system32
76e60000 rasman.dll            5.1.2600.5512    C:\WINDOWS\system32
76e80000 TAPI32.dll            5.1.2600.5512    C:\WINDOWS\system32
76eb0000 RASAPI32.DLL          5.1.2600.5512    C:\WINDOWS\system32
76ef0000 DNSAPI.dll            5.1.2600.6089    C:\WINDOWS\system32
76f30000 WLDAP32.dll           5.1.2600.5512    C:\WINDOWS\system32
76f80000 winrnr.dll            5.1.2600.5512    C:\WINDOWS\System32
76f90000 rasadhlp.dll          5.1.2600.5512    C:\WINDOWS\system32
76fa0000 CLBCATQ.DLL           2001.12.4414.700 C:\WINDOWS\system32
77020000 COMRes.dll            2001.12.4414.700 C:\WINDOWS\system32
770f0000 oleaut32.dll          5.1.2600.6058    C:\WINDOWS\system32
77180000 comctl32.dll          6.0.2900.6028    C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202
77bd0000 version.dll           5.1.2600.5512    C:\WINDOWS\system32
77be0000 msvcrt.dll            7.0.2600.5512    C:\WINDOWS\system32
77c40000 msv1_0.dll            5.1.2600.5876    C:\WINDOWS\system32
77d10000 user32.dll            5.1.2600.5512    C:\WINDOWS\system32
77da0000 advapi32.dll          5.1.2600.5755    C:\WINDOWS\system32
77e50000 RPCRT4.dll            5.1.2600.6022    C:\WINDOWS\system32
77ef0000 GDI32.dll             5.1.2600.5698    C:\WINDOWS\system32
77f40000 SHLWAPI.dll           6.0.2900.5912    C:\WINDOWS\system32
77fc0000 Secur32.dll           5.1.2600.5834    C:\WINDOWS\system32
7c800000 kernel32.dll          5.1.2600.5781    C:\WINDOWS\system32
7c920000 ntdll.dll             5.1.2600.6055    C:\WINDOWS\system32
7d590000 shell32.dll           6.0.2900.6018    C:\WINDOWS\system32
7e550000 shdocvw.dll           6.0.2900.6104    C:\WINDOWS\system32

processes:
0000 Idle                0   0
0004 System              0   0   normal
02b0 smss.exe            0   0   normal C:\WINDOWS\system32
0318 csrss.exe           0   0
0338 winlogon.exe        46  14  high   C:\WINDOWS\system32
0364 services.exe        4   2   normal C:\WINDOWS\system32
0370 lsass.exe           6   3   normal C:\WINDOWS\system32
0408 svchost.exe         4   1   normal C:\WINDOWS\system32
0450 svchost.exe         0   0
0484 svchost.exe         11  26  normal C:\WINDOWS\System32
04bc svchost.exe         0   0
0538 svchost.exe         0   0
0560 zhudongfangyu.exe   4   4   normal C:\Program Files\360\360Safe\deepscan
0604 spoolsv.exe         4   4   normal C:\WINDOWS\system32
06e8 Explorer.EXE        419 237 normal C:\WINDOWS
0754 WDKeyMonitorABC.exe 21  9   normal C:\WINDOWS\system32\ABC\ABC SAFE CSP v3.2
0778 SddSUpdate.exe      4   1   normal C:\Program Files\SddSUpdate
07c0 liveupdsrv.exe      47  39  normal C:\Program Files\ʢ\ʢ
07f8 svchost.exe         4   2   normal C:\WINDOWS\system32
010c 360Tray.exe         211 78  normal C:\Program Files\360\360Safe\safemon
0190 ctfmon.exe          28  12  normal C:\WINDOWS\system32
09ec svchost.exe         4   1   normal C:\WINDOWS\system32
1048 FlashFXP.exe        159 89  normal F:\FlashFXP
0dfc msiexec.exe         4   3   normal C:\WINDOWS\system32
1004 iexplore.exe        171 117 normal C:\Program Files\Internet Explorer

hardware:
+ Bluetooth Devices
  - Broadcom Bluetooth Device (driver 3.0.1.169)
+ DVD/CD-ROM 
  - TSSTcorp CDDVDW TS-L632H
  - Wdabc Autorun CDROM USB Device
+ IDE ATA/ATAPI 
  - AMD PCI IDE Controller (driver 5.1.0.8)
  - AMD SATA Controller(Native IDE Mode) (driver 5.1.0.8)
  - Ҫ IDE ͨ
  - Ҫ IDE ͨ
  - Ҫ IDE ͨ
  - Ҫ IDE ͨ
+ 
  - Intel(R) Pentium(R) Dual  CPU  T2390  @ 1.86GHz
  - Intel(R) Pentium(R) Dual  CPU  T2390  @ 1.86GHz
+ 
  - Multi Flash Reader USB Device
  - WDC WD1600BEVS-22RST0
+ 
  - Microsoft AC Adapter
  - Microsoft ACPI-Compliant Control Method Battery
+ ƽ
  - Agere Systems HDA Modem (driver 2.1.87.1)
+ 
  - 弴ü
  - Ĭϼ
  - Ĭϼ
+ 
  - ACPI Multiprocessor PC
+ 
  - Standard 101/102-Key or Microsoft Natural PS/2 Keyboard with HP QLB (driver 1.0.0.1)
+ ѧ豸
  - USB ѧ豸
+ ƵϷ
  - Realtek High Definition Audio (driver 5.10.0.6132)
  - ͳƵ׽豸
  - ͳƵ
  - ý豸
  - Ƶ
  - Ƶ
+ ָ豸
  - HID-compliant mouse
  - PS/2 Compatible Mouse
+ ͨô߿
  - Standard Enhanced PCI to USB Host Controller
  - Standard OpenHCD USB Host Controller
  - Standard OpenHCD USB Host Controller
  - Standard OpenHCD USB Host Controller
  - Standard OpenHCD USB Host Controller
  - Standard OpenHCD USB Host Controller
  - USB Mass Storage Device
  - USB Mass Storage Device
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
+ 
  - Atheros AR5007EG Wireless Network Adapter (driver 7.7.0.523)
  - Realtek RTL8139/810x Family Fast Ethernet NIC (driver 5.719.325.2009)
+ ϵͳ豸
  - ACPI Fan
  - ACPI Fixed Feature Button
  - ACPI Lid
  - ACPI Power Button
  - ACPI Sleep Button
  - ACPI Thermal Zone
  - ACPI Thermal Zone
  - ATI SMBus (driver 5.10.1000.8)
  - Direct memory access controller
  - ISAPNP Read Data Port
  - Logical Disk Manager
  - Microcode Update Device
  - Microsoft ACPI-Compliant Embedded Controller
  - Microsoft ACPI-Compliant System
  - Microsoft Composite Battery
  - Microsoft System Management BIOS Driver
  - Microsoft  High Definition Audio  UAA 
  - Motherboard resources
  - Motherboard resources
  - Numeric data processor
  - PCI bus
  - PCI standard host CPU bridge
  - PCI standard ISA bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - Plug and Play Software Device Enumerator
  - Programmable interrupt controller
  - System board
  - System CMOS/real time clock
  - System speaker
  - System timer
  - Terminal Server Device Redirector
  - Terminal Server Keyboard Driver
  - Terminal Server Mouse Driver
  - Volume Manager
  - ̨ȫʾƵ
+ ʾ
  - ATI Mobility Radeon X2300 (driver 8.591.0.0)

cpu registers:
eax = 00000000
ebx = 00000000
ecx = 00f611f4
edx = 0132f400
esi = 00000001
edi = 004a8244
eip = 004d976c
esp = 0012ef2c
ebp = 0012ef50

stack dump:
0012ef2c  05 5e 40 00 5c ef 12 00 - c8 f0 12 00 14 02 00 00  .^@.\...........
0012ef3c  50 f0 12 00 01 00 00 00 - ec 3e b2 02 00 00 00 00  P........>......
0012ef4c  60 ef f1 00 a8 ef 12 00 - d7 c0 00 00 d7 c0 00 00  `...............
0012ef5c  50 f0 12 00 00 00 00 00 - d4 00 00 00 09 00 00 00  P...............
0012ef6c  13 01 00 00 00 00 00 00 - 00 00 00 00 01 00 00 00  ................
0012ef7c  d9 8b d1 77 88 10 d7 77 - d7 c0 00 00 00 00 00 00  ...w...w........
0012ef8c  5a df 92 7c db 25 80 7c - 14 02 00 00 00 00 00 00  Z..|.%.|........
0012ef9c  00 00 00 00 44 82 4a 00 - 01 00 00 00 01 00 00 00  ....D.J.........
0012efac  14 00 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00  ................
0012efbc  10 00 00 00 2a 26 80 7c - d8 ef 12 00 00 50 fd 7f  ....*&.|.....P..
0012efcc  00 f0 fd 7f 00 00 00 00 - 00 00 00 00 a0 ef 12 00  ................
0012efdc  01 00 00 00 40 f0 12 00 - d8 9a 83 7c 08 26 80 7c  ....@......|.&.|
0012efec  00 00 00 00 04 f0 12 00 - 42 25 80 7c 14 02 00 00  ........B%.|....
0012effc  ff ff ff ff 00 00 00 00 - 24 f0 12 00 b6 8a 4a 00  ........$.....J.
0012f00c  14 02 00 00 ff ff ff ff - 01 00 00 00 01 00 00 00  ................
0012f01c  00 00 00 00 2a da 92 7c - 30 f0 12 00 4f 82 4a 00  ....*..|0...O.J.
0012f02c  00 00 00 00 60 f0 12 00 - 9a e1 48 00 5c f0 12 00  ....`.....H.\...
0012f03c  00 00 00 00 e4 f0 12 00 - da e1 48 00 60 f0 12 00  ..........H.`...
0012f04c  c8 f0 12 00 50 e0 48 00 - 00 00 00 00 78 1f fa 00  ....P.H.....x...
0012f05c  00 00 00 00 8c f0 12 00 - 34 87 d1 77 bc 00 07 00  ........4..w....

disassembling:
004d0cf0     public IniFiles32.TIniFile32.ReadString:  ; function entry point
004d0cf0 930   push    ebp
004d0cf1       mov     ebp, esp
004d0cf3       push    0
004d0cf5       push    0
004d0cf7       push    0
004d0cf9       push    0
004d0cfb       push    ebx
004d0cfc       push    esi
004d0cfd       push    edi
004d0cfe       mov     [ebp-4], ecx
004d0d01       mov     esi, edx
004d0d03       mov     ebx, eax
004d0d05       xor     eax, eax
004d0d07       push    ebp
004d0d08       push    $4d0e03                ; System.@HandleFinally
004d0d0d       push    dword ptr fs:[eax]
004d0d10       mov     fs:[eax], esp
004d0d13 935   mov     eax, ebx
004d0d15       call    +$118e ($4d1ea8)       ; IniFiles32.TIniFile32.Reload
004d0d1a 936   mov     eax, [ebp+8]
004d0d1d       mov     edx, [ebp+$c]
004d0d20       call    -$ccbb1 ($404174)      ; System.@LStrLAsg
004d0d25 937 > mov     eax, [ebx+$2c]
004d0d28       mov     edx, [eax]
004d0d2a       call    dword ptr [edx+$14]
004d0d2d       test    eax, eax
004d0d2f       jle     loc_4d0de8
004d0d35 939   mov     edx, esi
004d0d37       mov     eax, ebx
004d0d39       call    -$f56 ($4cfde8)        ; IniFiles32.TIniFile32.GetSectionIndex
004d0d3e       mov     esi, eax
004d0d40 940   cmp     esi, -1
004d0d43       jz      loc_4d0de8
004d0d49 942   inc     esi
004d0d4a       jmp     loc_4d0dbd
004d0d4c 945   lea     ecx, [ebp-$c]
004d0d4f       mov     edx, esi
004d0d51       mov     eax, [ebx+$2c]
004d0d54       mov     edi, [eax]
004d0d56       call    dword ptr [edi+$c]
004d0d59       mov     edx, [ebp-$c]
004d0d5c       lea     ecx, [ebp-$10]
004d0d5f       mov     eax, ebx
[...]

date/time         : 2011-06-26, 02:06:54, 921ms
computer name     : 20110625-1633
user name         : Administrator <admin>
registered owner  : ΢û / ΢й
operating system  : Windows XP Service Pack 3 (5.1.2600) build 2600
system language   : Chinese
system up time    : 6 hours 19 minutes
program up time   : 3 hours 52 minutes
processors        : 2x Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz
physical memory   : 1601/2046 MB (free/total)
free disk space   : (C:) 17.79 GB (F:) 48.16 GB
display mode      : 1280x800, 32 bit
process id        : $1048
allocated memory  : 20.25 MB
executable        : FlashFXP.exe
exec. date/time   : 2011-03-08 22:10
executable hash   : EBF9591E30DAFE2A9F8E05B39F791BAC
version           : 4.0.0.1543
language          : chinese simplified
callstack crc     : $12a5b57a, $3b1f1de4, $21a59b30
exception number  : 3
exception class   : EInvalidPointer
exception message : Invalid pointer operation.

main thread ($104c):
004033a6 +0022 FlashFXP.exe System             TObject.FreeInstance
00402af6 +000e FlashFXP.exe System             Error
0040375a +0002 FlashFXP.exe System             @ClassDestroy
00423b3e +001e FlashFXP.exe Graphics           TFont.Destroy
004033e4 +0008 FlashFXP.exe System             TObject.Free
004247a7 +0023 FlashFXP.exe Graphics           TCanvas.Destroy
00451999 +0019 FlashFXP.exe Controls           TControlCanvas.Destroy
004033e4 +0008 FlashFXP.exe System             TObject.Free
00445b67 +007f FlashFXP.exe Forms    2730   +7 TCustomForm.Destroy
0041c412 +001e FlashFXP.exe Classes            TComponent.DestroyComponents
0041c24a +004e FlashFXP.exe Classes            TComponent.Destroy
00452059 +0095 FlashFXP.exe Controls           TControl.Destroy
00454f13 +00bb FlashFXP.exe Controls           TWinControl.Destroy
00444f30 +0028 FlashFXP.exe Forms    2259   +3 TScrollingWinControl.Destroy
00445b9f +00b7 FlashFXP.exe Forms    2734  +11 TCustomForm.Destroy
0041c412 +001e FlashFXP.exe Classes            TComponent.DestroyComponents
004436cb +002f FlashFXP.exe Forms    1261   +3 DoneApplication
0040a9be +0026 FlashFXP.exe SysUtils           DoExitProc
00403f50 +0028 FlashFXP.exe System             @Halt0
007992b7 +1ccb FlashFXP.exe FlashFXP  940 +650 initialization

thread $460:
7c92df58 +00a ntdll.dll              NtWaitForSingleObject
7c8025d5 +085 kernel32.dll           WaitForSingleObjectEx
7c80253d +00d kernel32.dll           WaitForSingleObject
004bd48d +ed1 FlashFXP.exe madExcept Ebp
004bd4fc +f40 FlashFXP.exe madExcept Ebp
>> created by thread $a1c at:
71a2d374 +000 WS2_32.dll

thread $120c: <priority:1>
7c92da48 +00a ntdll.dll              NtRemoveIoCompletion
004bd48d +ed1 FlashFXP.exe madExcept Ebp
004bd4f7 +f3b FlashFXP.exe madExcept Ebp
>> created by thread $a1c at:
719cd926 +000 mswsock.dll

thread $1220 (THttpPostThread):
7c92df58 +00a ntdll.dll                       NtWaitForSingleObject
7c8025d5 +085 kernel32.dll                    WaitForSingleObjectEx
7c80253d +00d kernel32.dll                    WaitForSingleObject
00432cc0 +048 FlashFXP.exe EnhFunc    4162 +7 GetHttpProxyServer
004c03af +0ef FlashFXP.exe FDhttpPost         HTTPPostBugReport
004c001a +006 FlashFXP.exe FDhttpPost         THttpPostThread.Execute
0041bfcc +230 FlashFXP.exe Classes            HexToBin
00404080 +028 FlashFXP.exe System             ThreadWrapper
004bd48d +ed1 FlashFXP.exe madExcept          Ebp
004bd4fc +f40 FlashFXP.exe madExcept          Ebp
>> created by thread $11a0 at:
004bffda +01e FlashFXP.exe FDhttpPost         THttpPostThread.Create

modules:
00400000 FlashFXP.exe          4.0.0.1543       F:\FlashFXP
01010000 safemon.dll           6.8.2.1010       C:\Program Files\360\360Safe\safemon
03010000 ssleay32.dll          1.0.0.4          F:\FlashFXP
07160000 audiodev.dll          5.2.5721.5262    C:\WINDOWS\system32
10000000 libeay32.dll          1.0.0.4          F:\FlashFXP
10930000 PortableDeviceApi.dll 5.2.5721.5262    C:\WINDOWS\system32
11c70000 WMASF.DLL             11.0.5721.5262   C:\WINDOWS\system32
15110000 WMVCore.DLL           11.0.5721.5275   C:\WINDOWS\system32
16500000 wpdshext.dll          5.2.5721.5262    C:\WINDOWS\system32
1f840000 odbcint.dll           3.525.1117.0     C:\WINDOWS\system32
4ae90000 gdiplus.dll           5.2.6002.22509   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22509_x-ww_c7dad023
5adc0000 uxtheme.dll           6.0.2900.5512    C:\WINDOWS\system32
5efe0000 olepro32.dll          5.1.2600.5512    C:\WINDOWS\system32
5fdd0000 NETAPI32.dll          5.1.2600.5694    C:\WINDOWS\system32
60fd0000 hnetcfg.dll           5.1.2600.5512    C:\WINDOWS\system32
62c20000 LPK.DLL               5.1.2600.5512    C:\WINDOWS\system32
68000000 rsaenh.dll            5.1.2600.5507    C:\WINDOWS\system32
68100000 dssenh.dll            5.1.2600.5507    C:\WINDOWS\system32
719c0000 mswsock.dll           5.1.2600.5625    C:\WINDOWS\system32
71a00000 wshtcpip.dll          5.1.2600.5512    C:\WINDOWS\System32
71a10000 WS2HELP.dll           5.1.2600.5512    C:\WINDOWS\system32
71a20000 WS2_32.dll            5.1.2600.5512    C:\WINDOWS\system32
71a40000 wsock32.dll           5.1.2600.5512    C:\WINDOWS\system32
71a90000 MPR.dll               5.1.2600.5512    C:\WINDOWS\system32
71b70000 SAMLIB.dll            5.1.2600.5512    C:\WINDOWS\system32
71b90000 ntlanman.dll          5.1.2600.5512    C:\WINDOWS\System32
71c00000 NETRAP.dll            5.1.2600.5512    C:\WINDOWS\System32
71c10000 NETUI1.dll            5.1.2600.5512    C:\WINDOWS\System32
71c50000 NETUI0.dll            5.1.2600.5512    C:\WINDOWS\System32
72240000 sensapi.dll           5.1.2600.5512    C:\WINDOWS\system32
72f70000 winspool.drv          5.1.2600.5512    C:\WINDOWS\system32
73540000 ODBC32.dll            3.525.3012.0     C:\WINDOWS\system32
73640000 msctfime.ime          5.1.2600.5768    C:\WINDOWS\system32
73ce0000 shgina.dll            6.0.2900.5512    C:\WINDOWS\system32
73fa0000 USP10.dll             1.420.2600.5969  C:\WINDOWS\system32
74680000 MSCTF.dll             5.1.2600.5512    C:\WINDOWS\system32
75430000 CRYPTUI.dll           5.131.2600.5512  C:\WINDOWS\system32
758d0000 MSGINA.dll            5.1.2600.5512    C:\WINDOWS\system32
759d0000 USERENV.dll           5.1.2600.5512    C:\WINDOWS\system32
75ed0000 drprov.dll            5.1.2600.5512    C:\WINDOWS\System32
75ee0000 davclnt.dll           5.1.2600.5512    C:\WINDOWS\System32
75ef0000 browseui.dll          6.0.2900.6104    C:\WINDOWS\system32
75ff0000 MSVCP60.dll           6.2.3104.0       C:\WINDOWS\system32
76060000 SETUPAPI.dll          5.1.2600.5512    C:\WINDOWS\system32
762d0000 WINSTA.dll            5.1.2600.5512    C:\WINDOWS\system32
76300000 IMM32.DLL             5.1.2600.5512    C:\WINDOWS\system32
76320000 comdlg32.dll          6.0.2900.5512    C:\WINDOWS\system32
765e0000 crypt32.dll           5.131.2600.5512  C:\WINDOWS\system32
76680000 WININET.dll           6.0.2900.6104    C:\WINDOWS\system32
76760000 cryptdll.dll          5.1.2600.5512    C:\WINDOWS\system32
76950000 LINKINFO.dll          5.1.2600.5512    C:\WINDOWS\system32
76960000 ntshrui.dll           5.1.2600.5512    C:\WINDOWS\system32
76990000 ole32.dll             5.1.2600.6010    C:\WINDOWS\system32
76af0000 ATL.DLL               3.5.2284.2       C:\WINDOWS\system32
76b10000 winmm.dll             5.1.2600.5512    C:\WINDOWS\system32
76bc0000 PSAPI.DLL             5.1.2600.5512    C:\WINDOWS\system32
76c00000 WINTRUST.dll          5.131.2600.5922  C:\WINDOWS\system32
76c60000 IMAGEHLP.dll          5.1.2600.5512    C:\WINDOWS\system32
76d30000 iphlpapi.dll          5.1.2600.5512    C:\WINDOWS\system32
76d70000 appHelp.dll           5.1.2600.5512    C:\WINDOWS\system32
76db0000 MSASN1.dll            5.1.2600.5875    C:\WINDOWS\system32
76e50000 rtutils.dll           5.1.2600.5512    C:\WINDOWS\system32
76e60000 rasman.dll            5.1.2600.5512    C:\WINDOWS\system32
76e80000 TAPI32.dll            5.1.2600.5512    C:\WINDOWS\system32
76eb0000 RASAPI32.DLL          5.1.2600.5512    C:\WINDOWS\system32
76ef0000 DNSAPI.dll            5.1.2600.6089    C:\WINDOWS\system32
76f30000 WLDAP32.dll           5.1.2600.5512    C:\WINDOWS\system32
76f80000 winrnr.dll            5.1.2600.5512    C:\WINDOWS\System32
76f90000 rasadhlp.dll          5.1.2600.5512    C:\WINDOWS\system32
76fa0000 CLBCATQ.DLL           2001.12.4414.700 C:\WINDOWS\system32
77020000 COMRes.dll            2001.12.4414.700 C:\WINDOWS\system32
770f0000 oleaut32.dll          5.1.2600.6058    C:\WINDOWS\system32
77180000 comctl32.dll          6.0.2900.6028    C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202
77bd0000 version.dll           5.1.2600.5512    C:\WINDOWS\system32
77be0000 msvcrt.dll            7.0.2600.5512    C:\WINDOWS\system32
77c40000 msv1_0.dll            5.1.2600.5876    C:\WINDOWS\system32
77d10000 user32.dll            5.1.2600.5512    C:\WINDOWS\system32
77da0000 advapi32.dll          5.1.2600.5755    C:\WINDOWS\system32
77e50000 RPCRT4.dll            5.1.2600.6022    C:\WINDOWS\system32
77ef0000 GDI32.dll             5.1.2600.5698    C:\WINDOWS\system32
77f40000 SHLWAPI.dll           6.0.2900.5912    C:\WINDOWS\system32
77fc0000 Secur32.dll           5.1.2600.5834    C:\WINDOWS\system32
7c800000 kernel32.dll          5.1.2600.5781    C:\WINDOWS\system32
7c920000 ntdll.dll             5.1.2600.6055    C:\WINDOWS\system32
7d590000 shell32.dll           6.0.2900.6018    C:\WINDOWS\system32
7e550000 shdocvw.dll           6.0.2900.6104    C:\WINDOWS\system32

processes:
0000 Idle                0   0
0004 System              0   0   normal
02b0 smss.exe            0   0   normal C:\WINDOWS\system32
0318 csrss.exe           0   0
0338 winlogon.exe        46  14  high   C:\WINDOWS\system32
0364 services.exe        4   2   normal C:\WINDOWS\system32
0370 lsass.exe           6   3   normal C:\WINDOWS\system32
0408 svchost.exe         4   1   normal C:\WINDOWS\system32
0450 svchost.exe         0   0
0484 svchost.exe         11  26  normal C:\WINDOWS\System32
04bc svchost.exe         0   0
0538 svchost.exe         0   0
0560 zhudongfangyu.exe   4   4   normal C:\Program Files\360\360Safe\deepscan
0604 spoolsv.exe         4   4   normal C:\WINDOWS\system32
06e8 Explorer.EXE        419 237 normal C:\WINDOWS
0754 WDKeyMonitorABC.exe 21  9   normal C:\WINDOWS\system32\ABC\ABC SAFE CSP v3.2
0778 SddSUpdate.exe      4   1   normal C:\Program Files\SddSUpdate
07c0 liveupdsrv.exe      47  39  normal C:\Program Files\ʢ\ʢ
07f8 svchost.exe         4   2   normal C:\WINDOWS\system32
010c 360Tray.exe         211 78  normal C:\Program Files\360\360Safe\safemon
0190 ctfmon.exe          28  12  normal C:\WINDOWS\system32
09ec svchost.exe         4   1   normal C:\WINDOWS\system32
1048 FlashFXP.exe        151 88  normal F:\FlashFXP
0dfc msiexec.exe         4   3   normal C:\WINDOWS\system32
1004 iexplore.exe        171 117 normal C:\Program Files\Internet Explorer

hardware:
+ Bluetooth Devices
  - Broadcom Bluetooth Device (driver 3.0.1.169)
+ DVD/CD-ROM 
  - TSSTcorp CDDVDW TS-L632H
  - Wdabc Autorun CDROM USB Device
+ IDE ATA/ATAPI 
  - AMD PCI IDE Controller (driver 5.1.0.8)
  - AMD SATA Controller(Native IDE Mode) (driver 5.1.0.8)
  - Ҫ IDE ͨ
  - Ҫ IDE ͨ
  - Ҫ IDE ͨ
  - Ҫ IDE ͨ
+ 
  - Intel(R) Pentium(R) Dual  CPU  T2390  @ 1.86GHz
  - Intel(R) Pentium(R) Dual  CPU  T2390  @ 1.86GHz
+ 
  - Multi Flash Reader USB Device
  - WDC WD1600BEVS-22RST0
+ 
  - Microsoft AC Adapter
  - Microsoft ACPI-Compliant Control Method Battery
+ ƽ
  - Agere Systems HDA Modem (driver 2.1.87.1)
+ 
  - 弴ü
  - Ĭϼ
  - Ĭϼ
+ 
  - ACPI Multiprocessor PC
+ 
  - Standard 101/102-Key or Microsoft Natural PS/2 Keyboard with HP QLB (driver 1.0.0.1)
+ ѧ豸
  - USB ѧ豸
+ ƵϷ
  - Realtek High Definition Audio (driver 5.10.0.6132)
  - ͳƵ׽豸
  - ͳƵ
  - ý豸
  - Ƶ
  - Ƶ
+ ָ豸
  - HID-compliant mouse
  - PS/2 Compatible Mouse
+ ͨô߿
  - Standard Enhanced PCI to USB Host Controller
  - Standard OpenHCD USB Host Controller
  - Standard OpenHCD USB Host Controller
  - Standard OpenHCD USB Host Controller
  - Standard OpenHCD USB Host Controller
  - Standard OpenHCD USB Host Controller
  - USB Mass Storage Device
  - USB Mass Storage Device
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
+ 
  - Atheros AR5007EG Wireless Network Adapter (driver 7.7.0.523)
  - Realtek RTL8139/810x Family Fast Ethernet NIC (driver 5.719.325.2009)
+ ϵͳ豸
  - ACPI Fan
  - ACPI Fixed Feature Button
  - ACPI Lid
  - ACPI Power Button
  - ACPI Sleep Button
  - ACPI Thermal Zone
  - ACPI Thermal Zone
  - ATI SMBus (driver 5.10.1000.8)
  - Direct memory access controller
  - ISAPNP Read Data Port
  - Logical Disk Manager
  - Microcode Update Device
  - Microsoft ACPI-Compliant Embedded Controller
  - Microsoft ACPI-Compliant System
  - Microsoft Composite Battery
  - Microsoft System Management BIOS Driver
  - Microsoft  High Definition Audio  UAA 
  - Motherboard resources
  - Motherboard resources
  - Numeric data processor
  - PCI bus
  - PCI standard host CPU bridge
  - PCI standard ISA bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - Plug and Play Software Device Enumerator
  - Programmable interrupt controller
  - System board
  - System CMOS/real time clock
  - System speaker
  - System timer
  - Terminal Server Device Redirector
  - Terminal Server Keyboard Driver
  - Terminal Server Mouse Driver
  - Volume Manager
  - ̨ȫʾƵ
+ ʾ
  - ATI Mobility Radeon X2300 (driver 8.591.0.0)

cpu registers:
eax = 00f8c050
ebx = 004033a6
ecx = 0040edb0
edx = 004033a6
esi = 00000000
edi = 007b903c
eip = 004033a6
esp = 0012fe54
ebp = 0012fedc

stack dump:
0012fe54  a6 33 40 00 de fa ed 0e - 01 00 00 00 07 00 00 00  .3@.............
0012fe64  68 fe 12 00 a6 33 40 00 - 50 c0 f8 00 a6 33 40 00  h....3@.P....3@.
0012fe74  00 00 00 00 3c 90 7b 00 - dc fe 12 00 84 fe 12 00  ....<.{.........
0012fe84  a8 0f b9 02 f8 2a 40 00 - a8 0f b9 02 01 90 ee 00  .....*@.........
0012fe94  5d 37 40 00 43 3b 42 00 - 88 c9 f5 00 00 90 ee 00  ]7@.C;B.........
0012fea4  e7 33 40 00 ac 47 42 00 - 88 c9 f5 00 01 90 ee 00  .3@..GB.........
0012feb4  9e 19 45 00 b0 90 ee 00 - 60 ef f1 00 e7 33 40 00  ..E.....`....3@.
0012fec4  6c 5b 44 00 44 ff 12 00 - ac 3a 40 00 dc fe 12 00  l[D.D....:@.....
0012fed4  60 ef f1 01 b0 90 ee 00 - 58 ff 12 00 15 c4 41 00  `.......X.....A.
0012fee4  60 ef f1 00 60 ef f1 00 - 4f c2 41 00 00 95 fa 00  `...`...O.A.....
0012fef4  58 ff 12 00 3c 90 7b 00 - 60 ef f1 00 60 ef f1 00  X...<.{.`...`...
0012ff04  5e 20 45 00 00 d1 f8 00 - 01 00 00 00 5d 37 40 00  ^.E.........]7@.
0012ff14  07 44 42 00 10 10 f6 00 - 10 10 f6 00 60 ef f1 00  .DB.........`...
0012ff24  18 4f 45 00 00 e8 f2 00 - 60 ef f1 00 00 23 41 00  .OE.....`....#A.
0012ff34  35 4f 44 00 60 ef f1 00 - 30 80 f6 00 a4 5b 44 00  5OD.`...0....[D.
0012ff44  b4 ff 12 00 ac 3a 40 00 - 58 ff 12 00 e7 33 40 01  .....:@.X....3@.
0012ff54  60 ef f1 00 98 a9 40 00 - 15 c4 41 00 38 90 7b 00  `.....@...A.8.{.
0012ff64  9c 36 44 00 d0 36 44 00 - c0 a9 40 00 a4 94 7b 00  .6D..6D...@...{.
0012ff74  52 3f 40 00 c0 ff 12 00 - 11 a9 00 00 00 00 00 00  R?@.............
0012ff84  00 50 fd 7f bc 92 79 00 - 00 00 00 00 00 00 00 00  .P....y.........

disassembling:
[...]
00445b1c 2726   mov     eax, [ebp-4]
00445b1f        cmp     byte ptr [eax+$214], 0
00445b26        jz      loc_445b30
00445b28        mov     eax, [ebp-4]
00445b2b        call    +$11c ($445c4c)        ; Forms.TCustomForm.DoDestroy
00445b30 2727   xor     edx, edx
00445b32        mov     eax, [ebp-4]
00445b35        call    +$27fa ($448334)       ; Forms.TCustomForm.MergeMenu
00445b3a 2728   mov     eax, [ebp-4]
00445b3d        call    +$1347e ($458fc0)      ; Controls.TWinControl.HandleAllocated
00445b42        test    al, al
00445b44        jz      loc_445b51
00445b46        mov     eax, [ebp-4]
00445b49        mov     edx, [eax]
00445b4b        call    dword ptr [edx+$a0]
00445b51 2729   mov     edx, [ebp-4]
00445b54        mov     eax, [$7bbaac]
00445b59        call    +$4d76 ($44a8d4)       ; Forms.TScreen.RemoveForm
00445b5e 2730   mov     eax, [ebp-4]
00445b61        mov     eax, [eax+$218]
00445b67      > call    -$42790 ($4033dc)      ; System.TObject.Free
00445b6c 2731   mov     eax, [ebp-4]
00445b6f        mov     eax, [eax+$220]
00445b75        call    -$4279e ($4033dc)      ; System.TObject.Free
00445b7a 2732   mov     eax, [ebp-4]
00445b7d        mov     eax, [eax+$228]
00445b83        call    -$427ac ($4033dc)      ; System.TObject.Free
00445b88 2733   mov     eax, [ebp-4]
00445b8b        mov     eax, [eax+$2bc]
00445b91        call    -$427ba ($4033dc)      ; System.TObject.Free
00445b96 2734   mov     dl, [ebp-5]
00445b99        and     dl, -4
00445b9c        mov     eax, [ebp-4]
00445b9f        call    -$c9c ($444f08)        ; Forms.TScrollingWinControl.Destroy
00445ba4        xor     eax, eax
00445ba6        pop     edx
00445ba7        pop     ecx
00445ba8        pop     ecx
00445ba9        mov     fs:[eax], edx
00445bac        push    $445bc5
00445bb1 2736   mov     eax, [$7b8258]
[...]

date/time         : 2012-06-07, 21:48:54, 890ms
computer name     : LIUDUN-MAS
user name         : Administrator <admin>
registered owner  : Sky123.Org / Sky123.Org
operating system  : Windows XP Service Pack 3 (5.1.2600) build 2600
system language   : Chinese
system up time    : 12 hours 46 minutes
program up time   : 1 minute 3 seconds
processors        : 2x AMD Athlon(tm) II X2 240 Processor
physical memory   : 2108/2815 MB (free/total)
free disk space   : (C:) 54.57 GB (D:) 274.78 GB
display mode      : 1440x900, 16 bit
process id        : $9c8
allocated memory  : 13.70 MB
executable        : flashfxp.exe
exec. date/time   : 2011-03-08 22:10
executable hash   : EBF9591E30DAFE2A9F8E05B39F791BAC
version           : 4.0.0.1543
language          : chinese simplified
callstack crc     : $a22584fc, $08519d0a, $af94b5d8
exception number  : 1
exception class   : EReadError
exception message : Error reading Editor.HideSelection: Win32 Error. Code: 1400. ЧĴھ.

main thread ($1474):
004193d1 +00f1 flashfxp.exe Classes             TReader.ReadPrefix
004195b8 +0164 flashfxp.exe Classes             TReader.ReadProperty
00418f5d +0015 flashfxp.exe Classes             TReader.ReadDataInner
00418f3f +0067 flashfxp.exe Classes             TReader.ReadData
0041c5a5 +0001 flashfxp.exe Classes             TComponent.ReadState
00452231 +002d flashfxp.exe Controls            TControl.ReadState
00455025 +0025 flashfxp.exe Controls            TWinControl.ReadState
00418e2d +00d5 flashfxp.exe Classes             TReader.ReadComponent
00418fd1 +0089 flashfxp.exe Classes             TReader.ReadDataInner
00418f10 +0038 flashfxp.exe Classes             TReader.ReadData
0041c5a5 +0001 flashfxp.exe Classes             TComponent.ReadState
00452231 +002d flashfxp.exe Controls            TControl.ReadState
00455025 +0025 flashfxp.exe Controls            TWinControl.ReadState
00445e33 +005b flashfxp.exe Forms     2817   +8 TCustomForm.ReadState
00419e13 +016f flashfxp.exe Classes             TReader.ReadRootComponent
0041774e +0032 flashfxp.exe Classes             TStream.ReadComponent
00413ac9 +0059 flashfxp.exe Classes             IntToIdent
00413c55 +0079 flashfxp.exe Classes             EndGlobalLoading
00413cc4 +0040 flashfxp.exe Classes             InitInheritedComponent
0044585d +00a1 flashfxp.exe Forms     2666   +8 TCustomForm.Create
007476a6 +0082 flashfxp.exe FrmMain1 13643  +12 TFrmMain.CreateEditor
0073eaf8 +0290 flashfxp.exe FrmMain1 10707  +30 TFrmMain.DoOpenEdit
0073e7a7 +0513 flashfxp.exe FrmMain1 10669 +120 TFrmMain.ViewFile
0073df25 +01f5 flashfxp.exe FrmMain1 10472  +32 TFrmMain.ViewClick
0073edbf +006f flashfxp.exe FrmMain1 10748  +17 TFrmMain.mnuEditClick
00461067 +008f flashfxp.exe Menus               TMenuItem.Click
004621df +0013 flashfxp.exe Menus               TMenu.DispatchCommand
0046316b +00bf flashfxp.exe Menus               TPopupList.WndProc
0046307d +001d flashfxp.exe Menus               TPopupList.MainWndProc
0041d0e6 +00a2 flashfxp.exe Classes             TStreamAdapter.Clone
77d196c2 +000a user32.dll                       DispatchMessageA
0044cabf +008b flashfxp.exe Forms     7117  +34 TApplication.ProcessMessage
0078852a +0012 flashfxp.exe FDSock     699   +2 HandledMessage
0078d45e +044e flashfxp.exe FDSock    3291 +140 TFlashsock.CaptureFile
0062cdc6 +121a flashfxp.exe FDFtp     2923 +493 TFDFTP.Download
0075e837 +0d97 flashfxp.exe FrmMain1 21743 +331 TFrmMain.DownloadFile
0073285c +162c flashfxp.exe FrmMain1  6011 +511 TFrmMain.Transfer1Click
0072b5a1 +0039 flashfxp.exe FrmMain1  3181   +9 TFrmMain.WMTRANS
00453e55 +0111 flashfxp.exe Controls            TControl.WndProc
004566c2 +01ae flashfxp.exe Controls            TWinControl.WndProc
00446bed +0571 flashfxp.exe Forms     3235 +139 TCustomForm.WndProc
0050ab27 +003f flashfxp.exe ThemeMgr            TWindowProcList.DispatchMessage
0050b474 +00dc flashfxp.exe ThemeMgr            TThemeManager.FormWindowProc
0050c965 +0009 flashfxp.exe ThemeMgr            TThemeManager.PreFormWindowProc
0045634c +002c flashfxp.exe Controls            TWinControl.MainWndProc
00443cbc +0014 flashfxp.exe Forms     1529   +8 StdWndProc
77d196c2 +000a user32.dll                       DispatchMessageA
0044cabf +008b flashfxp.exe Forms     7117  +34 TApplication.ProcessMessage
0044caf6 +000a flashfxp.exe Forms     7155   +1 TApplication.HandleMessage
0044cdab +00bf flashfxp.exe Forms     7259  +26 TApplication.Run
0079925c +1c70 flashfxp.exe FlashFXP   921 +631 initialization

thread $510:
7c92df48 +00a ntdll.dll              NtWaitForMultipleObjects
004bd48d +ed1 flashfxp.exe madExcept Ebp
004bd4fc +f40 flashfxp.exe madExcept Ebp
>> created by main thread ($1474) at:
77dc8c8c +000 advapi32.dll

thread $175c (TChangeHandlerThread):
7c92df48 +00a ntdll.dll                              NtWaitForMultipleObjects
7c80958a +000 kernel32.dll                           WaitForMultipleObjectsEx
7c80a110 +013 kernel32.dll                           WaitForMultipleObjects
006430e3 +07b flashfxp.exe UPTShellControls 4380 +13 TChangeHandlerThread.Execute
004bd5ab +fef flashfxp.exe madExcept                 Ebp
0041bfcc +230 flashfxp.exe Classes                   HexToBin
00404080 +028 flashfxp.exe System                    ThreadWrapper
004bd48d +ed1 flashfxp.exe madExcept                 Ebp
004bd4fc +f40 flashfxp.exe madExcept                 Ebp
>> created by main thread ($1474) at:
00642d9f +01f flashfxp.exe UPTShellControls 4262  +2 TChangeHandlerThread.Create

thread $804: <priority:1>
7c92da48 +00a ntdll.dll              NtRemoveIoCompletion
004bd48d +ed1 flashfxp.exe madExcept Ebp
004bd4f7 +f3b flashfxp.exe madExcept Ebp
>> created by main thread ($1474) at:
719cd926 +000 mswsock.dll

thread $ec (TSaveFileWorker):
7c92df48 +00a ntdll.dll                  NtWaitForMultipleObjects
7c80958a +000 kernel32.dll               WaitForMultipleObjectsEx
7c80a110 +013 kernel32.dll               WaitForMultipleObjects
00664604 +10c flashfxp.exe SaveToFileThd TSaveFileWorker.Execute
004bd5ad +ff1 flashfxp.exe madExcept     Ebp
0041bfc9 +22d flashfxp.exe Classes       HexToBin
00404080 +028 flashfxp.exe System        ThreadWrapper
004bd48d +ed1 flashfxp.exe madExcept     Ebp
004bd4fc +f40 flashfxp.exe madExcept     Ebp
>> created by main thread ($1474) at:
00664400 +090 flashfxp.exe SaveToFileThd TSaveFileWorker.Create

modules:
00400000 flashfxp.exe          4.0.0.1543       D:\ɱרҵ\FlashFXP
01500000 360UDiskGuard.dll     2.0.0.1019       D:\360\360Safe\safemon
02610000 Normaliz.dll          6.0.5441.0       C:\WINDOWS\system32
02d70000 libeay32.dll          1.0.0.4          D:\ɱרҵ\FlashFXP
02ec0000 ssleay32.dll          1.0.0.4          D:\ɱרҵ\FlashFXP
07160000 audiodev.dll          5.2.5721.5262    C:\WINDOWS\system32
10000000 kliveshellext.dll     1.21.0.1087      C:\Documents and Settings\Administrator\Application Data\Kingsoft\klive\bin
10930000 PortableDeviceApi.dll 5.2.5721.5262    C:\WINDOWS\system32
11c70000 WMASF.DLL             11.0.5721.5262   C:\WINDOWS\system32
15110000 WMVCore.DLL           11.0.5721.5275   C:\WINDOWS\system32
16500000 wpdshext.dll          5.2.5721.5262    C:\WINDOWS\system32
1f840000 odbcint.dll           3.525.1117.0     C:\WINDOWS\system32
36f10000 MSOXEV.DLL            11.0.8161.0      C:\Program Files\Common Files\Microsoft Shared\OFFICE11
3e410000 WININET.dll           8.0.6001.19222   C:\WINDOWS\system32
3eab0000 iertutil.dll          8.0.6001.19222   C:\WINDOWS\system32
3eca0000 ieframe.dll           8.0.6001.19222   C:\WINDOWS\system32
43ce0000 urlmon.dll            8.0.6001.19222   C:\WINDOWS\system32
4ae90000 gdiplus.dll           5.2.6002.22509   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22509_x-ww_c7dad023
5adc0000 uxtheme.dll           6.0.2900.5512    C:\WINDOWS\system32
5efe0000 olepro32.dll          5.1.2600.5512    C:\WINDOWS\system32
5fdd0000 NETAPI32.dll          5.1.2600.5694    C:\WINDOWS\system32
60fd0000 hnetcfg.dll           5.1.2600.5512    C:\WINDOWS\system32
62c20000 LPK.DLL               5.1.2600.5512    C:\WINDOWS\system32
68000000 rsaenh.dll            5.1.2600.5507    C:\WINDOWS\system32
68100000 dssenh.dll            5.1.2600.5507    C:\WINDOWS\system32
719c0000 mswsock.dll           5.1.2600.5625    C:\WINDOWS\system32
71a00000 wshtcpip.dll          5.1.2600.5512    C:\WINDOWS\System32
71a10000 WS2HELP.dll           5.1.2600.5512    C:\WINDOWS\system32
71a20000 WS2_32.dll            5.1.2600.5512    C:\WINDOWS\system32
71a40000 wsock32.dll           5.1.2600.5512    C:\WINDOWS\system32
71a90000 MPR.dll               5.1.2600.5512    C:\WINDOWS\system32
71b70000 SAMLIB.dll            5.1.2600.5512    C:\WINDOWS\System32
71b90000 ntlanman.dll          5.1.2600.5512    C:\WINDOWS\System32
71c00000 NETRAP.dll            5.1.2600.5512    C:\WINDOWS\System32
71c10000 NETUI1.dll            5.1.2600.5512    C:\WINDOWS\System32
71c50000 NETUI0.dll            5.1.2600.5512    C:\WINDOWS\System32
72f70000 winspool.drv          5.1.2600.5512    C:\WINDOWS\system32
73540000 ODBC32.dll            3.525.3012.0     C:\WINDOWS\system32
73640000 msctfime.ime          5.1.2600.5768    C:\WINDOWS\system32
73ce0000 shgina.dll            6.0.2900.5512    C:\WINDOWS\system32
73fa0000 USP10.dll             1.420.2600.5969  C:\WINDOWS\system32
74680000 MSCTF.dll             5.1.2600.5512    C:\WINDOWS\system32
75430000 CRYPTUI.dll           5.131.2600.5512  C:\WINDOWS\system32
758d0000 MSGINA.dll            5.1.2600.5512    C:\WINDOWS\system32
759d0000 USERENV.dll           5.1.2600.5512    C:\WINDOWS\system32
75ed0000 drprov.dll            5.1.2600.5512    C:\WINDOWS\System32
75ee0000 davclnt.dll           5.1.2600.5512    C:\WINDOWS\System32
75ef0000 browseui.dll          6.0.2900.6148    C:\WINDOWS\system32
76060000 SETUPAPI.dll          5.1.2600.5512    C:\WINDOWS\system32
762d0000 WINSTA.dll            5.1.2600.5512    C:\WINDOWS\system32
76300000 IMM32.DLL             5.1.2600.5512    C:\WINDOWS\system32
76320000 comdlg32.dll          6.0.2900.5512    C:\WINDOWS\system32
76570000 CSCDLL.dll            5.1.2600.5512    C:\WINDOWS\System32
76590000 cscui.dll             5.1.2600.5512    C:\WINDOWS\System32
765e0000 crypt32.dll           5.131.2600.6149  C:\WINDOWS\system32
76950000 LINKINFO.dll          5.1.2600.5512    C:\WINDOWS\system32
76960000 ntshrui.dll           5.1.2600.5512    C:\WINDOWS\system32
76990000 ole32.dll             5.1.2600.6010    C:\WINDOWS\system32
76af0000 ATL.DLL               3.5.2284.2       C:\WINDOWS\system32
76b10000 winmm.dll             5.1.2600.5512    C:\WINDOWS\system32
76c00000 WINTRUST.dll          5.131.2600.5922  C:\WINDOWS\system32
76c60000 IMAGEHLP.dll          5.1.2600.5512    C:\WINDOWS\system32
76d70000 appHelp.dll           5.1.2600.5512    C:\WINDOWS\system32
76db0000 MSASN1.dll            5.1.2600.5875    C:\WINDOWS\system32
76f30000 WLDAP32.dll           5.1.2600.5512    C:\WINDOWS\system32
76fa0000 CLBCATQ.DLL           2001.12.4414.700 C:\WINDOWS\system32
77020000 COMRes.dll            2001.12.4414.700 C:\WINDOWS\system32
770f0000 oleaut32.dll          5.1.2600.6058    C:\WINDOWS\system32
77180000 comctl32.dll          6.0.2900.6028    C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202
77bd0000 version.dll           5.1.2600.5512    C:\WINDOWS\system32
77be0000 msvcrt.dll            7.0.2600.5512    C:\WINDOWS\system32
77d10000 user32.dll            5.1.2600.5512    C:\WINDOWS\system32
77da0000 advapi32.dll          5.1.2600.5755    C:\WINDOWS\system32
77e50000 RPCRT4.dll            5.1.2600.6022    C:\WINDOWS\system32
77ef0000 GDI32.dll             5.1.2600.5698    C:\WINDOWS\system32
77f40000 SHLWAPI.dll           6.0.2900.5912    C:\WINDOWS\system32
77fc0000 Secur32.dll           5.1.2600.5834    C:\WINDOWS\system32
7c800000 kernel32.dll          5.1.2600.5781    C:\WINDOWS\system32
7c920000 ntdll.dll             5.1.2600.6055    C:\WINDOWS\system32
7d590000 shell32.dll           6.0.2900.6072    C:\WINDOWS\system32
7e550000 shdocvw.dll           6.0.2900.6148    C:\WINDOWS\system32

processes:
0000 Idle                   0    0
0004 System                 0    0   normal
0288 smss.exe               0    0   normal C:\WINDOWS\system32
02bc csrss.exe              0    0
02d4 winlogon.exe           46   14  high   C:\WINDOWS\system32
0300 services.exe           4    2   normal C:\WINDOWS\system32
030c lsass.exe              4    2   normal C:\WINDOWS\system32
03b0 svchost.exe            4    1   normal C:\WINDOWS\system32
03f4 svchost.exe            0    0
0454 svchost.exe            11   27  normal C:\WINDOWS\System32
04b4 svchost.exe            0    0
04f4 svchost.exe            0    0
0514 ZhuDongFangYu.exe      4    5   normal D:\360\360Safe\deepscan
063c spoolsv.exe            4    4   normal C:\WINDOWS\system32
0700 Explorer.EXE           227  129 normal C:\WINDOWS
0788 ɱרҵ߰.exe 557  204 normal D:\ɱרҵ
0790 ctfmon.exe             28   12  normal C:\WINDOWS\system32
042c TXPlatform.exe         8    5   normal D:\ɱרҵ\QQ\Bin
0490 QQ.exe                 880  111 normal D:\ɱרҵ\QQ\Bin
01c8 QQ.exe                 1079 135 normal D:\ɱרҵ\QQ\Bin
07d0 AliIM.exe              275  155 normal E:\Ա\
07c0 zdsj.exe               39   29  normal G:\Ϸ\ͬ˳\ͬ˳
0aa4 wmiprvse.exe           0    0
0afc YingYan.exe            626  141 normal D:\netվר(ض)\YingYan
0bd4 AliimSafe.exe          8    13  normal E:\Ա\\7.10.07C\miser
09d4 conime.exe             24   12  normal C:\WINDOWS\system32
0370 QQExternal.exe         92   39  normal D:\ɱרҵ\QQ\Bin
0ad8 QQExternal.exe         84   31  normal D:\ɱרҵ\QQ\Bin
16cc scardsvr.exe           0    0
0b60 WDCertM_ABC.exe        31   12  high   C:\WINDOWS\system32\ABC\ABC SAFE CSP v3.2
027c WDKeyMonitorABC.exe    11   8   normal C:\WINDOWS\system32\ABC\ABC SAFE CSP v3.2
17dc alicnotify.exe         14   8   normal C:\Documents and Settings\Administrator\Application Data\alipay\cf
1624 AlipaySecSvc.exe       4    4   normal C:\Program Files\alipay\alieditplus
179c QQExternal.exe         83   45  normal D:\ɱרҵ\QQ\Bin
0dd0 QQExternal.exe         113  32  normal D:\ɱרҵ\QQ\Bin
0f10 iexplore.exe           282  105 normal C:\Program Files\Internet Explorer
16e0 iexplore.exe           181  120 normal C:\Program Files\Internet Explorer
0c8c NOTEPAD.EXE            29   21  normal C:\WINDOWS\system32
09c8 flashfxp.exe           234  175 normal D:\ɱרҵ\FlashFXP

hardware:
+ IDE ATA/ATAPI 
  - NVIDIA nForce Serial ATA Controller (driver 10.3.0.46)
  - NVIDIA nForce Serial ATA Controller (driver 10.3.0.46)
  - ׼˫ͨ PCI IDE 
  - Ҫ IDE ͨ
  - Ҫ IDE ͨ
+ 
  - AMD Athlon(tm) II X2 240 Processor (driver 1.0.0.0)
  - AMD Athlon(tm) II X2 240 Processor (driver 1.0.0.0)
+ 
  - Samsung G2 Portable USB Device
  - ST310005 28AS SCSI Disk Device
+ ˿ (COM  LPT)
  - ӡ˿ (LPT1)
  - ͨѶ˿ (COM1)
+ 
  - 弴ü
+ 
  - ACPI Multiprocessor PC
+ 
  - HID Keyboard Device
+ ѧ豸
  - HID-compliant device
  - HID-compliant device
  - USB ѧ豸
  - USB ѧ豸
  -  HID ׼û豸
+ ƵϷ
  - Realtek High Definition Audio (driver 5.10.0.5919)
  - ͳƵ׽豸
  - ͳƵ
  - ý豸
  - Ƶ
  - Ƶ
+ ָ豸
  - HID-compliant mouse
+ ͨô߿
  - Standard Enhanced PCI to USB Host Controller
  - Standard OpenHCD USB Host Controller
  - USB Composite Device
  - USB Mass Storage Device
  - USB Root Hub
  - USB Root Hub
+ 
  - Realtek PCIe FE Family Controller (driver 5.732.629.2009)
+ ϵͳ豸
  - ACPI Fixed Feature Button
  - ACPI Power Button
  - AMD Low Level Device Driver (driver 1.0.1.0)
  - AMD-8111 High Precision Event Timer (driver 1.0.0.0)
  - Direct memory access controller
  - ISAPNP Read Data Port
  - Logical Disk Manager
  - Microcode Update Device
  - Microsoft ACPI-Compliant System
  - Microsoft System Management BIOS Driver
  - Microsoft  High Definition Audio  UAA 
  - Motherboard resources
  - Motherboard resources
  - Motherboard resources
  - Motherboard resources
  - Numeric data processor
  - NVIDIA nForce PCI System Management (driver 4.7.9.0)
  - NVIDIA nForce System Management Controller (driver 5.1.2600.208)
  - PCI bus
  - PCI standard host CPU bridge
  - PCI standard host CPU bridge
  - PCI standard host CPU bridge
  - PCI standard host CPU bridge
  - PCI standard host CPU bridge
  - PCI standard ISA bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard RAM Controller
  - PCI standard RAM Controller
  - Plug and Play Software Device Enumerator
  - Printer Port Logical Interface
  - Programmable interrupt controller
  - System board
  - System CMOS/real time clock
  - System speaker
  - System timer
  - Terminal Server Device Redirector
  - Terminal Server Keyboard Driver
  - Terminal Server Mouse Driver
  - Volume Manager
  - ̨ȫʾƵ
+ ʾ
  - NVIDIA GeForce 7025 / NVIDIA nForce 630a (driver 6.14.11.9634)

cpu registers:
eax = 02a248f0
ebx = 02a316d8
ecx = 00000000
edx = 004193d1
esi = 00000000
edi = 0012f158
eip = 004193d1
esp = 0012e9b4
ebp = 0012eb1c

stack dump:
0012e9b4  d1 93 41 00 de fa ed 0e - 01 00 00 00 07 00 00 00  ..A.............
0012e9c4  c8 e9 12 00 d1 93 41 00 - f0 48 a2 02 d8 16 a3 02  ......A..H......
0012e9d4  00 00 00 00 58 f1 12 00 - 1c eb 12 00 e4 e9 12 00  ....X...........
0012e9e4  58 f1 12 00 ac 3a 40 00 - 1c eb 12 00 af 95 41 00  X....:@.......A.
0012e9f4  00 00 00 00 d0 1d a3 02 - 0b 00 00 00 30 14 41 00  ............0.A.
0012ea04  0b 00 00 00 78 87 fa 00 - 0b 00 00 00 80 46 f8 00  ....x........F..
0012ea14  0b 8e d2 77 89 e3 d2 77 - 4f e3 d2 77 00 02 00 80  ...w...wO..w....
0012ea24  3c ef 12 00 68 ea 12 00 - 50 ef 12 00 44 01 01 44  <...h...P...D..D
0012ea34  00 00 00 00 00 00 00 00 - 48 02 00 00 57 01 00 00  ........H...W...
0012ea44  6a 04 11 00 00 00 00 00 - 00 00 40 00 00 00 00 00  j.........@.....
0012ea54  00 04 00 40 00 00 00 00 - 3c ef 12 00 6c d3 43 00  ...@....<...l.C.
0012ea64  74 e3 d2 77 12 00 00 00 - 14 00 00 00 78 a4 03 03  t..w........x...
0012ea74  a7 5c 93 7c 00 00 00 00 - 00 00 00 00 00 00 00 00  .\.|............
0012ea84  00 00 40 00 50 ef 12 00 - 6a 04 11 00 00 00 00 00  ..@.P...j.......
0012ea94  00 00 00 40 00 00 00 00 - 00 00 00 00 00 00 00 00  ...@............
0012eaa4  00 00 00 00 00 00 00 00 - 68 ea 12 00 00 00 00 00  ........h.......
0012eab4  00 00 00 00 07 00 00 00 - f8 ea 12 00 23 03 93 7c  ............#..|
0012eac4  a6 95 41 00 00 00 40 00 - 00 00 40 00 00 01 40 00  ..A...@...@...@.
0012ead4  c4 ea 12 00 00 00 00 00 - fc ea 12 00 85 03 93 7c  ...............|
0012eae4  00 00 40 00 01 00 00 00 - 0e 00 00 00 20 eb 12 00  ..@.............

disassembling:
[...]
00445dee        push    $445fda                ; System.@HandleFinally
00445df3        push    dword ptr fs:[edx]
00445df6        mov     fs:[edx], esp
00445df9 2812   mov     eax, [ebp-4]
00445dfc        xor     edx, edx
00445dfe        mov     [eax+$248], edx
00445e04 2813   mov     eax, [ebp-4]
00445e07        xor     edx, edx
00445e09        mov     [eax+$24c], edx
00445e0f 2814   mov     eax, [ebp-4]
00445e12        xor     edx, edx
00445e14        mov     [eax+$250], edx
00445e1a 2815   xor     ebx, ebx
00445e1c 2816   mov     eax, [$7b7b10]
00445e21        mov     al, [eax]
00445e23        xor     al, 1
00445e25        mov     edx, [ebp-4]
00445e28        mov     [edx+$214], al
00445e2e 2817   mov     edx, esi
00445e30        mov     eax, [ebp-4]
00445e33      > call    +$f1c8 ($455000)       ; Controls.TWinControl.ReadState
00445e38 2818   mov     eax, [ebp-4]
00445e3b        cmp     dword ptr [eax+$23c], 0
00445e42        jz      loc_445f4e
00445e48        mov     eax, [ebp-4]
00445e4b        cmp     dword ptr [eax+$250], 0
00445e52        jle     loc_445f4e
00445e58 2820   mov     eax, [ebp-4]
00445e5b        test    byte ptr [eax+$84], $10
00445e62        jz      loc_445ea7
00445e64        mov     eax, [ebp-4]
00445e67        mov     eax, [eax+$23c]
00445e6d        mov     edx, [$7bbaac]
00445e73        cmp     eax, [edx+$34]
00445e76        jz      loc_445ea7
00445e78 2821   mov     eax, [ebp-4]
00445e7b        mov     eax, [eax+$23c]
00445e81        push    eax
00445e82        mov     eax, [$7bbaac]
00445e87        mov     eax, [eax+$34]
00445e8a        push    eax
[...]

date/time         : 2012-06-08, 16:08:45, 937ms
computer name     : LIUDUN-MAS
user name         : Administrator <admin>
registered owner  : Sky123.Org / Sky123.Org
operating system  : Windows XP Service Pack 3 (5.1.2600) build 2600
system language   : Chinese
system up time    : 7 hours 8 minutes
program up time   : 54 minutes 23 seconds
processors        : 2x AMD Athlon(tm) II X2 240 Processor
physical memory   : 1976/2815 MB (free/total)
free disk space   : (C:) 54.53 GB (D:) 274.62 GB
display mode      : 1440x900, 16 bit
process id        : $d2c
allocated memory  : 15.05 MB
executable        : flashfxp.exe
exec. date/time   : 2011-03-08 22:10
executable hash   : EBF9591E30DAFE2A9F8E05B39F791BAC
version           : 4.0.0.1543
language          : chinese simplified
callstack crc     : $a22584fc, $ead371aa, $a3274fff
count             : 2
exception number  : 1
exception class   : EReadError
exception message : Error reading Editor.HideSelection: Win32 Error. Code: 1400. ЧĴھ.

main thread ($e3c):
004193d1 +00f1 flashfxp.exe Classes             TReader.ReadPrefix
004195b8 +0164 flashfxp.exe Classes             TReader.ReadProperty
00418f5d +0015 flashfxp.exe Classes             TReader.ReadDataInner
00418f3f +0067 flashfxp.exe Classes             TReader.ReadData
0041c5a5 +0001 flashfxp.exe Classes             TComponent.ReadState
00452231 +002d flashfxp.exe Controls            TControl.ReadState
00455025 +0025 flashfxp.exe Controls            TWinControl.ReadState
00418e2d +00d5 flashfxp.exe Classes             TReader.ReadComponent
00418fd1 +0089 flashfxp.exe Classes             TReader.ReadDataInner
00418f10 +0038 flashfxp.exe Classes             TReader.ReadData
0041c5a5 +0001 flashfxp.exe Classes             TComponent.ReadState
00452231 +002d flashfxp.exe Controls            TControl.ReadState
00455025 +0025 flashfxp.exe Controls            TWinControl.ReadState
00445e33 +005b flashfxp.exe Forms     2817   +8 TCustomForm.ReadState
00419e13 +016f flashfxp.exe Classes             TReader.ReadRootComponent
0041774e +0032 flashfxp.exe Classes             TStream.ReadComponent
00413ac9 +0059 flashfxp.exe Classes             IntToIdent
00413c55 +0079 flashfxp.exe Classes             EndGlobalLoading
00413cc4 +0040 flashfxp.exe Classes             InitInheritedComponent
0044585d +00a1 flashfxp.exe Forms     2666   +8 TCustomForm.Create
007476a6 +0082 flashfxp.exe FrmMain1 13643  +12 TFrmMain.CreateEditor
0073eaf8 +0290 flashfxp.exe FrmMain1 10707  +30 TFrmMain.DoOpenEdit
0073e7a7 +0513 flashfxp.exe FrmMain1 10669 +120 TFrmMain.ViewFile
0073df25 +01f5 flashfxp.exe FrmMain1 10472  +32 TFrmMain.ViewClick
0073edbf +006f flashfxp.exe FrmMain1 10748  +17 TFrmMain.mnuEditClick
00461067 +008f flashfxp.exe Menus               TMenuItem.Click
004621df +0013 flashfxp.exe Menus               TMenu.DispatchCommand
0046316b +00bf flashfxp.exe Menus               TPopupList.WndProc
0046307d +001d flashfxp.exe Menus               TPopupList.MainWndProc
0041d0e6 +00a2 flashfxp.exe Classes             TStreamAdapter.Clone
77d196c2 +000a user32.dll                       DispatchMessageA
0044cabf +008b flashfxp.exe Forms     7117  +34 TApplication.ProcessMessage
0044caf6 +000a flashfxp.exe Forms     7155   +1 TApplication.HandleMessage
0044cdab +00bf flashfxp.exe Forms     7259  +26 TApplication.Run
0079925c +1c70 flashfxp.exe FlashFXP   921 +631 initialization

thread $14ac (TChangeHandlerThread):
7c92df48 +00a ntdll.dll                              NtWaitForMultipleObjects
7c80958a +000 kernel32.dll                           WaitForMultipleObjectsEx
7c80a110 +013 kernel32.dll                           WaitForMultipleObjects
006430e3 +07b flashfxp.exe UPTShellControls 4380 +13 TChangeHandlerThread.Execute
004bd5ab +fef flashfxp.exe madExcept                 Ebp
0041bfc9 +22d flashfxp.exe Classes                   HexToBin
00404080 +028 flashfxp.exe System                    ThreadWrapper
004bd48d +ed1 flashfxp.exe madExcept                 Ebp
004bd4fc +f40 flashfxp.exe madExcept                 Ebp
>> created by main thread ($e3c) at:
00642d9f +01f flashfxp.exe UPTShellControls 4262  +2 TChangeHandlerThread.Create

thread $14c4 (TSaveFileWorker):
7c92df48 +00a ntdll.dll                  NtWaitForMultipleObjects
7c80958a +000 kernel32.dll               WaitForMultipleObjectsEx
7c80a110 +013 kernel32.dll               WaitForMultipleObjects
00664604 +10c flashfxp.exe SaveToFileThd TSaveFileWorker.Execute
004bd5ad +ff1 flashfxp.exe madExcept     Ebp
0041bfcc +230 flashfxp.exe Classes       HexToBin
00404080 +028 flashfxp.exe System        ThreadWrapper
004bd48d +ed1 flashfxp.exe madExcept     Ebp
004bd4fc +f40 flashfxp.exe madExcept     Ebp
>> created by main thread ($e3c) at:
00664400 +090 flashfxp.exe SaveToFileThd TSaveFileWorker.Create

thread $44c: <priority:1>
7c92da48 +00a ntdll.dll              NtRemoveIoCompletion
004bd48d +ed1 flashfxp.exe madExcept Ebp
004bd4f7 +f3b flashfxp.exe madExcept Ebp
>> created by main thread ($e3c) at:
719cd926 +000 mswsock.dll

modules:
00400000 flashfxp.exe          4.0.0.1543       D:\ɱרҵ\FlashFXP
01020000 Normaliz.dll          6.0.5441.0       C:\WINDOWS\system32
028d0000 kliveshellext.dll     1.21.0.1087      C:\Documents and Settings\Administrator\Application Data\Kingsoft\klive\bin
02970000 360UDiskGuard.dll     2.0.0.1019       D:\360\360Safe\safemon
02f00000 libeay32.dll          1.0.0.4          D:\ɱרҵ\FlashFXP
03050000 ssleay32.dll          1.0.0.4          D:\ɱרҵ\FlashFXP
03790000 psicon.dll            6.6.64.53        C:\Program Files\Common Files\Adobe\Shell
037d0000 AliIMExt.dll          1.0.0.1          E:\Ա\\7.10.07C
03820000 HaoZipExt.dll         2.5.1.8008       C:\Program Files\HaoZip
07160000 audiodev.dll          5.2.5721.5262    C:\WINDOWS\system32
10000000 safemon.dll           8.1.1.1001       D:\360\360Safe\safemon
10930000 PortableDeviceApi.dll 5.2.5721.5262    C:\WINDOWS\system32
11c70000 WMASF.DLL             11.0.5721.5262   C:\WINDOWS\system32
15110000 WMVCore.DLL           11.0.5721.5275   C:\WINDOWS\system32
16500000 wpdshext.dll          5.2.5721.5262    C:\WINDOWS\system32
1f840000 odbcint.dll           3.525.1117.0     C:\WINDOWS\system32
325c0000 msohev.dll            11.0.5510.0      C:\Program Files\Microsoft Office\OFFICE11
36f10000 MSOXEV.DLL            11.0.8161.0      C:\Program Files\Common Files\Microsoft Shared\OFFICE11
3e410000 WININET.dll           8.0.6001.19222   C:\WINDOWS\system32
3eab0000 iertutil.dll          8.0.6001.19222   C:\WINDOWS\system32
3eca0000 ieframe.dll           8.0.6001.19222   C:\WINDOWS\system32
43ce0000 urlmon.dll            8.0.6001.19222   C:\WINDOWS\system32
4ae90000 gdiplus.dll           5.2.6002.22509   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22509_x-ww_c7dad023
5adc0000 uxtheme.dll           6.0.2900.5512    C:\WINDOWS\system32
5efe0000 olepro32.dll          5.1.2600.5512    C:\WINDOWS\system32
5fdd0000 NETAPI32.dll          5.1.2600.5694    C:\WINDOWS\system32
60fd0000 hnetcfg.dll           5.1.2600.5512    C:\WINDOWS\system32
62c20000 LPK.DLL               5.1.2600.5512    C:\WINDOWS\system32
68000000 rsaenh.dll            5.1.2600.5507    C:\WINDOWS\system32
68100000 dssenh.dll            5.1.2600.5507    C:\WINDOWS\system32
719c0000 mswsock.dll           5.1.2600.5625    C:\WINDOWS\system32
71a00000 wshtcpip.dll          5.1.2600.5512    C:\WINDOWS\System32
71a10000 WS2HELP.dll           5.1.2600.5512    C:\WINDOWS\system32
71a20000 WS2_32.dll            5.1.2600.5512    C:\WINDOWS\system32
71a40000 wsock32.dll           5.1.2600.5512    C:\WINDOWS\system32
71a90000 MPR.dll               5.1.2600.5512    C:\WINDOWS\system32
71b70000 SAMLIB.dll            5.1.2600.5512    C:\WINDOWS\System32
71b90000 ntlanman.dll          5.1.2600.5512    C:\WINDOWS\System32
71c00000 NETRAP.dll            5.1.2600.5512    C:\WINDOWS\System32
71c10000 NETUI1.dll            5.1.2600.5512    C:\WINDOWS\System32
71c50000 NETUI0.dll            5.1.2600.5512    C:\WINDOWS\System32
72f70000 winspool.drv          5.1.2600.5512    C:\WINDOWS\system32
73540000 ODBC32.dll            3.525.3012.0     C:\WINDOWS\system32
73640000 msctfime.ime          5.1.2600.5768    C:\WINDOWS\system32
73ce0000 shgina.dll            6.0.2900.5512    C:\WINDOWS\system32
73fa0000 USP10.dll             1.420.2600.5969  C:\WINDOWS\system32
74680000 MSCTF.dll             5.1.2600.5512    C:\WINDOWS\system32
75430000 CRYPTUI.dll           5.131.2600.5512  C:\WINDOWS\system32
758d0000 MSGINA.dll            5.1.2600.5512    C:\WINDOWS\system32
759d0000 USERENV.dll           5.1.2600.5512    C:\WINDOWS\system32
75ed0000 drprov.dll            5.1.2600.5512    C:\WINDOWS\System32
75ee0000 davclnt.dll           5.1.2600.5512    C:\WINDOWS\System32
75ef0000 browseui.dll          6.0.2900.6148    C:\WINDOWS\system32
76060000 SETUPAPI.dll          5.1.2600.5512    C:\WINDOWS\system32
762d0000 WINSTA.dll            5.1.2600.5512    C:\WINDOWS\system32
762f0000 MSIMG32.dll           5.1.2600.5512    C:\WINDOWS\system32
76300000 IMM32.DLL             5.1.2600.5512    C:\WINDOWS\system32
76320000 comdlg32.dll          6.0.2900.5512    C:\WINDOWS\system32
76570000 CSCDLL.dll            5.1.2600.5512    C:\WINDOWS\System32
76590000 cscui.dll             5.1.2600.5512    C:\WINDOWS\System32
765e0000 crypt32.dll           5.131.2600.6149  C:\WINDOWS\system32
76760000 Cryptdll.dll          5.1.2600.5512    C:\WINDOWS\system32
76950000 LINKINFO.dll          5.1.2600.5512    C:\WINDOWS\system32
76960000 ntshrui.dll           5.1.2600.5512    C:\WINDOWS\system32
76990000 ole32.dll             5.1.2600.6010    C:\WINDOWS\system32
76af0000 ATL.DLL               3.5.2284.2       C:\WINDOWS\system32
76b10000 winmm.dll             5.1.2600.5512    C:\WINDOWS\system32
76bc0000 PSAPI.DLL             5.1.2600.5512    C:\WINDOWS\system32
76c00000 WINTRUST.dll          5.131.2600.5922  C:\WINDOWS\system32
76c60000 IMAGEHLP.dll          5.1.2600.5512    C:\WINDOWS\system32
76d70000 appHelp.dll           5.1.2600.5512    C:\WINDOWS\system32
76db0000 MSASN1.dll            5.1.2600.5875    C:\WINDOWS\system32
76f30000 WLDAP32.dll           5.1.2600.5512    C:\WINDOWS\system32
76fa0000 CLBCATQ.DLL           2001.12.4414.700 C:\WINDOWS\system32
77020000 COMRes.dll            2001.12.4414.700 C:\WINDOWS\system32
770f0000 oleaut32.dll          5.1.2600.6058    C:\WINDOWS\system32
77180000 comctl32.dll          6.0.2900.6028    C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202
77bd0000 version.dll           5.1.2600.5512    C:\WINDOWS\system32
77be0000 msvcrt.dll            7.0.2600.5512    C:\WINDOWS\system32
77d10000 user32.dll            5.1.2600.5512    C:\WINDOWS\system32
77da0000 advapi32.dll          5.1.2600.5755    C:\WINDOWS\system32
77e50000 RPCRT4.dll            5.1.2600.6022    C:\WINDOWS\system32
77ef0000 GDI32.dll             5.1.2600.5698    C:\WINDOWS\system32
77f40000 SHLWAPI.dll           6.0.2900.5912    C:\WINDOWS\system32
77fc0000 Secur32.dll           5.1.2600.5834    C:\WINDOWS\system32
78130000 MSVCR80.dll           8.0.50727.4053   C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989
7c800000 kernel32.dll          5.1.2600.5781    C:\WINDOWS\system32
7c920000 ntdll.dll             5.1.2600.6055    C:\WINDOWS\system32
7d590000 shell32.dll           6.0.2900.6072    C:\WINDOWS\system32
7e550000 shdocvw.dll           6.0.2900.6148    C:\WINDOWS\system32

processes:
0000 Idle                   0   0
0004 System                 0   0   normal
0288 smss.exe               0   0   normal C:\WINDOWS\system32
02bc csrss.exe              0   0
02d4 winlogon.exe           46  14  high   C:\WINDOWS\system32
0300 services.exe           4   2   normal C:\WINDOWS\system32
030c lsass.exe              4   1   normal C:\WINDOWS\system32
03b8 svchost.exe            4   1   normal C:\WINDOWS\system32
03fc svchost.exe            0   0
045c svchost.exe            11  28  normal C:\WINDOWS\System32
04b4 svchost.exe            0   0
04fc svchost.exe            0   0
051c ZhuDongFangYu.exe      4   5   normal D:\360\360Safe\deepscan
05fc spoolsv.exe            4   4   normal C:\WINDOWS\system32
070c Explorer.EXE           317 147 normal C:\WINDOWS
07b4 ɱרҵ߰.exe 560 205 normal D:\ɱרҵ
07bc WDCertM_ABC.exe        29  12  normal C:\WINDOWS\system32\ABC\ABC SAFE CSP v3.2
07c4 ctfmon.exe             28  12  normal C:\WINDOWS\system32
00bc conime.exe             22  9   normal C:\WINDOWS\system32
018c WDKeyMonitorABC.exe    11  8   normal C:\WINDOWS\system32\ABC\ABC SAFE CSP v3.2
01a4 AlipaySecSvc.exe       4   2   normal C:\Program Files\alipay\alieditplus
00a4 svchost.exe            4   1   normal C:\WINDOWS\System32
07e4 TXPlatform.exe         8   5   normal D:\ɱרҵ\QQ\Bin
0108 QQ.exe                 734 112 normal D:\ɱרҵ\QQ\Bin
0350 AliIM.exe              293 148 normal E:\Ա\
0870 wmiprvse.exe           0   0
094c QQ.exe                 782 124 normal D:\ɱרҵ\QQ\Bin
0a98 zdsj.exe               39  29  normal G:\Ϸ\ͬ˳\ͬ˳
06e4 AliimSafe.exe          8   13  normal E:\Ա\\7.10.07C\miser
0724 alicnotify.exe         14  8   normal C:\Documents and Settings\Administrator\Application Data\alipay\cf
0c54 QQExternal.exe         90  38  normal D:\ɱרҵ\QQ\Bin
0a68 IEXPLORE.EXE           404 148 normal C:\Program Files\Internet Explorer
0b2c IEXPLORE.EXE           325 154 normal C:\Program Files\Internet Explorer
097c IEXPLORE.EXE           265 157 normal C:\Program Files\Internet Explorer
064c QQExternal.exe         109 39  normal D:\ɱרҵ\QQ\Bin
0a04 FunshionService.exe    11  7   normal G:\Program Files\Funshion Online\Funshion
1074 360Tray.exe            195 43  normal D:\360\360Safe\safemon
113c IEXPLORE.EXE           296 121 normal C:\Program Files\Internet Explorer
0d2c flashfxp.exe           250 186 normal D:\ɱרҵ\FlashFXP
0ac4 mstsc.exe              97  71  normal C:\WINDOWS\system32
1760 IEXPLORE.EXE           136 102 normal C:\Program Files\Internet Explorer

hardware:
+ IDE ATA/ATAPI 
  - NVIDIA nForce Serial ATA Controller (driver 10.3.0.46)
  - NVIDIA nForce Serial ATA Controller (driver 10.3.0.46)
  - ׼˫ͨ PCI IDE 
  - Ҫ IDE ͨ
  - Ҫ IDE ͨ
+ 
  - AMD Athlon(tm) II X2 240 Processor (driver 1.0.0.0)
  - AMD Athlon(tm) II X2 240 Processor (driver 1.0.0.0)
+ 
  - Samsung G2 Portable USB Device
  - ST310005 28AS SCSI Disk Device
+ ˿ (COM  LPT)
  - ӡ˿ (LPT1)
  - ͨѶ˿ (COM1)
+ 
  - 弴ü
+ 
  - ACPI Multiprocessor PC
+ 
  - HID Keyboard Device
+ ѧ豸
  - HID-compliant device
  - HID-compliant device
  - USB ѧ豸
  - USB ѧ豸
  -  HID ׼û豸
+ ƵϷ
  - Realtek High Definition Audio (driver 5.10.0.5919)
  - ͳƵ׽豸
  - ͳƵ
  - ý豸
  - Ƶ
  - Ƶ
+ ָ豸
  - HID-compliant mouse
+ ͨô߿
  - Standard Enhanced PCI to USB Host Controller
  - Standard OpenHCD USB Host Controller
  - USB Composite Device
  - USB Mass Storage Device
  - USB Root Hub
  - USB Root Hub
+ 
  - Realtek PCIe FE Family Controller (driver 5.732.629.2009)
+ ϵͳ豸
  - ACPI Fixed Feature Button
  - ACPI Power Button
  - AMD Low Level Device Driver (driver 1.0.1.0)
  - AMD-8111 High Precision Event Timer (driver 1.0.0.0)
  - Direct memory access controller
  - ISAPNP Read Data Port
  - Logical Disk Manager
  - Microcode Update Device
  - Microsoft ACPI-Compliant System
  - Microsoft System Management BIOS Driver
  - Microsoft  High Definition Audio  UAA 
  - Motherboard resources
  - Motherboard resources
  - Motherboard resources
  - Motherboard resources
  - Numeric data processor
  - NVIDIA nForce PCI System Management (driver 4.7.9.0)
  - NVIDIA nForce System Management Controller (driver 5.1.2600.208)
  - PCI bus
  - PCI standard host CPU bridge
  - PCI standard host CPU bridge
  - PCI standard host CPU bridge
  - PCI standard host CPU bridge
  - PCI standard host CPU bridge
  - PCI standard ISA bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard RAM Controller
  - PCI standard RAM Controller
  - Plug and Play Software Device Enumerator
  - Printer Port Logical Interface
  - Programmable interrupt controller
  - System board
  - System CMOS/real time clock
  - System speaker
  - System timer
  - Terminal Server Device Redirector
  - Terminal Server Keyboard Driver
  - Terminal Server Mouse Driver
  - Volume Manager
  - ̨ȫʾƵ
+ ʾ
  - NVIDIA GeForce 7025 / NVIDIA nForce 630a (driver 6.14.11.9634)

cpu registers:
eax = 00f8bdb0
ebx = 00ea72f8
ecx = 00000000
edx = 004193d1
esi = 00000000
edi = 0012f73c
eip = 004193d1
esp = 0012ef98
ebp = 0012f100

stack dump:
0012ef98  d1 93 41 00 de fa ed 0e - 01 00 00 00 07 00 00 00  ..A.............
0012efa8  ac ef 12 00 d1 93 41 00 - b0 bd f8 00 f8 72 ea 00  ......A......r..
0012efb8  00 00 00 00 3c f7 12 00 - 00 f1 12 00 c8 ef 12 00  ....<...........
0012efc8  3c f7 12 00 ac 3a 40 00 - 00 f1 12 00 af 95 41 00  <....:@.......A.
0012efd8  00 00 00 00 60 76 ea 00 - 0b 00 00 00 30 14 41 00  ....`v......0.A.
0012efe8  0b 00 00 00 98 7b fa 00 - 0b 00 00 00 58 49 f8 00  .....{......XI..
0012eff8  0b 8e d2 77 89 e3 d2 77 - 4f e3 d2 77 00 02 00 80  ...w...wO..w....
0012f008  20 f5 12 00 4c f0 12 00 - 34 f5 12 00 44 01 01 44  ....L...4...D..D
0012f018  00 00 00 00 00 00 00 00 - 48 02 00 00 57 01 00 00  ........H...W...
0012f028  4a 05 12 00 00 00 00 00 - 00 00 40 00 00 00 00 00  J.........@.....
0012f038  00 04 00 40 00 00 00 00 - 20 f5 12 00 6c d3 43 00  ...@........l.C.
0012f048  74 e3 d2 77 12 00 00 00 - 14 00 00 00 b8 00 1d 03  t..w............
0012f058  a7 5c 93 7c 00 00 00 00 - 00 00 00 00 00 00 00 00  .\.|............
0012f068  00 00 40 00 34 f5 12 00 - 4a 05 12 00 00 00 00 00  ..@.4...J.......
0012f078  00 00 00 40 00 00 00 00 - 00 00 00 00 00 00 00 00  ...@............
0012f088  00 00 00 00 00 00 00 00 - 4c f0 12 00 00 00 00 00  ........L.......
0012f098  00 00 00 00 07 00 00 00 - dc f0 12 00 23 03 93 7c  ............#..|
0012f0a8  a6 95 41 00 00 00 40 00 - 00 00 40 00 00 01 40 00  ..A...@...@...@.
0012f0b8  a8 f0 12 00 00 00 00 00 - e0 f0 12 00 85 03 93 7c  ...............|
0012f0c8  00 00 40 00 01 00 00 00 - 0e 00 00 00 04 f1 12 00  ..@.............

disassembling:
[...]
00445dee        push    $445fda                ; System.@HandleFinally
00445df3        push    dword ptr fs:[edx]
00445df6        mov     fs:[edx], esp
00445df9 2812   mov     eax, [ebp-4]
00445dfc        xor     edx, edx
00445dfe        mov     [eax+$248], edx
00445e04 2813   mov     eax, [ebp-4]
00445e07        xor     edx, edx
00445e09        mov     [eax+$24c], edx
00445e0f 2814   mov     eax, [ebp-4]
00445e12        xor     edx, edx
00445e14        mov     [eax+$250], edx
00445e1a 2815   xor     ebx, ebx
00445e1c 2816   mov     eax, [$7b7b10]
00445e21        mov     al, [eax]
00445e23        xor     al, 1
00445e25        mov     edx, [ebp-4]
00445e28        mov     [edx+$214], al
00445e2e 2817   mov     edx, esi
00445e30        mov     eax, [ebp-4]
00445e33      > call    +$f1c8 ($455000)       ; Controls.TWinControl.ReadState
00445e38 2818   mov     eax, [ebp-4]
00445e3b        cmp     dword ptr [eax+$23c], 0
00445e42        jz      loc_445f4e
00445e48        mov     eax, [ebp-4]
00445e4b        cmp     dword ptr [eax+$250], 0
00445e52        jle     loc_445f4e
00445e58 2820   mov     eax, [ebp-4]
00445e5b        test    byte ptr [eax+$84], $10
00445e62        jz      loc_445ea7
00445e64        mov     eax, [ebp-4]
00445e67        mov     eax, [eax+$23c]
00445e6d        mov     edx, [$7bbaac]
00445e73        cmp     eax, [edx+$34]
00445e76        jz      loc_445ea7
00445e78 2821   mov     eax, [ebp-4]
00445e7b        mov     eax, [eax+$23c]
00445e81        push    eax
00445e82        mov     eax, [$7bbaac]
00445e87        mov     eax, [eax+$34]
00445e8a        push    eax
[...]

date/time         : 2023-12-16, 22:17:39, 346ms
computer name     : XIATIAN-PC1
user name         : Administrator
operating system  : Windows NT New x64 (6.2.9200) build 9200
system language   : Chinese (Simplified)
system up time    : 1 day 9 hours
program up time   : 11 hours 59 minutes
processors        : 16x Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
physical memory   : 49012/65411 MB (free/total)
free disk space   : (C:) 56.78 GB (E:) 389.94 GB
display mode      : 3440x1440, 32 bit
process id        : $544c
allocated memory  : 76.53 MB
executable        : FlashFXP.exe
exec. date/time   : 2023-05-24 18:55
executable hash   : EBF9591E30DAFE2A9F8E05B39F791BAC
version           : 4.0.0.1543
language          : chinese simplified
callstack crc     : $772eca75, $aa111f78, $61b619f9
count             : 2
exception number  : 2
exception class   : EAccessViolation
exception message : Access violation at address 004EBAB3 in module 'FlashFXP.exe'. ȡ of address 00000025.

main thread ($80d0):
004ebab3 +0003 FlashFXP.exe ComCtrls            TTreeNode.GetTreeView
004ebaa1 +0005 FlashFXP.exe ComCtrls            TTreeNode.GetHandle
004ec244 +0008 FlashFXP.exe ComCtrls            TTreeNode.getFirstChild
0075876a +0062 FlashFXP.exe FrmMain1 19330  +17 TFrmMain.AddDirStructNodeToTree
00752e73 +04a3 FlashFXP.exe FrmMain1 17649 +102 TFrmMain.GetPath
0076924c +0194 FlashFXP.exe FrmMain1 25648  +31 TFrmMain.ChangeDir
00775ade +059a FlashFXP.exe FrmMain1 29836 +124 TFrmMain.GUIChangeDir
0077b8da +0116 FlashFXP.exe FrmMain1 32097  +17 TFrmMain.icbKeyPress
004579ef +0017 FlashFXP.exe Controls            TWinControl.KeyPress
0043c7d4 +0000 FlashFXP.exe StdCtrls            TCustomEdit.KeyPress
00457a42 +004a FlashFXP.exe Controls            TWinControl.DoKeyPress
00457a6e +000a FlashFXP.exe Controls            TWinControl.WMChar
00453e55 +0111 FlashFXP.exe Controls            TControl.WndProc
004566c2 +01ae FlashFXP.exe Controls            TWinControl.WndProc
777c8b6a +007a user32.dll                       GetWindowLongW
0050ab27 +003f FlashFXP.exe ThemeMgr            TWindowProcList.DispatchMessage
0050c920 +01b8 FlashFXP.exe ThemeMgr            TThemeManager.WinControlWindowProc
0050c9f5 +0009 FlashFXP.exe ThemeMgr            TThemeManager.PreWinControlWindowProc
0045634c +002c FlashFXP.exe Controls            TWinControl.MainWndProc
00443cbc +0014 FlashFXP.exe Forms     1529   +8 StdWndProc
777b7fdb +000b user32.dll                       DispatchMessageA
0044cabf +008b FlashFXP.exe Forms     7117  +34 TApplication.ProcessMessage
0044caf6 +000a FlashFXP.exe Forms     7155   +1 TApplication.HandleMessage
0044cdab +00bf FlashFXP.exe Forms     7259  +26 TApplication.Run
0079925c +1c70 FlashFXP.exe FlashFXP   921 +631 initialization
766dfcc7 +0017 KERNEL32.DLL                     BaseThreadInitThunk

thread $7478 (TChangeHandlerThread):
77304cc3 +013 KERNELBASE.dll                           WaitForMultipleObjects
006430e3 +07b FlashFXP.exe   UPTShellControls 4380 +13 TChangeHandlerThread.Execute
004bd5ab +fef FlashFXP.exe   madExcept                 Ebp
0041bfcc +230 FlashFXP.exe   Classes                   HexToBin
00404080 +028 FlashFXP.exe   System                    ThreadWrapper
004bd48d +ed1 FlashFXP.exe   madExcept                 Ebp
004bd4fc +f40 FlashFXP.exe   madExcept                 Ebp
766dfcc7 +017 KERNEL32.DLL                             BaseThreadInitThunk
>> created by main thread ($80d0) at:
00642d9f +01f FlashFXP.exe   UPTShellControls 4262  +2 TChangeHandlerThread.Create

thread $7f24:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $8190 (TSaveFileWorker):
77304cc3 +013 KERNELBASE.dll               WaitForMultipleObjects
00664604 +10c FlashFXP.exe   SaveToFileThd TSaveFileWorker.Execute
004bd5ad +ff1 FlashFXP.exe   madExcept     Ebp
0041bfcc +230 FlashFXP.exe   Classes       HexToBin
00404080 +028 FlashFXP.exe   System        ThreadWrapper
004bd48d +ed1 FlashFXP.exe   madExcept     Ebp
004bd4fc +f40 FlashFXP.exe   madExcept     Ebp
766dfcc7 +017 KERNEL32.DLL                 BaseThreadInitThunk
>> created by main thread ($80d0) at:
00664400 +090 FlashFXP.exe   SaveToFileThd TSaveFileWorker.Create

thread $8730:
777cb988 +028 user32.dll             GetMessageW
004bd48d +ed1 FlashFXP.exe madExcept Ebp
004bd4f7 +f3b FlashFXP.exe madExcept Ebp
766dfcc7 +017 KERNEL32.DLL           BaseThreadInitThunk
>> created by main thread ($80d0) at:
76889f68 +000 shcore.dll

thread $39ec: <priority:1>
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $7a0 (TDirSizeWorker):
77304cc3 +013 KERNELBASE.dll            WaitForMultipleObjects
00664029 +155 FlashFXP.exe   DirSizeThd TDirSizeWorker.Execute
004bd5ad +ff1 FlashFXP.exe   madExcept  Ebp
0041bfcc +230 FlashFXP.exe   Classes    HexToBin
00404080 +028 FlashFXP.exe   System     ThreadWrapper
004bd48d +ed1 FlashFXP.exe   madExcept  Ebp
004bd4fc +f40 FlashFXP.exe   madExcept  Ebp
766dfcc7 +017 KERNEL32.DLL              BaseThreadInitThunk
>> created by main thread ($80d0) at:
00663b64 +09c FlashFXP.exe   DirSizeThd TDirSizeWorker.Create

thread $85a4:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $7384:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $86f8:
772fabad +00d KERNELBASE.dll           WaitForSingleObject
004bd48d +ed1 FlashFXP.exe   madExcept Ebp
004bd4fc +f40 FlashFXP.exe   madExcept Ebp
766dfcc7 +017 KERNEL32.DLL             BaseThreadInitThunk
>> created by thread $76bc at:
75dcd94e +000 WS2_32.dll

thread $4818:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

modules:
00400000 FlashFXP.exe                    4.0.0.1543          E:\\ճ\\FlashFXP
04da0000 GrooveIntlResource.dll          14.0.4761.1000      C:\PROGRA~2\MICROS~2\Office14\2052
07660000 OneCoreUAPCommonProxyStub.dll   6.2.19041.3636      C:\Windows\System32
07d20000 WMVCore.DLL                     12.0.19041.3636     C:\Windows\system32
07f30000 StructuredQuery.dll             7.0.19041.3636      C:\Windows\System32
08200000 MSWB70804.dll                   6.2.19041.1         C:\Windows\System32
08300000 Windows.Storage.Search.dll      6.2.19041.3636      C:\Windows\system32
08470000 libeay32.dll                    1.0.0.4             E:\\ճ\\FlashFXP
085c0000 ssleay32.dll                    1.0.0.4             E:\\ճ\\FlashFXP
09170000 NL7Data0804.dll                 6.2.19041.1         C:\Windows\system32
10000000 office.odf                      14.0.4738.1000      C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures
56040000 twext.dll                       6.2.19041.3636      C:\Windows\system32
569a0000 dssenh.dll                      6.2.19041.3636      C:\Windows\system32
569f0000 Bcp47Langs.dll                  6.2.19041.3636      C:\Windows\System32
56b30000 ntlanman.dll                    6.2.19041.3636      C:\Windows\System32
56b70000 virtdisk.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
5ab10000 mfperfhelper.dll                6.2.19041.1         C:\Windows\system32
5b150000 MMDevApi.dll                    6.2.19041.3636      C:\Windows\System32
5b1c0000 samcli.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
67d30000 wintypes.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
67e10000 CoreUIComponents.dll            6.2.19041.3636      C:\Windows\System32
68090000 CoreMessaging.dll               6.2.19041.3636      C:\Windows\System32
68130000 textinputframework.dll          6.2.19041.3758      C:\Windows\SYSTEM32
6aa70000 sfc_os.dll                      6.2.19041.3636      C:\Windows\System32
6aa80000 winspool.drv                    6.2.19041.3693      C:\Windows\SYSTEM32
6adc0000 srvcli.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
6ade0000 urlmon.dll                      11.0.19041.3758     C:\Windows\System32
6afb0000 iertutil.dll                    11.0.19041.3803     C:\Windows\System32
6b260000 DAVHLPR.dll                     6.2.19041.3636      C:\Windows\System32
6b270000 tiptsf.dll                      6.2.19041.3636      C:\Program Files (x86)\Common Files\microsoft shared\ink
6b360000 DEVOBJ.dll                      6.2.19041.3636      C:\Windows\System32
6b390000 propsys.dll                     7.0.19041.3636      C:\Windows\system32
6b5d0000 TextShaping.dll                                     C:\Windows\SYSTEM32
6b680000 PortableDeviceApi.dll           6.2.19041.3636      C:\Windows\System32
6b8b0000 shacct.dll                      6.2.19041.3636      C:\Windows\System32
6b8d0000 XmlLite.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
6b920000 twinapi.appcore.dll             6.2.19041.3758      C:\Windows\system32
6bac0000 dcomp.dll                       6.2.19041.3693      C:\Windows\system32
6bc30000 dataexchange.dll                6.2.19041.3636      C:\Windows\system32
6c880000 ondemandconnroutehelper.dll     6.2.19041.3636      C:\Windows\SYSTEM32
6ca40000 VCRUNTIME140.dll                14.29.30135.0       C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211\plugins\FileSmashPro
6d0a0000 MSVCR90.dll                     9.0.30729.9625      C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589
6d150000 MSVCP90.dll                     9.0.30729.9625      C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589
6db80000 ntshrui.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
6e930000 WINNSI.DLL                      6.2.19041.3636      C:\Windows\SYSTEM32
6e940000 ATL90.DLL                       9.0.30729.4148      C:\Windows\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806
6fb10000 gdiplus.dll                     6.2.19041.3636      C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3636_none_d94ec9f9e106bba9
6fc80000 drprov.dll                      6.2.19041.3636      C:\Windows\System32
6fe00000 winhttp.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
70340000 SAMLIB.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
70e10000 d3d11.dll                       6.2.19041.3636      C:\Windows\system32
715f0000 LINKINFO.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
71630000 cscapi.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
718a0000 pcacli.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
71c40000 uxtheme.dll                     6.2.19041.3636      C:\Windows\system32
71d30000 comctl32.dll                    6.10.19041.3636     C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db
71f40000 Secur32.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
72220000 dxgi.dll                        6.2.19041.3636      C:\Windows\system32
73440000 mswsock.dll                     6.2.19041.3636      C:\Windows\system32
73540000 CRYPTBASE.DLL                   6.2.19041.3636      C:\Windows\SYSTEM32
735c0000 rsaenh.dll                      6.2.19041.3636      C:\Windows\system32
735f0000 CRYPTSP.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
73620000 MPR.dll                         6.2.19041.3636      C:\Windows\SYSTEM32
73680000 rasadhlp.dll                    6.2.19041.3636      C:\Windows\System32
73690000 fwpuclnt.dll                    6.2.19041.3636      C:\Windows\System32
736f0000 winrnr.dll                      6.2.19041.3636      C:\Windows\System32
73700000 DNSAPI.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
73790000 NLAapi.dll                      6.2.19041.3636      C:\Windows\system32
737b0000 pnrpnsp.dll                     6.2.19041.3636      C:\Windows\system32
73820000 IPHLPAPI.DLL                    6.2.19041.3636      C:\Windows\SYSTEM32
73860000 wshbth.dll                      6.2.19041.3636      C:\Windows\system32
73870000 napinsp.dll                     6.2.19041.3636      C:\Windows\system32
73920000 SSPICLI.DLL                     6.2.19041.3636      C:\Windows\SYSTEM32
73950000 FLTLIB.DLL                      6.2.19041.3636      C:\Windows\SYSTEM32
73970000 apphelp.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
73a10000 MSASN1.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
73a80000 winmm.dll                       6.2.19041.3636      C:\Windows\SYSTEM32
74300000 WINSTA.dll                      6.2.19041.3636      C:\Windows\System32
74600000 ntmarta.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
74630000 profapi.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
74650000 Wldp.dll                        6.2.19041.3636      C:\Windows\SYSTEM32
74680000 windows.storage.dll             6.2.19041.3758      C:\Windows\SYSTEM32
74ca0000 wkscli.dll                      6.2.19041.3636      C:\Windows\System32
74cf0000 netutils.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
74de0000 WININET.dll                     11.0.19041.3636     C:\Windows\SYSTEM32
75420000 kernel.appcore.dll              6.2.19041.3758      C:\Windows\SYSTEM32
75430000 QMLogEx.dll                     16.9.24712.211      C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211
75450000 QMStuck.dll                     1.1.0.1             C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211
75470000 WTSAPI32.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
75510000 USERENV.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
757d0000 version.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
757e0000 crypt32.dll                     6.2.19041.3636      C:\Windows\System32
758e0000 clbcatq.dll                     2001.12.10941.16384 C:\Windows\System32
75ad0000 combase.dll                     6.2.19041.3636      C:\Windows\System32
75d50000 SHLWAPI.dll                     6.2.19041.3636      C:\Windows\System32
75da0000 WS2_32.dll                      6.2.19041.3636      C:\Windows\System32
75e10000 shell32.dll                     6.2.19041.3758      C:\Windows\System32
763d0000 advapi32.dll                    6.2.19041.3693      C:\Windows\System32
76450000 NSI.dll                         6.2.19041.3636      C:\Windows\System32
76460000 bcrypt.dll                      6.2.19041.3636      C:\Windows\System32
76480000 WINTRUST.dll                    6.2.19041.3636      C:\Windows\System32
764d0000 GDI32.dll                       6.2.19041.3636      C:\Windows\System32
76590000 CFGMGR32.dll                    6.2.19041.3636      C:\Windows\System32
765d0000 gdi32full.dll                   6.2.19041.3803      C:\Windows\System32
766c0000 KERNEL32.DLL                    6.2.19041.3636      C:\Windows\System32
767b0000 oleaut32.dll                    6.2.19041.3636      C:\Windows\System32
76850000 shcore.dll                      6.2.19041.3636      C:\Windows\System32
768e0000 msvcp_win.dll                   6.2.19041.3636      C:\Windows\System32
76960000 sechost.dll                     6.2.19041.3636      C:\Windows\System32
76a50000 SETUPAPI.dll                    6.2.19041.3636      C:\Windows\System32
76e90000 msvcrt.dll                      7.0.19041.3636      C:\Windows\System32
76f50000 comdlg32.dll                    6.2.19041.3758      C:\Windows\System32
77000000 PSAPI.DLL                       6.2.19041.3636      C:\Windows\System32
77070000 bcryptPrimitives.dll            6.2.19041.3636      C:\Windows\System32
770d0000 MSCTF.dll                       6.2.19041.3636      C:\Windows\System32
771b0000 IMM32.DLL                       6.2.19041.3636      C:\Windows\System32
771e0000 KERNELBASE.dll                  6.2.19041.3803      C:\Windows\System32
77440000 win32u.dll                      6.2.19041.3803      C:\Windows\System32
77460000 ucrtbase.dll                    6.2.19041.3636      C:\Windows\System32
77580000 ole32.dll                       6.2.19041.3636      C:\Windows\System32
776d0000 RPCRT4.dll                      6.2.19041.3758      C:\Windows\System32
77790000 user32.dll                      6.2.19041.3803      C:\Windows\System32
77940000 ntdll.dll                       6.2.19041.3693      C:\Windows\SYSTEM32
77af0000 wsock32.dll                     6.2.19041.1         C:\Windows\SYSTEM32
77b00000 thumbcache.dll                  6.2.19041.3636      C:\Windows\System32
77b50000 Windows.StateRepositoryPS.dll   6.2.19041.3636      C:\Windows\System32
78e80000 GROOVEEX.DLL                    14.0.4761.1000      C:\PROGRA~2\MICROS~2\Office14
794e0000 Windows.FileExplorer.Common.dll 6.2.19041.3636      C:\Windows\System32
79600000 dlnashext.dll                   6.2.19041.3636      C:\Windows\System32
796c0000 FileSmashMenu.dll               16.1.20399.201      C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211\plugins\FileSmashPro
79720000 QMContextScan.dll               16.9.24712.211      C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211
79770000 IDStore.dll                     6.2.19041.3636      C:\Windows\System32
797f0000 wlidprov.dll                    6.2.19041.3758      C:\Windows\System32
79f80000 provsvc.dll                     6.2.19041.3636      C:\Windows\System32
7a060000 explorerframe.dll               6.2.19041.3758      C:\Windows\system32
7a660000 MSVCP140.dll                    14.29.30135.0       C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211\plugins\FileSmashPro
7b1f0000 WindowsCodecs.dll               6.2.19041.3636      C:\Windows\SYSTEM32
7b370000 policymanager.dll               6.2.19041.3636      C:\Windows\SYSTEM32
7b400000 msvcp110_win.dll                6.2.19041.3636      C:\Windows\SYSTEM32
7b6e0000 davclnt.dll                     6.2.19041.3636      C:\Windows\System32
7b700000 DevDispItemProvider.dll         6.2.19041.3636      C:\Windows\System32
7b720000 audiodev.dll                    6.2.19041.1         C:\Windows\system32
7b760000 WMASF.DLL                       12.0.19041.1        C:\Windows\system32
7c200000 wpdshext.dll                    6.2.19041.3636      C:\Windows\system32
7c290000 edputil.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
7c2b0000 appresolver.dll                 6.2.19041.3636      C:\Windows\System32
7c330000 SLC.dll                         6.2.19041.3636      C:\Windows\System32
7c350000 sppc.dll                        6.2.19041.3636      C:\Windows\System32
7c370000 OneCoreCommonProxyStub.dll      6.2.19041.3758      C:\Windows\System32
7c3b0000 olepro32.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
7c8b0000 PlayToDevice.dll                6.2.19041.3636      C:\Windows\System32
7c900000 FileSyncShell.dll               23.221.1024.2       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Microsoft\OneDrive\23.221.1024.0002\i386

processes:
0000 Idle                        0 0   0
0004 System                      0 0   0
016c Registry                    0 0   0
0360 smss.exe                    0 0   0
0374 csrss.exe                   0 0   0
04b4 wininit.exe                 0 0   0
04bc csrss.exe                   1 0   0
04fc services.exe                0 0   0
0504 lsass.exe                   0 0   0
058c svchost.exe                 0 0   0
05ac fontdrvhost.exe             0 0   0
05d0 WUDFHost.exe                0 0   0
061c svchost.exe                 0 0   0
064c svchost.exe                 0 0   0
06a4 winlogon.exe                1 0   0
06fc fontdrvhost.exe             1 0   0
0744 dwm.exe                     1 0   0
07a8 svchost.exe                 0 0   0
07e4 svchost.exe                 0 0   0
07ec svchost.exe                 0 0   0
0434 svchost.exe                 0 0   0
0460 svchost.exe                 0 0   0
0464 svchost.exe                 0 0   0
0544 svchost.exe                 0 0   0
0834 svchost.exe                 0 0   0
0878 svchost.exe                 0 0   0
08a4 svchost.exe                 0 0   0
08d4 svchost.exe                 0 0   0
0910 svchost.exe                 0 0   0
0944 svchost.exe                 0 0   0
0994 svchost.exe                 0 0   0
0a4c QQPCRTP.exe                 0 0   0
0a54 qmbsrv.exe                  0 0   0
0a98 svchost.exe                 0 0   0
0b04 svchost.exe                 0 0   0
0b40 svchost.exe                 0 0   0
0ba0 svchost.exe                 0 0   0
0bcc svchost.exe                 0 0   0
0824 svchost.exe                 0 0   0
0a10 svchost.exe                 0 0   0
0c40 svchost.exe                 0 0   0
0c48 svchost.exe                 0 0   0
0ca8 svchost.exe                 0 0   0
0d74 amdfendrsr.exe              0 0   0
0d8c atiesrxx.exe                0 0   0
0e1c svchost.exe                 0 0   0
0e24 svchost.exe                 0 0   0
0e4c atieclxx.exe                1 0   0
0e5c svchost.exe                 0 0   0
0e64 svchost.exe                 0 0   0
0f10 svchost.exe                 0 0   0
0f58 svchost.exe                 0 0   0
0f60 svchost.exe                 0 0   0
1118 svchost.exe                 0 0   0
1184 svchost.exe                 0 0   0
11a4 dasHost.exe                 0 0   0
1264 svchost.exe                 0 0   0
12cc svchost.exe                 0 0   0
1368 svchost.exe                 0 0   0
1370 svchost.exe                 0 0   0
1398 svchost.exe                 0 0   0
10f8 svchost.exe                 0 0   0
1104 svchost.exe                 0 0   0
110c spoolsv.exe                 0 0   0
1430 svchost.exe                 0 0   0
1450 svchost.exe                 0 0   0
156c svchost.exe                 0 0   0
1580 svchost.exe                 0 0   0
1588 svchost.exe                 0 0   0
1590 svchost.exe                 0 0   0
1598 svchost.exe                 0 0   0
15a0 yyldrsvr.exe                0 0   0
15c0 SunloginClient.exe          0 0   0
16b4 svchost.exe                 0 0   0
16c4 svchost.exe                 0 0   0
1704 svchost.exe                 0 0   0
1a08 svchost.exe                 0 0   0
1a10 SearchIndexer.exe           0 0   0
1b70 SunloginClient.exe          0 0   0
1e00 sihost.exe                  1 0   7   normal       C:\Windows\System32
1e24 svchost.exe                 1 0   1   normal       C:\Windows\System32
1e4c svchost.exe                 1 0   4   normal       C:\Windows\System32
1ee4 svchost.exe                 0 0   0
1f1c taskhostw.exe               1 8   6   normal       C:\Windows\System32
1f7c svchost.exe                 0 0   0
1fdc ctfmon.exe                  1 0   0
1c74 explorer.exe                1 698 454 normal       C:\Windows
1cd4 svchost.exe                 0 0   0
20a0 svchost.exe                 1 0   8   normal       C:\Windows\System32
21c0 ChsIME.exe                  1 0   0
23d4 StartMenuExperienceHost.exe 1 7   18  normal       C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
2118 svchost.exe                 0 0   0
1dbc RuntimeBroker.exe           1 40  1   normal       C:\Windows\System32
2240 SearchApp.exe               1 14  58  normal       C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy
2360 RuntimeBroker.exe           1 40  4   normal       C:\Windows\System32
1390 svchost.exe                 0 0   0
2144 ShellExperienceHost.exe     1 6   48  normal       C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy
24f8 TextInputHost.exe           1 0   49  normal       C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy
28d8 svchost.exe                 0 0   0
2b14 RuntimeBroker.exe           1 0   1   normal       C:\Windows\System32
2d18 svchost.exe                 0 0   0
2e80 PhoneExperienceHost.exe     1 0   18  normal       C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23092.158.0_x64__8wekyb3d8bbwe
2c84 RuntimeBroker.exe           1 0   1   normal       C:\Windows\System32
3154 SecurityHealthService.exe   0 0   0
3214 RuntimeBroker.exe           1 40  6   normal       C:\Windows\System32
3338 RAVCpl64.exe                1 70  18  normal       C:\Program Files\Realtek\Audio\HDA
31b4 SunloginClient.exe          1 198 168 normal       C:\Program Files\Oray\SunLogin\SunloginClient
3284 dllhost.exe                 1 0   3   normal       C:\Windows\System32
2d10 QQ.exe                      1 159 212 normal       C:\Program Files (x86)\Tencent\QQ\Bin
36cc svchost.exe                 1 0   1   normal       C:\Windows\System32
1f84 SgrmBroker.exe              0 0   0
372c svchost.exe                 0 0   0
0e7c TXPlatform.exe              1 0   2   normal       C:\Program Files (x86)\Tencent\QQ\Bin
3510 QQ.exe                      1 162 171 normal       C:\Program Files (x86)\Tencent\QQ\Bin
2398 QQ.exe                      1 144 154 normal       C:\Program Files (x86)\Tencent\QQ\Bin
3544 QQGuild.exe                 1 52  52  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2f60 QQGuild.exe                 1 3   17  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1c5c QQGuild.exe                 1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
3398 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2338 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
0a74 QQGuild.exe                 1 52  53  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
20f4 QQGuild.exe                 1 3   17  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2d2c QQGuild.exe                 1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2c28 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2de8 QQGuild.exe                 1 52  52  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1d2c QQGuild.exe                 1 3   17  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
07fc QQGuild.exe                 1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
0c34 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1b50 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1bdc QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
0b98 ߰.exe                  1 134 45  normal       E:\\߰
28d4 .exe              1 103 116 normal       D:\
3ae0 ѯ.exe                    1 182 83  normal       E:\\ճ\
3fcc MsMpEng.exe                 0 0   0
32a0 ApplicationFrameHost.exe    1 12  2   normal       C:\Windows\System32
3b00 svchost.exe                 0 0   0
269c svchost.exe                 0 0   0
15dc UserOOBEBroker.exe          1 0   1   normal       C:\Windows\System32\oobe
3e54 svchost.exe                 0 0   0
3dfc NisSrv.exe                  0 0   0
3f08 svchost.exe                 0 0   0
3e94 sesvc.exe                   1 0   17  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\360se6\Application\components\sesvc
3d48 sesvr.exe                   1 14  10  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\360se6\Application\components\sesvr\13.0.0.1323
322c SeAppService.exe            1 17  18  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\360se6\Application\components\seapp
240c svchost.exe                 0 0   0
4958 svchost.exe                 0 0   0
4b94 CompPkgSrv.exe              1 0   1   normal       C:\Windows\System32
50cc svchost.exe                 0 0   0
6710 taskhostw.exe               1 0   0
6f18 OSPPSVC.EXE                 0 0   0
6e24 svchost.exe                 1 0   1   normal       C:\Windows\System32
61bc MpCmdRun.exe                0 0   0
73b0 svchost.exe                 0 0   0
544c FlashFXP.exe                1 270 225 normal       E:\\ճ\\FlashFXP
8424 FlashFXP.exe                1 253 182 normal       E:\\ճ\\FlashFXP
6794 v2.0[].exe        1 0   0
6f40 mstsc.exe                   1 115 76  normal       C:\Windows\System32
7af0 explorer.exe                1 404 150 normal       C:\Windows
3fac v2.0.exe            1 0   0
7b98 WeChat.exe                  1 131 81  normal       C:\Program Files\Tencent\WeChat
274c mmcrashpad_handler64.exe    1 0   4   normal       C:\Program Files\Tencent\WeChat\[3.9.8.15]
32b0 WeChatAppEx.exe             1 14  42  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
7f50 WeChatAppEx.exe             1 0   4   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
5774 WeChatAppEx.exe             1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
7318 WeChatAppEx.exe             1 6   50  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
77e8 WeChatPlayer.exe            1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\ThumbPlayer\4067\extracted
72fc WeChatUtility.exe           1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\WeChatUtility\8085\extracted
0b18 WeChatOCR.exe               1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\WeChatOCR\7061\extracted
4024 WeChatAppEx.exe             1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
53b8 WeChatAppEx.exe             1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
70a0 WeChatAppEx.exe             1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
35bc WeChatAppEx.exe             1 0   0   idle         C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
407c WeChatAppEx.exe             1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
793c svchost.exe                 0 0   0
87a8 backgroundTaskHost.exe      1 0   2   normal       C:\Windows\System32
60a4 RuntimeBroker.exe           1 0   1   normal       C:\Windows\System32
7a60 audiodg.exe                 0 0   0

hardware:
+ {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
  - Fax
  - Microsoft Print to PDF
  - Microsoft XPS Document Writer
  - OneNote for Windows 10
  -  OneNote 2010
  - ӡ
+ {36fc9e60-c465-11cf-8056-444553540000}
  - Generic USB Hub
  - Generic USB Hub
  - Intel(R) USB 3.0 չ - 1.0 (Microsoft)
  - Standard Enhanced PCI to USB Host Controller
  - Standard Enhanced PCI to USB Host Controller
  - USB Composite Device
  - USB Composite Device
  - USB Composite Device
  - USB Composite Device
  - USB Root Hub
  - USB Root Hub
  - USB 洢豸
  - USB (USB 3.0)
  - ͨ USB 
+ {4d36e966-e325-11ce-bfc1-08002be10318}
  -  ACPI x64 ĵ
+ {4d36e967-e325-11ce-bfc1-08002be10318}
  - REECHO V3000 512GB
  - TOSHIBA MK6465GSX
  - XSTAR SS D 480GB USB Device
+ {4d36e968-e325-11ce-bfc1-08002be10318}
  - AMD Radeon RX 580 2048SP (driver 31.0.12027.9001)
  - OrayIddDriver Device (driver 17.1.58.818)
+ {4d36e96a-e325-11ce-bfc1-08002be10318}
  - ׼ SATA AHCI 
+ {4d36e96b-e325-11ce-bfc1-08002be10318}
  - HID Keyboard Device
  - HID Keyboard Device
  - HID Keyboard Device
+ {4d36e96c-e325-11ce-bfc1-08002be10318}
  - AMD High Definition Audio Device (driver 10.0.1.7)
  - BCC950 ConferenceCam
  - Realtek High Definition Audio (driver 6.0.8924.1)
+ {4d36e96e-e325-11ce-bfc1-08002be10318}
  - ͨü弴ü
+ {4d36e96f-e325-11ce-bfc1-08002be10318}
  - HID-compliant mouse
  - HID-compliant mouse
  - HID-compliant mouse
+ {4d36e972-e325-11ce-bfc1-08002be10318}
  - Realtek PCIe GbE Family Controller
+ {4d36e978-e325-11ce-bfc1-08002be10318}
  - ͨŶ˿ (COM1)
+ {4d36e97b-e325-11ce-bfc1-08002be10318}
  - Microsoft 洢ռ
  - ׼ NVM Express 
+ {4d36e97d-e325-11ce-bfc1-08002be10318}
  - ACPI Դť
  - ACPI ̶ܰť
  - ACPI ģ豸
  - ACPI ģ豸
  - AMD Crash Defender (driver 22.20.0.2)
  - High Definition Audio 
  - High Definition Audio 
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel(R) C610 series/X99 chipset LPC Controller - 8D44 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset PCI Express Root Port #1 - 8D10 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset PCI Express Root Port #4 - 8D16 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset SMBus Controller - 8D22 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset SPSR - 8D7C (driver 10.1.1.38)
  - Intel(R) Xeon(R) E7 v3/Xeon(R) E5 v3/Core i7 DMI2 - 2F00 (driver 10.1.2.9)
  - Intel(R) Xeon(R) E7 v3/Xeon(R) E5 v3/Core i7 PCI Express Root Port 1 - 2F02 (driver 10.1.2.9)
  - Intel(R) Xeon(R) E7 v3/Xeon(R) E5 v3/Core i7 PCI Express Root Port 3 - 2F08 (driver 10.1.2.9)
  - Microsoft ACPI-Compliant System
  - Microsoft Hyper-V ⻯ṹ
  - Microsoft System Management BIOS Driver
  - Microsoft Windows Management Interface for ACPI
  - Microsoft Windows Management Interface for ACPI
  - Microsoft 
  - Microsoft ʾ
  - Microsoft ö
  - NDIS ö
  - Pci Bus (driver 22.20.0.1)
  - PCI Express 
  - PCI 
  - PCI 
  - UMBus Root Bus Enumerator
  - ö
  - ߼ɱжϿ
  - ߾¼ʱ
  - 弴豸ö
  - 
  - ɱжϿ
  - ĸԴ
  - ĸԴ
  - ֵݴ
  - ϵͳ CMOS/ʵʱʱ
  - ϵͳʱ
  - ϵͳ
  - Զ豸ض
  - ֱڴʿ
+ {50127dc3-0f36-415e-a6cc-4cb3be910b65}
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
+ {5c4c3332-344d-483c-8739-259e934c9cc8}
  - ͨ
+ {62f9c741-b25a-46ce-b54c-9bccce08b6f2}
  - Microsoft Device Association Root Enumerator
  - Microsoft GS ϳ
  - Microsoft Radio Device Enumeration Bus
  - Microsoft RRAS Root Enumerator
  - J8
+ {745a17a0-74d3-11d0-b6fe-00a0c90f57da}
  - HID-compliant game controller
  - Microsoft Input Configuration Device
  - Oray VHID (driver 6.1.7600.16385)
  - USB 豸
  - USB 豸
  - USB 豸
  - USB 豸
  - USB 豸
  - USB 豸
  -  HID ׼ĵ绰
  -  HID ׼ĹӦ̶豸
  -  HID ׼ĹӦ̶豸
  -  HID ׼ĹӦ̶豸
  -  HID ׼ֻ
  -  HID ׼ϵͳ
  -  HID ׼û豸
  -  HID ׼û豸
  -  HID ׼û豸
  -  HID ׼û豸
+ {c166523c-fe0c-4a94-a586-f1a80cfbbf3e}
  - 4 - U34G2G4R3 (AMD High Definition Audio Device)
  - Realtek Digital Output (Realtek High Definition Audio)
  - Ͳ (2- BCC950 ConferenceCam)
  - Ͳ (2- BCC950 ConferenceCam)
+ {ca3e7ab9-b4c3-4ae6-8251-579ef933890f}
  - BCC950 ConferenceCam

cpu registers:
eax = 00000021
ebx = 027abc30
ecx = 00000001
edx = 03111d98
esi = 00000000
edi = 027abc30
eip = 004ebab3
esp = 0019f9b0
ebp = 0019f9e8

stack dump:
0019f9b0  a6 ba 4e 00 30 bc 7a 02 - 49 c2 4e 00 00 00 00 00  ..N.0.z.I.N.....
0019f9c0  00 00 00 00 6f 87 75 00 - 34 2a 41 00 d0 f0 81 02  ....o.u.4*A.....
0019f9d0  02 00 00 00 73 6e 41 00 - 00 fa 19 02 d0 1c 11 03  ....snA.........
0019f9e0  d0 f0 81 02 00 8f 82 02 - 54 fa 19 00 78 2e 75 00  ........T...x.u.
0019f9f0  30 bc 7a 02 02 00 00 00 - e8 c3 7e 04 a0 c3 7e 04  0.z.......~...~.
0019fa00  0c fa 19 00 ac 3a 40 00 - 54 fa 19 00 5c fa 19 00  .....:@.T...\...
0019fa10  ac 3a 40 00 54 fa 19 00 - 00 8f 82 02 2e 02 00 00  .:@.T...........
0019fa20  00 00 00 00 00 00 00 00 - 00 00 00 00 02 00 00 00  ................
0019fa30  00 00 00 00 25 00 00 00 - 78 63 13 03 00 00 00 00  ....%...xc......
0019fa40  00 00 00 01 00 00 00 00 - 90 f8 7b 02 b0 5f 78 02  ..........{.._x.
0019fa50  00 8f 82 02 88 fa 19 00 - 51 92 76 00 9c fa 19 00  ........Q.v.....
0019fa60  ac 3a 40 00 88 fa 19 00 - 01 00 00 00 00 00 00 00  .:@.............
0019fa70  00 00 00 00 00 00 00 00 - f5 ff 01 01 00 00 00 00  ................
0019fa80  b0 5f 78 02 00 8f 82 02 - e8 fa 19 00 e3 5a 77 00  ._x..........Zw.
0019fa90  1a fb 19 00 01 00 00 00 - 01 00 00 00 a8 fa 19 00  ................
0019faa0  ac 3a 40 00 e8 fa 19 00 - f8 fa 19 00 ac 3a 40 00  .:@..........:@.
0019fab0  e8 fa 19 00 00 8f 82 02 - 2e 02 00 00 02 1a 87 02  ................
0019fac0  00 00 00 00 26 00 00 00 - ff ff ff ff 00 00 00 00  ....&...........
0019fad0  00 00 00 00 00 00 00 00 - 80 63 13 00 00 00 00 00  .........c......
0019fae0  b0 5f 78 02 00 8f 82 02 - 28 fb 19 00 df b8 77 00  ._x.....(.....w.

disassembling:
[...]
00758729         mov     edx, $75888c
0075872e         call    -$35429b ($404498)     ; System.@LStrCmp
00758733         jz      loc_758744
00758735         mov     eax, [ebp+$10]
00758738         mov     edx, $758898
0075873d         call    -$3542aa ($404498)     ; System.@LStrCmp
00758742         jnz     loc_75874b
00758744 19318   mov     eax, edi
00758746 19319   jmp     loc_758879
0075874b 19322   mov     ecx, [ebp-$c]
0075874e         mov     edx, [ebp-8]
00758751         mov     eax, [ebp-4]
00758754         call    +$100bb ($768814)      ; FrmMain1.TFrmMain.NodeTable_Lookup
00758759         mov     esi, eax
0075875b 19323   test    esi, esi
0075875d         jz      loc_758766
0075875f 19325   mov     eax, esi
00758761 19326   jmp     loc_758879
00758766 19329   xor     ebx, ebx
00758768 19330   mov     eax, edi
0075876a       > call    -$26c533 ($4ec23c)     ; ComCtrls.TTreeNode.getFirstChild
0075876f         mov     esi, eax
00758771         jmp     loc_75878d
00758773 19334   mov     eax, [esi+8]
00758776         mov     edx, [ebp+$10]
00758779         call    -$3542e6 ($404498)     ; System.@LStrCmp
0075877e         jnz     loc_758784
00758780 19335   mov     bl, 1
00758782         jmp     loc_75878d
00758784 19337   mov     eax, esi
00758786         call    -$26c5d7 ($4ec1b4)     ; ComCtrls.TTreeNode.getNextSibling
0075878b         mov     esi, eax
0075878d 19332   test    esi, esi
0075878f         jz      loc_758795
00758791         test    bl, bl
00758793         jz      loc_758773
00758795 19340   test    bl, bl
00758797         jnz     loc_758877
0075879d 19342   mov     eax, [ebp-8]
007587a0         mov     eax, [eax+$254]
007587a6         mov     ecx, [ebp+$10]
[...]

date/time         : 2023-12-16, 22:17:50, 175ms
computer name     : XIATIAN-PC1
user name         : Administrator
operating system  : Windows NT New x64 (6.2.9200) build 9200
system language   : Chinese (Simplified)
system up time    : 1 day 9 hours
program up time   : 11 hours 59 minutes
processors        : 16x Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
physical memory   : 49006/65411 MB (free/total)
free disk space   : (C:) 56.78 GB (E:) 389.94 GB
display mode      : 3440x1440, 32 bit
process id        : $544c
allocated memory  : 76.75 MB
executable        : FlashFXP.exe
exec. date/time   : 2023-05-24 18:55
executable hash   : EBF9591E30DAFE2A9F8E05B39F791BAC
version           : 4.0.0.1543
language          : chinese simplified
callstack crc     : $772eca75, $08bd6a96, $3f46b468
count             : 2
exception number  : 5
exception class   : EAccessViolation
exception message : Access violation at address 004EBAB3 in module 'FlashFXP.exe'. ȡ of address 00000025.

main thread ($80d0):
004ebab3 +0003 FlashFXP.exe ComCtrls            TTreeNode.GetTreeView
004ebaa1 +0005 FlashFXP.exe ComCtrls            TTreeNode.GetHandle
004ec244 +0008 FlashFXP.exe ComCtrls            TTreeNode.getFirstChild
0075876a +0062 FlashFXP.exe FrmMain1 19330  +17 TFrmMain.AddDirStructNodeToTree
00752e73 +04a3 FlashFXP.exe FrmMain1 17649 +102 TFrmMain.GetPath
0076924c +0194 FlashFXP.exe FrmMain1 25648  +31 TFrmMain.ChangeDir
00775ade +059a FlashFXP.exe FrmMain1 29836 +124 TFrmMain.GUIChangeDir
0072ffb6 +00d6 FlashFXP.exe FrmMain1  4963  +20 TFrmMain.LvDblClick
00454009 +0015 FlashFXP.exe Controls            TControl.DblClick
0045412c +0034 FlashFXP.exe Controls            TControl.WMLButtonDblClk
004f6c55 +0051 FlashFXP.exe ComCtrls            TCustomListView.WndProc
0050ab27 +003f FlashFXP.exe ThemeMgr            TWindowProcList.DispatchMessage
0050b80d +004d FlashFXP.exe ThemeMgr            TThemeManager.ListviewWindowProc
0050c985 +0009 FlashFXP.exe ThemeMgr            TThemeManager.PreListviewWindowProc
0045634c +002c FlashFXP.exe Controls            TWinControl.MainWndProc
00443cbc +0014 FlashFXP.exe Forms     1529   +8 StdWndProc
777c59d6 +0016 user32.dll                       CallWindowProcW
777b7fdb +000b user32.dll                       DispatchMessageA
0044cabf +008b FlashFXP.exe Forms     7117  +34 TApplication.ProcessMessage
0044caf6 +000a FlashFXP.exe Forms     7155   +1 TApplication.HandleMessage
0044cdab +00bf FlashFXP.exe Forms     7259  +26 TApplication.Run
0079925c +1c70 FlashFXP.exe FlashFXP   921 +631 initialization
766dfcc7 +0017 KERNEL32.DLL                     BaseThreadInitThunk

thread $7478 (TChangeHandlerThread):
77304cc3 +013 KERNELBASE.dll                           WaitForMultipleObjects
006430e3 +07b FlashFXP.exe   UPTShellControls 4380 +13 TChangeHandlerThread.Execute
004bd5ab +fef FlashFXP.exe   madExcept                 Ebp
0041bfcc +230 FlashFXP.exe   Classes                   HexToBin
00404080 +028 FlashFXP.exe   System                    ThreadWrapper
004bd48d +ed1 FlashFXP.exe   madExcept                 Ebp
004bd4fc +f40 FlashFXP.exe   madExcept                 Ebp
766dfcc7 +017 KERNEL32.DLL                             BaseThreadInitThunk
>> created by main thread ($80d0) at:
00642d9f +01f FlashFXP.exe   UPTShellControls 4262  +2 TChangeHandlerThread.Create

thread $7f24:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $8190 (TSaveFileWorker):
77304cc3 +013 KERNELBASE.dll               WaitForMultipleObjects
00664604 +10c FlashFXP.exe   SaveToFileThd TSaveFileWorker.Execute
004bd5ad +ff1 FlashFXP.exe   madExcept     Ebp
0041bfcc +230 FlashFXP.exe   Classes       HexToBin
00404080 +028 FlashFXP.exe   System        ThreadWrapper
004bd48d +ed1 FlashFXP.exe   madExcept     Ebp
004bd4fc +f40 FlashFXP.exe   madExcept     Ebp
766dfcc7 +017 KERNEL32.DLL                 BaseThreadInitThunk
>> created by main thread ($80d0) at:
00664400 +090 FlashFXP.exe   SaveToFileThd TSaveFileWorker.Create

thread $8730:
777cb988 +028 user32.dll             GetMessageW
004bd48d +ed1 FlashFXP.exe madExcept Ebp
004bd4f7 +f3b FlashFXP.exe madExcept Ebp
766dfcc7 +017 KERNEL32.DLL           BaseThreadInitThunk
>> created by main thread ($80d0) at:
76889f68 +000 shcore.dll

thread $39ec: <priority:1>
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $7a0 (TDirSizeWorker):
77304cc3 +013 KERNELBASE.dll            WaitForMultipleObjects
00664029 +155 FlashFXP.exe   DirSizeThd TDirSizeWorker.Execute
004bd5ad +ff1 FlashFXP.exe   madExcept  Ebp
0041bfcc +230 FlashFXP.exe   Classes    HexToBin
00404080 +028 FlashFXP.exe   System     ThreadWrapper
004bd48d +ed1 FlashFXP.exe   madExcept  Ebp
004bd4fc +f40 FlashFXP.exe   madExcept  Ebp
766dfcc7 +017 KERNEL32.DLL              BaseThreadInitThunk
>> created by main thread ($80d0) at:
00663b64 +09c FlashFXP.exe   DirSizeThd TDirSizeWorker.Create

thread $85a4:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $7384:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $86f8:
772fabad +00d KERNELBASE.dll           WaitForSingleObject
004bd48d +ed1 FlashFXP.exe   madExcept Ebp
004bd4fc +f40 FlashFXP.exe   madExcept Ebp
766dfcc7 +017 KERNEL32.DLL             BaseThreadInitThunk
>> created by thread $76bc at:
75dcd94e +000 WS2_32.dll

thread $4818:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

modules:
00400000 FlashFXP.exe                    4.0.0.1543          E:\\ճ\\FlashFXP
04da0000 GrooveIntlResource.dll          14.0.4761.1000      C:\PROGRA~2\MICROS~2\Office14\2052
07660000 OneCoreUAPCommonProxyStub.dll   6.2.19041.3636      C:\Windows\System32
07d20000 WMVCore.DLL                     12.0.19041.3636     C:\Windows\system32
07f30000 StructuredQuery.dll             7.0.19041.3636      C:\Windows\System32
08200000 MSWB70804.dll                   6.2.19041.1         C:\Windows\System32
08300000 Windows.Storage.Search.dll      6.2.19041.3636      C:\Windows\system32
08470000 libeay32.dll                    1.0.0.4             E:\\ճ\\FlashFXP
085c0000 ssleay32.dll                    1.0.0.4             E:\\ճ\\FlashFXP
09170000 NL7Data0804.dll                 6.2.19041.1         C:\Windows\system32
10000000 office.odf                      14.0.4738.1000      C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures
56040000 twext.dll                       6.2.19041.3636      C:\Windows\system32
569a0000 dssenh.dll                      6.2.19041.3636      C:\Windows\system32
569f0000 Bcp47Langs.dll                  6.2.19041.3636      C:\Windows\System32
56b30000 ntlanman.dll                    6.2.19041.3636      C:\Windows\System32
56b70000 virtdisk.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
5ab10000 mfperfhelper.dll                6.2.19041.1         C:\Windows\system32
5b150000 MMDevApi.dll                    6.2.19041.3636      C:\Windows\System32
5b1c0000 samcli.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
67d30000 wintypes.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
67e10000 CoreUIComponents.dll            6.2.19041.3636      C:\Windows\System32
68090000 CoreMessaging.dll               6.2.19041.3636      C:\Windows\System32
68130000 textinputframework.dll          6.2.19041.3758      C:\Windows\SYSTEM32
6aa70000 sfc_os.dll                      6.2.19041.3636      C:\Windows\System32
6aa80000 winspool.drv                    6.2.19041.3693      C:\Windows\SYSTEM32
6adc0000 srvcli.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
6ade0000 urlmon.dll                      11.0.19041.3758     C:\Windows\System32
6afb0000 iertutil.dll                    11.0.19041.3803     C:\Windows\System32
6b260000 DAVHLPR.dll                     6.2.19041.3636      C:\Windows\System32
6b270000 tiptsf.dll                      6.2.19041.3636      C:\Program Files (x86)\Common Files\microsoft shared\ink
6b360000 DEVOBJ.dll                      6.2.19041.3636      C:\Windows\System32
6b390000 propsys.dll                     7.0.19041.3636      C:\Windows\system32
6b5d0000 TextShaping.dll                                     C:\Windows\SYSTEM32
6b680000 PortableDeviceApi.dll           6.2.19041.3636      C:\Windows\System32
6b8b0000 shacct.dll                      6.2.19041.3636      C:\Windows\System32
6b8d0000 XmlLite.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
6b920000 twinapi.appcore.dll             6.2.19041.3758      C:\Windows\system32
6bac0000 dcomp.dll                       6.2.19041.3693      C:\Windows\system32
6bc30000 dataexchange.dll                6.2.19041.3636      C:\Windows\system32
6c880000 ondemandconnroutehelper.dll     6.2.19041.3636      C:\Windows\SYSTEM32
6ca40000 VCRUNTIME140.dll                14.29.30135.0       C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211\plugins\FileSmashPro
6d0a0000 MSVCR90.dll                     9.0.30729.9625      C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589
6d150000 MSVCP90.dll                     9.0.30729.9625      C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589
6db80000 ntshrui.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
6e930000 WINNSI.DLL                      6.2.19041.3636      C:\Windows\SYSTEM32
6e940000 ATL90.DLL                       9.0.30729.4148      C:\Windows\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806
6fb10000 gdiplus.dll                     6.2.19041.3636      C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3636_none_d94ec9f9e106bba9
6fc80000 drprov.dll                      6.2.19041.3636      C:\Windows\System32
6fe00000 winhttp.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
70340000 SAMLIB.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
70e10000 d3d11.dll                       6.2.19041.3636      C:\Windows\system32
715f0000 LINKINFO.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
71630000 cscapi.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
718a0000 pcacli.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
71c40000 uxtheme.dll                     6.2.19041.3636      C:\Windows\system32
71d30000 comctl32.dll                    6.10.19041.3636     C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db
71f40000 Secur32.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
72220000 dxgi.dll                        6.2.19041.3636      C:\Windows\system32
73440000 mswsock.dll                     6.2.19041.3636      C:\Windows\system32
73540000 CRYPTBASE.DLL                   6.2.19041.3636      C:\Windows\SYSTEM32
735c0000 rsaenh.dll                      6.2.19041.3636      C:\Windows\system32
735f0000 CRYPTSP.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
73620000 MPR.dll                         6.2.19041.3636      C:\Windows\SYSTEM32
73680000 rasadhlp.dll                    6.2.19041.3636      C:\Windows\System32
73690000 fwpuclnt.dll                    6.2.19041.3636      C:\Windows\System32
736f0000 winrnr.dll                      6.2.19041.3636      C:\Windows\System32
73700000 DNSAPI.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
73790000 NLAapi.dll                      6.2.19041.3636      C:\Windows\system32
737b0000 pnrpnsp.dll                     6.2.19041.3636      C:\Windows\system32
73820000 IPHLPAPI.DLL                    6.2.19041.3636      C:\Windows\SYSTEM32
73860000 wshbth.dll                      6.2.19041.3636      C:\Windows\system32
73870000 napinsp.dll                     6.2.19041.3636      C:\Windows\system32
73920000 SSPICLI.DLL                     6.2.19041.3636      C:\Windows\SYSTEM32
73950000 FLTLIB.DLL                      6.2.19041.3636      C:\Windows\SYSTEM32
73970000 apphelp.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
73a10000 MSASN1.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
73a80000 winmm.dll                       6.2.19041.3636      C:\Windows\SYSTEM32
74300000 WINSTA.dll                      6.2.19041.3636      C:\Windows\System32
74600000 ntmarta.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
74630000 profapi.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
74650000 Wldp.dll                        6.2.19041.3636      C:\Windows\SYSTEM32
74680000 windows.storage.dll             6.2.19041.3758      C:\Windows\SYSTEM32
74ca0000 wkscli.dll                      6.2.19041.3636      C:\Windows\System32
74cf0000 netutils.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
74de0000 WININET.dll                     11.0.19041.3636     C:\Windows\SYSTEM32
75420000 kernel.appcore.dll              6.2.19041.3758      C:\Windows\SYSTEM32
75430000 QMLogEx.dll                     16.9.24712.211      C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211
75450000 QMStuck.dll                     1.1.0.1             C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211
75470000 WTSAPI32.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
75510000 USERENV.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
757d0000 version.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
757e0000 crypt32.dll                     6.2.19041.3636      C:\Windows\System32
758e0000 clbcatq.dll                     2001.12.10941.16384 C:\Windows\System32
75ad0000 combase.dll                     6.2.19041.3636      C:\Windows\System32
75d50000 SHLWAPI.dll                     6.2.19041.3636      C:\Windows\System32
75da0000 WS2_32.dll                      6.2.19041.3636      C:\Windows\System32
75e10000 shell32.dll                     6.2.19041.3758      C:\Windows\System32
763d0000 advapi32.dll                    6.2.19041.3693      C:\Windows\System32
76450000 NSI.dll                         6.2.19041.3636      C:\Windows\System32
76460000 bcrypt.dll                      6.2.19041.3636      C:\Windows\System32
76480000 WINTRUST.dll                    6.2.19041.3636      C:\Windows\System32
764d0000 GDI32.dll                       6.2.19041.3636      C:\Windows\System32
76590000 CFGMGR32.dll                    6.2.19041.3636      C:\Windows\System32
765d0000 gdi32full.dll                   6.2.19041.3803      C:\Windows\System32
766c0000 KERNEL32.DLL                    6.2.19041.3636      C:\Windows\System32
767b0000 oleaut32.dll                    6.2.19041.3636      C:\Windows\System32
76850000 shcore.dll                      6.2.19041.3636      C:\Windows\System32
768e0000 msvcp_win.dll                   6.2.19041.3636      C:\Windows\System32
76960000 sechost.dll                     6.2.19041.3636      C:\Windows\System32
76a50000 SETUPAPI.dll                    6.2.19041.3636      C:\Windows\System32
76e90000 msvcrt.dll                      7.0.19041.3636      C:\Windows\System32
76f50000 comdlg32.dll                    6.2.19041.3758      C:\Windows\System32
77000000 PSAPI.DLL                       6.2.19041.3636      C:\Windows\System32
77070000 bcryptPrimitives.dll            6.2.19041.3636      C:\Windows\System32
770d0000 MSCTF.dll                       6.2.19041.3636      C:\Windows\System32
771b0000 IMM32.DLL                       6.2.19041.3636      C:\Windows\System32
771e0000 KERNELBASE.dll                  6.2.19041.3803      C:\Windows\System32
77440000 win32u.dll                      6.2.19041.3803      C:\Windows\System32
77460000 ucrtbase.dll                    6.2.19041.3636      C:\Windows\System32
77580000 ole32.dll                       6.2.19041.3636      C:\Windows\System32
776d0000 RPCRT4.dll                      6.2.19041.3758      C:\Windows\System32
77790000 user32.dll                      6.2.19041.3803      C:\Windows\System32
77940000 ntdll.dll                       6.2.19041.3693      C:\Windows\SYSTEM32
77af0000 wsock32.dll                     6.2.19041.1         C:\Windows\SYSTEM32
77b00000 thumbcache.dll                  6.2.19041.3636      C:\Windows\System32
77b50000 Windows.StateRepositoryPS.dll   6.2.19041.3636      C:\Windows\System32
78e80000 GROOVEEX.DLL                    14.0.4761.1000      C:\PROGRA~2\MICROS~2\Office14
794e0000 Windows.FileExplorer.Common.dll 6.2.19041.3636      C:\Windows\System32
79600000 dlnashext.dll                   6.2.19041.3636      C:\Windows\System32
796c0000 FileSmashMenu.dll               16.1.20399.201      C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211\plugins\FileSmashPro
79720000 QMContextScan.dll               16.9.24712.211      C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211
79770000 IDStore.dll                     6.2.19041.3636      C:\Windows\System32
797f0000 wlidprov.dll                    6.2.19041.3758      C:\Windows\System32
79f80000 provsvc.dll                     6.2.19041.3636      C:\Windows\System32
7a060000 explorerframe.dll               6.2.19041.3758      C:\Windows\system32
7a660000 MSVCP140.dll                    14.29.30135.0       C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211\plugins\FileSmashPro
7b1f0000 WindowsCodecs.dll               6.2.19041.3636      C:\Windows\SYSTEM32
7b370000 policymanager.dll               6.2.19041.3636      C:\Windows\SYSTEM32
7b400000 msvcp110_win.dll                6.2.19041.3636      C:\Windows\SYSTEM32
7b6e0000 davclnt.dll                     6.2.19041.3636      C:\Windows\System32
7b700000 DevDispItemProvider.dll         6.2.19041.3636      C:\Windows\System32
7b720000 audiodev.dll                    6.2.19041.1         C:\Windows\system32
7b760000 WMASF.DLL                       12.0.19041.1        C:\Windows\system32
7c200000 wpdshext.dll                    6.2.19041.3636      C:\Windows\system32
7c290000 edputil.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
7c2b0000 appresolver.dll                 6.2.19041.3636      C:\Windows\System32
7c330000 SLC.dll                         6.2.19041.3636      C:\Windows\System32
7c350000 sppc.dll                        6.2.19041.3636      C:\Windows\System32
7c370000 OneCoreCommonProxyStub.dll      6.2.19041.3758      C:\Windows\System32
7c3b0000 olepro32.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
7c8b0000 PlayToDevice.dll                6.2.19041.3636      C:\Windows\System32
7c900000 FileSyncShell.dll               23.221.1024.2       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Microsoft\OneDrive\23.221.1024.0002\i386

processes:
0000 Idle                        0 0   0
0004 System                      0 0   0
016c Registry                    0 0   0
0360 smss.exe                    0 0   0
0374 csrss.exe                   0 0   0
04b4 wininit.exe                 0 0   0
04bc csrss.exe                   1 0   0
04fc services.exe                0 0   0
0504 lsass.exe                   0 0   0
058c svchost.exe                 0 0   0
05ac fontdrvhost.exe             0 0   0
05d0 WUDFHost.exe                0 0   0
061c svchost.exe                 0 0   0
064c svchost.exe                 0 0   0
06a4 winlogon.exe                1 0   0
06fc fontdrvhost.exe             1 0   0
0744 dwm.exe                     1 0   0
07a8 svchost.exe                 0 0   0
07e4 svchost.exe                 0 0   0
07ec svchost.exe                 0 0   0
0434 svchost.exe                 0 0   0
0460 svchost.exe                 0 0   0
0464 svchost.exe                 0 0   0
0544 svchost.exe                 0 0   0
0834 svchost.exe                 0 0   0
0878 svchost.exe                 0 0   0
08a4 svchost.exe                 0 0   0
08d4 svchost.exe                 0 0   0
0910 svchost.exe                 0 0   0
0944 svchost.exe                 0 0   0
0994 svchost.exe                 0 0   0
0a4c QQPCRTP.exe                 0 0   0
0a54 qmbsrv.exe                  0 0   0
0a98 svchost.exe                 0 0   0
0b04 svchost.exe                 0 0   0
0b40 svchost.exe                 0 0   0
0ba0 svchost.exe                 0 0   0
0bcc svchost.exe                 0 0   0
0824 svchost.exe                 0 0   0
0a10 svchost.exe                 0 0   0
0c40 svchost.exe                 0 0   0
0c48 svchost.exe                 0 0   0
0ca8 svchost.exe                 0 0   0
0d74 amdfendrsr.exe              0 0   0
0d8c atiesrxx.exe                0 0   0
0e1c svchost.exe                 0 0   0
0e24 svchost.exe                 0 0   0
0e4c atieclxx.exe                1 0   0
0e5c svchost.exe                 0 0   0
0e64 svchost.exe                 0 0   0
0f10 svchost.exe                 0 0   0
0f58 svchost.exe                 0 0   0
0f60 svchost.exe                 0 0   0
1118 svchost.exe                 0 0   0
1184 svchost.exe                 0 0   0
11a4 dasHost.exe                 0 0   0
1264 svchost.exe                 0 0   0
12cc svchost.exe                 0 0   0
1368 svchost.exe                 0 0   0
1370 svchost.exe                 0 0   0
1398 svchost.exe                 0 0   0
10f8 svchost.exe                 0 0   0
1104 svchost.exe                 0 0   0
110c spoolsv.exe                 0 0   0
1430 svchost.exe                 0 0   0
1450 svchost.exe                 0 0   0
156c svchost.exe                 0 0   0
1580 svchost.exe                 0 0   0
1588 svchost.exe                 0 0   0
1590 svchost.exe                 0 0   0
1598 svchost.exe                 0 0   0
15a0 yyldrsvr.exe                0 0   0
15c0 SunloginClient.exe          0 0   0
16b4 svchost.exe                 0 0   0
16c4 svchost.exe                 0 0   0
1704 svchost.exe                 0 0   0
1a08 svchost.exe                 0 0   0
1a10 SearchIndexer.exe           0 0   0
1b70 SunloginClient.exe          0 0   0
1e00 sihost.exe                  1 0   7   normal       C:\Windows\System32
1e24 svchost.exe                 1 0   1   normal       C:\Windows\System32
1e4c svchost.exe                 1 0   4   normal       C:\Windows\System32
1ee4 svchost.exe                 0 0   0
1f1c taskhostw.exe               1 8   6   normal       C:\Windows\System32
1f7c svchost.exe                 0 0   0
1fdc ctfmon.exe                  1 0   0
1c74 explorer.exe                1 698 455 normal       C:\Windows
1cd4 svchost.exe                 0 0   0
20a0 svchost.exe                 1 0   8   normal       C:\Windows\System32
21c0 ChsIME.exe                  1 0   0
23d4 StartMenuExperienceHost.exe 1 7   18  normal       C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
2118 svchost.exe                 0 0   0
1dbc RuntimeBroker.exe           1 40  1   normal       C:\Windows\System32
2240 SearchApp.exe               1 14  58  normal       C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy
2360 RuntimeBroker.exe           1 40  4   normal       C:\Windows\System32
1390 svchost.exe                 0 0   0
2144 ShellExperienceHost.exe     1 6   48  normal       C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy
24f8 TextInputHost.exe           1 0   49  normal       C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy
28d8 svchost.exe                 0 0   0
2b14 RuntimeBroker.exe           1 0   1   normal       C:\Windows\System32
2d18 svchost.exe                 0 0   0
2e80 PhoneExperienceHost.exe     1 0   18  normal       C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23092.158.0_x64__8wekyb3d8bbwe
2c84 RuntimeBroker.exe           1 0   1   normal       C:\Windows\System32
3154 SecurityHealthService.exe   0 0   0
3214 RuntimeBroker.exe           1 40  6   normal       C:\Windows\System32
3338 RAVCpl64.exe                1 70  18  normal       C:\Program Files\Realtek\Audio\HDA
31b4 SunloginClient.exe          1 198 168 normal       C:\Program Files\Oray\SunLogin\SunloginClient
3284 dllhost.exe                 1 0   3   normal       C:\Windows\System32
2d10 QQ.exe                      1 159 212 normal       C:\Program Files (x86)\Tencent\QQ\Bin
36cc svchost.exe                 1 0   1   normal       C:\Windows\System32
1f84 SgrmBroker.exe              0 0   0
372c svchost.exe                 0 0   0
0e7c TXPlatform.exe              1 0   2   normal       C:\Program Files (x86)\Tencent\QQ\Bin
3510 QQ.exe                      1 162 171 normal       C:\Program Files (x86)\Tencent\QQ\Bin
2398 QQ.exe                      1 144 154 normal       C:\Program Files (x86)\Tencent\QQ\Bin
3544 QQGuild.exe                 1 52  52  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2f60 QQGuild.exe                 1 3   17  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1c5c QQGuild.exe                 1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
3398 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2338 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
0a74 QQGuild.exe                 1 52  53  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
20f4 QQGuild.exe                 1 3   17  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2d2c QQGuild.exe                 1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2c28 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2de8 QQGuild.exe                 1 52  52  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1d2c QQGuild.exe                 1 3   17  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
07fc QQGuild.exe                 1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
0c34 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1b50 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1bdc QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
0b98 ߰.exe                  1 134 45  normal       E:\\߰
28d4 .exe              1 103 116 normal       D:\
3ae0 ѯ.exe                    1 182 83  normal       E:\\ճ\
3fcc MsMpEng.exe                 0 0   0
32a0 ApplicationFrameHost.exe    1 12  2   normal       C:\Windows\System32
3b00 svchost.exe                 0 0   0
269c svchost.exe                 0 0   0
15dc UserOOBEBroker.exe          1 0   1   normal       C:\Windows\System32\oobe
3e54 svchost.exe                 0 0   0
3dfc NisSrv.exe                  0 0   0
3f08 svchost.exe                 0 0   0
3e94 sesvc.exe                   1 0   17  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\360se6\Application\components\sesvc
3d48 sesvr.exe                   1 14  10  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\360se6\Application\components\sesvr\13.0.0.1323
322c SeAppService.exe            1 17  18  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\360se6\Application\components\seapp
240c svchost.exe                 0 0   0
4958 svchost.exe                 0 0   0
4b94 CompPkgSrv.exe              1 0   1   normal       C:\Windows\System32
50cc svchost.exe                 0 0   0
6710 taskhostw.exe               1 0   0
6f18 OSPPSVC.EXE                 0 0   0
6e24 svchost.exe                 1 0   1   normal       C:\Windows\System32
61bc MpCmdRun.exe                0 0   0
73b0 svchost.exe                 0 0   0
544c FlashFXP.exe                1 270 226 normal       E:\\ճ\\FlashFXP
8424 FlashFXP.exe                1 253 182 normal       E:\\ճ\\FlashFXP
6794 v2.0[].exe        1 0   0
6f40 mstsc.exe                   1 115 76  normal       C:\Windows\System32
7af0 explorer.exe                1 404 150 normal       C:\Windows
3fac v2.0.exe            1 0   0
7b98 WeChat.exe                  1 131 81  normal       C:\Program Files\Tencent\WeChat
274c mmcrashpad_handler64.exe    1 0   4   normal       C:\Program Files\Tencent\WeChat\[3.9.8.15]
32b0 WeChatAppEx.exe             1 14  42  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
7f50 WeChatAppEx.exe             1 0   4   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
5774 WeChatAppEx.exe             1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
7318 WeChatAppEx.exe             1 6   50  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
77e8 WeChatPlayer.exe            1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\ThumbPlayer\4067\extracted
72fc WeChatUtility.exe           1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\WeChatUtility\8085\extracted
0b18 WeChatOCR.exe               1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\WeChatOCR\7061\extracted
4024 WeChatAppEx.exe             1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
53b8 WeChatAppEx.exe             1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
70a0 WeChatAppEx.exe             1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
35bc WeChatAppEx.exe             1 0   0   idle         C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
407c WeChatAppEx.exe             1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
793c svchost.exe                 0 0   0
87a8 backgroundTaskHost.exe      1 0   2   normal       C:\Windows\System32
60a4 RuntimeBroker.exe           1 0   1   normal       C:\Windows\System32
7a60 audiodg.exe                 0 0   0

hardware:
+ {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
  - Fax
  - Microsoft Print to PDF
  - Microsoft XPS Document Writer
  - OneNote for Windows 10
  -  OneNote 2010
  - ӡ
+ {36fc9e60-c465-11cf-8056-444553540000}
  - Generic USB Hub
  - Generic USB Hub
  - Intel(R) USB 3.0 չ - 1.0 (Microsoft)
  - Standard Enhanced PCI to USB Host Controller
  - Standard Enhanced PCI to USB Host Controller
  - USB Composite Device
  - USB Composite Device
  - USB Composite Device
  - USB Composite Device
  - USB Root Hub
  - USB Root Hub
  - USB 洢豸
  - USB (USB 3.0)
  - ͨ USB 
+ {4d36e966-e325-11ce-bfc1-08002be10318}
  -  ACPI x64 ĵ
+ {4d36e967-e325-11ce-bfc1-08002be10318}
  - REECHO V3000 512GB
  - TOSHIBA MK6465GSX
  - XSTAR SS D 480GB USB Device
+ {4d36e968-e325-11ce-bfc1-08002be10318}
  - AMD Radeon RX 580 2048SP (driver 31.0.12027.9001)
  - OrayIddDriver Device (driver 17.1.58.818)
+ {4d36e96a-e325-11ce-bfc1-08002be10318}
  - ׼ SATA AHCI 
+ {4d36e96b-e325-11ce-bfc1-08002be10318}
  - HID Keyboard Device
  - HID Keyboard Device
  - HID Keyboard Device
+ {4d36e96c-e325-11ce-bfc1-08002be10318}
  - AMD High Definition Audio Device (driver 10.0.1.7)
  - BCC950 ConferenceCam
  - Realtek High Definition Audio (driver 6.0.8924.1)
+ {4d36e96e-e325-11ce-bfc1-08002be10318}
  - ͨü弴ü
+ {4d36e96f-e325-11ce-bfc1-08002be10318}
  - HID-compliant mouse
  - HID-compliant mouse
  - HID-compliant mouse
+ {4d36e972-e325-11ce-bfc1-08002be10318}
  - Realtek PCIe GbE Family Controller
+ {4d36e978-e325-11ce-bfc1-08002be10318}
  - ͨŶ˿ (COM1)
+ {4d36e97b-e325-11ce-bfc1-08002be10318}
  - Microsoft 洢ռ
  - ׼ NVM Express 
+ {4d36e97d-e325-11ce-bfc1-08002be10318}
  - ACPI Դť
  - ACPI ̶ܰť
  - ACPI ģ豸
  - ACPI ģ豸
  - AMD Crash Defender (driver 22.20.0.2)
  - High Definition Audio 
  - High Definition Audio 
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel(R) C610 series/X99 chipset LPC Controller - 8D44 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset PCI Express Root Port #1 - 8D10 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset PCI Express Root Port #4 - 8D16 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset SMBus Controller - 8D22 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset SPSR - 8D7C (driver 10.1.1.38)
  - Intel(R) Xeon(R) E7 v3/Xeon(R) E5 v3/Core i7 DMI2 - 2F00 (driver 10.1.2.9)
  - Intel(R) Xeon(R) E7 v3/Xeon(R) E5 v3/Core i7 PCI Express Root Port 1 - 2F02 (driver 10.1.2.9)
  - Intel(R) Xeon(R) E7 v3/Xeon(R) E5 v3/Core i7 PCI Express Root Port 3 - 2F08 (driver 10.1.2.9)
  - Microsoft ACPI-Compliant System
  - Microsoft Hyper-V ⻯ṹ
  - Microsoft System Management BIOS Driver
  - Microsoft Windows Management Interface for ACPI
  - Microsoft Windows Management Interface for ACPI
  - Microsoft 
  - Microsoft ʾ
  - Microsoft ö
  - NDIS ö
  - Pci Bus (driver 22.20.0.1)
  - PCI Express 
  - PCI 
  - PCI 
  - UMBus Root Bus Enumerator
  - ö
  - ߼ɱжϿ
  - ߾¼ʱ
  - 弴豸ö
  - 
  - ɱжϿ
  - ĸԴ
  - ĸԴ
  - ֵݴ
  - ϵͳ CMOS/ʵʱʱ
  - ϵͳʱ
  - ϵͳ
  - Զ豸ض
  - ֱڴʿ
+ {50127dc3-0f36-415e-a6cc-4cb3be910b65}
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
+ {5c4c3332-344d-483c-8739-259e934c9cc8}
  - ͨ
+ {62f9c741-b25a-46ce-b54c-9bccce08b6f2}
  - Microsoft Device Association Root Enumerator
  - Microsoft GS ϳ
  - Microsoft Radio Device Enumeration Bus
  - Microsoft RRAS Root Enumerator
  - J8
+ {745a17a0-74d3-11d0-b6fe-00a0c90f57da}
  - HID-compliant game controller
  - Microsoft Input Configuration Device
  - Oray VHID (driver 6.1.7600.16385)
  - USB 豸
  - USB 豸
  - USB 豸
  - USB 豸
  - USB 豸
  - USB 豸
  -  HID ׼ĵ绰
  -  HID ׼ĹӦ̶豸
  -  HID ׼ĹӦ̶豸
  -  HID ׼ĹӦ̶豸
  -  HID ׼ֻ
  -  HID ׼ϵͳ
  -  HID ׼û豸
  -  HID ׼û豸
  -  HID ׼û豸
  -  HID ׼û豸
+ {c166523c-fe0c-4a94-a586-f1a80cfbbf3e}
  - 4 - U34G2G4R3 (AMD High Definition Audio Device)
  - Realtek Digital Output (Realtek High Definition Audio)
  - Ͳ (2- BCC950 ConferenceCam)
  - Ͳ (2- BCC950 ConferenceCam)
+ {ca3e7ab9-b4c3-4ae6-8251-579ef933890f}
  - BCC950 ConferenceCam

cpu registers:
eax = 00000021
ebx = 027abc30
ecx = 00000001
edx = 03111d20
esi = 00000000
edi = 027abc30
eip = 004ebab3
esp = 0019f844
ebp = 0019f87c

stack dump:
0019f844  a6 ba 4e 00 30 bc 7a 02 - 49 c2 4e 00 00 00 00 00  ..N.0.z.I.N.....
0019f854  00 00 00 00 6f 87 75 00 - 34 2a 41 00 d0 f0 81 02  ....o.u.4*A.....
0019f864  02 00 00 00 73 6e 41 00 - 94 f8 19 02 78 29 11 03  ....snA.....x)..
0019f874  d0 f0 81 02 00 8f 82 02 - e8 f8 19 00 78 2e 75 00  ............x.u.
0019f884  30 bc 7a 02 02 00 00 00 - 70 c9 7e 04 00 b8 7e 04  0.z.....p.~...~.
0019f894  a0 f8 19 00 ac 3a 40 00 - e8 f8 19 00 f0 f8 19 00  .....:@.........
0019f8a4  ac 3a 40 00 e8 f8 19 00 - 00 8f 82 02 d0 30 83 02  .:@..........0..
0019f8b4  00 00 00 00 00 00 00 00 - 00 00 00 00 03 00 00 00  ................
0019f8c4  00 00 00 00 00 8f 82 02 - d8 4a 89 02 00 00 00 00  .........J......
0019f8d4  00 00 00 01 00 00 00 00 - 90 f8 7b 02 b0 5f 78 02  ..........{.._x.
0019f8e4  00 8f 82 02 1c f9 19 00 - 51 92 76 00 30 f9 19 00  ........Q.v.0...
0019f8f4  ac 3a 40 00 1c f9 19 00 - 01 00 00 00 00 00 00 00  .:@.............
0019f904  00 00 00 00 00 00 00 00 - f5 ff 01 01 00 00 00 00  ................
0019f914  b0 5f 78 02 00 8f 82 02 - 7c f9 19 00 e3 5a 77 00  ._x.....|....Zw.
0019f924  a6 f9 19 00 01 00 00 00 - 01 00 00 00 3c f9 19 00  ............<...
0019f934  ac 3a 40 00 7c f9 19 00 - 8c f9 19 00 ac 3a 40 00  .:@.|........:@.
0019f944  7c f9 19 00 00 8f 82 02 - d0 30 83 02 02 f4 7d 02  |........0....}.
0019f954  00 00 00 00 70 09 15 00 - ff ff ff ff 00 00 00 00  ....p...........
0019f964  00 00 00 00 00 00 00 00 - cb 42 7b 00 00 00 00 00  .........B{.....
0019f974  b0 5f 78 02 00 8f 82 02 - b4 f9 19 00 bb ff 72 00  ._x...........r.

disassembling:
[...]
00758729         mov     edx, $75888c
0075872e         call    -$35429b ($404498)     ; System.@LStrCmp
00758733         jz      loc_758744
00758735         mov     eax, [ebp+$10]
00758738         mov     edx, $758898
0075873d         call    -$3542aa ($404498)     ; System.@LStrCmp
00758742         jnz     loc_75874b
00758744 19318   mov     eax, edi
00758746 19319   jmp     loc_758879
0075874b 19322   mov     ecx, [ebp-$c]
0075874e         mov     edx, [ebp-8]
00758751         mov     eax, [ebp-4]
00758754         call    +$100bb ($768814)      ; FrmMain1.TFrmMain.NodeTable_Lookup
00758759         mov     esi, eax
0075875b 19323   test    esi, esi
0075875d         jz      loc_758766
0075875f 19325   mov     eax, esi
00758761 19326   jmp     loc_758879
00758766 19329   xor     ebx, ebx
00758768 19330   mov     eax, edi
0075876a       > call    -$26c533 ($4ec23c)     ; ComCtrls.TTreeNode.getFirstChild
0075876f         mov     esi, eax
00758771         jmp     loc_75878d
00758773 19334   mov     eax, [esi+8]
00758776         mov     edx, [ebp+$10]
00758779         call    -$3542e6 ($404498)     ; System.@LStrCmp
0075877e         jnz     loc_758784
00758780 19335   mov     bl, 1
00758782         jmp     loc_75878d
00758784 19337   mov     eax, esi
00758786         call    -$26c5d7 ($4ec1b4)     ; ComCtrls.TTreeNode.getNextSibling
0075878b         mov     esi, eax
0075878d 19332   test    esi, esi
0075878f         jz      loc_758795
00758791         test    bl, bl
00758793         jz      loc_758773
00758795 19340   test    bl, bl
00758797         jnz     loc_758877
0075879d 19342   mov     eax, [ebp-8]
007587a0         mov     eax, [eax+$254]
007587a6         mov     ecx, [ebp+$10]
[...]

date/time         : 2023-12-16, 22:17:53, 966ms
computer name     : XIATIAN-PC1
user name         : Administrator
operating system  : Windows NT New x64 (6.2.9200) build 9200
system language   : Chinese (Simplified)
system up time    : 1 day 9 hours
program up time   : 12 hours
processors        : 16x Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
physical memory   : 49004/65411 MB (free/total)
free disk space   : (C:) 56.78 GB (E:) 389.94 GB
display mode      : 3440x1440, 32 bit
process id        : $544c
allocated memory  : 76.09 MB
executable        : FlashFXP.exe
exec. date/time   : 2023-05-24 18:55
executable hash   : EBF9591E30DAFE2A9F8E05B39F791BAC
version           : 4.0.0.1543
language          : chinese simplified
callstack crc     : $772eca75, $0e9fac67, $da6fcc4d
count             : 2
exception number  : 6
exception class   : EAccessViolation
exception message : Access violation at address 004EBAB3 in module 'FlashFXP.exe'. ȡ of address 00000025.

main thread ($80d0):
004ebab3 +0003 FlashFXP.exe ComCtrls            TTreeNode.GetTreeView
004ebaa1 +0005 FlashFXP.exe ComCtrls            TTreeNode.GetHandle
004ec244 +0008 FlashFXP.exe ComCtrls            TTreeNode.getFirstChild
0075876a +0062 FlashFXP.exe FrmMain1 19330  +17 TFrmMain.AddDirStructNodeToTree
00752e73 +04a3 FlashFXP.exe FrmMain1 17649 +102 TFrmMain.GetPath
0076924c +0194 FlashFXP.exe FrmMain1 25648  +31 TFrmMain.ChangeDir
00775ade +059a FlashFXP.exe FrmMain1 29836 +124 TFrmMain.GUIChangeDir
0076647f +00d7 FlashFXP.exe FrmMain1 24532  +17 TFrmMain.BPClick
00453fea +0066 FlashFXP.exe Controls            TControl.Click
004f91d0 +0000 FlashFXP.exe ComCtrls            TToolButton.Click
004f91c0 +0060 FlashFXP.exe ComCtrls            TToolButton.MouseUp
004543d4 +0030 FlashFXP.exe Controls            TControl.DoMouseUp
00454449 +0069 FlashFXP.exe Controls            TControl.WMLButtonUp
00453c84 +0024 FlashFXP.exe Controls            TControl.Perform
00453e55 +0111 FlashFXP.exe Controls            TControl.WndProc
00453c84 +0024 FlashFXP.exe Controls            TControl.Perform
00456501 +00a5 FlashFXP.exe Controls            TWinControl.IsControlMouseMsg
004565fa +00e6 FlashFXP.exe Controls            TWinControl.WndProc
004fc899 +0231 FlashFXP.exe ComCtrls            TToolBar.WndProc
0050ab27 +003f FlashFXP.exe ThemeMgr            TWindowProcList.DispatchMessage
0050c920 +01b8 FlashFXP.exe ThemeMgr            TThemeManager.WinControlWindowProc
0050c9f5 +0009 FlashFXP.exe ThemeMgr            TThemeManager.PreWinControlWindowProc
0045634c +002c FlashFXP.exe Controls            TWinControl.MainWndProc
00443cbc +0014 FlashFXP.exe Forms     1529   +8 StdWndProc
777b7fdb +000b user32.dll                       DispatchMessageA
0044cabf +008b FlashFXP.exe Forms     7117  +34 TApplication.ProcessMessage
0044caf6 +000a FlashFXP.exe Forms     7155   +1 TApplication.HandleMessage
0044cdab +00bf FlashFXP.exe Forms     7259  +26 TApplication.Run
0079925c +1c70 FlashFXP.exe FlashFXP   921 +631 initialization
766dfcc7 +0017 KERNEL32.DLL                     BaseThreadInitThunk

thread $7478 (TChangeHandlerThread):
77304cc3 +013 KERNELBASE.dll                           WaitForMultipleObjects
006430e3 +07b FlashFXP.exe   UPTShellControls 4380 +13 TChangeHandlerThread.Execute
004bd5ab +fef FlashFXP.exe   madExcept                 Ebp
0041bfcc +230 FlashFXP.exe   Classes                   HexToBin
00404080 +028 FlashFXP.exe   System                    ThreadWrapper
004bd48d +ed1 FlashFXP.exe   madExcept                 Ebp
004bd4fc +f40 FlashFXP.exe   madExcept                 Ebp
766dfcc7 +017 KERNEL32.DLL                             BaseThreadInitThunk
>> created by main thread ($80d0) at:
00642d9f +01f FlashFXP.exe   UPTShellControls 4262  +2 TChangeHandlerThread.Create

thread $7f24:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $8190 (TSaveFileWorker):
77304cc3 +013 KERNELBASE.dll               WaitForMultipleObjects
00664604 +10c FlashFXP.exe   SaveToFileThd TSaveFileWorker.Execute
004bd5ad +ff1 FlashFXP.exe   madExcept     Ebp
0041bfcc +230 FlashFXP.exe   Classes       HexToBin
00404080 +028 FlashFXP.exe   System        ThreadWrapper
004bd48d +ed1 FlashFXP.exe   madExcept     Ebp
004bd4fc +f40 FlashFXP.exe   madExcept     Ebp
766dfcc7 +017 KERNEL32.DLL                 BaseThreadInitThunk
>> created by main thread ($80d0) at:
00664400 +090 FlashFXP.exe   SaveToFileThd TSaveFileWorker.Create

thread $8730:
777cb988 +028 user32.dll             GetMessageW
004bd48d +ed1 FlashFXP.exe madExcept Ebp
004bd4f7 +f3b FlashFXP.exe madExcept Ebp
766dfcc7 +017 KERNEL32.DLL           BaseThreadInitThunk
>> created by main thread ($80d0) at:
76889f68 +000 shcore.dll

thread $39ec: <priority:1>
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $7a0 (TDirSizeWorker):
77304cc3 +013 KERNELBASE.dll            WaitForMultipleObjects
00664029 +155 FlashFXP.exe   DirSizeThd TDirSizeWorker.Execute
004bd5ad +ff1 FlashFXP.exe   madExcept  Ebp
0041bfcc +230 FlashFXP.exe   Classes    HexToBin
00404080 +028 FlashFXP.exe   System     ThreadWrapper
004bd48d +ed1 FlashFXP.exe   madExcept  Ebp
004bd4fc +f40 FlashFXP.exe   madExcept  Ebp
766dfcc7 +017 KERNEL32.DLL              BaseThreadInitThunk
>> created by main thread ($80d0) at:
00663b64 +09c FlashFXP.exe   DirSizeThd TDirSizeWorker.Create

thread $85a4:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $7384:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

thread $86f8:
772fabad +00d KERNELBASE.dll           WaitForSingleObject
004bd48d +ed1 FlashFXP.exe   madExcept Ebp
004bd4fc +f40 FlashFXP.exe   madExcept Ebp
766dfcc7 +017 KERNEL32.DLL             BaseThreadInitThunk
>> created by thread $76bc at:
75dcd94e +000 WS2_32.dll

thread $4818:
766dfcc7 +17 KERNEL32.DLL  BaseThreadInitThunk

modules:
00400000 FlashFXP.exe                    4.0.0.1543          E:\\ճ\\FlashFXP
04da0000 GrooveIntlResource.dll          14.0.4761.1000      C:\PROGRA~2\MICROS~2\Office14\2052
07660000 OneCoreUAPCommonProxyStub.dll   6.2.19041.3636      C:\Windows\System32
07d20000 WMVCore.DLL                     12.0.19041.3636     C:\Windows\system32
07f30000 StructuredQuery.dll             7.0.19041.3636      C:\Windows\System32
08200000 MSWB70804.dll                   6.2.19041.1         C:\Windows\System32
08300000 Windows.Storage.Search.dll      6.2.19041.3636      C:\Windows\system32
08470000 libeay32.dll                    1.0.0.4             E:\\ճ\\FlashFXP
085c0000 ssleay32.dll                    1.0.0.4             E:\\ճ\\FlashFXP
09170000 NL7Data0804.dll                 6.2.19041.1         C:\Windows\system32
10000000 office.odf                      14.0.4738.1000      C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures
56040000 twext.dll                       6.2.19041.3636      C:\Windows\system32
569a0000 dssenh.dll                      6.2.19041.3636      C:\Windows\system32
569f0000 Bcp47Langs.dll                  6.2.19041.3636      C:\Windows\System32
56b30000 ntlanman.dll                    6.2.19041.3636      C:\Windows\System32
56b70000 virtdisk.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
5ab10000 mfperfhelper.dll                6.2.19041.1         C:\Windows\system32
5b150000 MMDevApi.dll                    6.2.19041.3636      C:\Windows\System32
5b1c0000 samcli.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
67d30000 wintypes.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
67e10000 CoreUIComponents.dll            6.2.19041.3636      C:\Windows\System32
68090000 CoreMessaging.dll               6.2.19041.3636      C:\Windows\System32
68130000 textinputframework.dll          6.2.19041.3758      C:\Windows\SYSTEM32
6aa70000 sfc_os.dll                      6.2.19041.3636      C:\Windows\System32
6aa80000 winspool.drv                    6.2.19041.3693      C:\Windows\SYSTEM32
6adc0000 srvcli.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
6ade0000 urlmon.dll                      11.0.19041.3758     C:\Windows\System32
6afb0000 iertutil.dll                    11.0.19041.3803     C:\Windows\System32
6b260000 DAVHLPR.dll                     6.2.19041.3636      C:\Windows\System32
6b270000 tiptsf.dll                      6.2.19041.3636      C:\Program Files (x86)\Common Files\microsoft shared\ink
6b360000 DEVOBJ.dll                      6.2.19041.3636      C:\Windows\System32
6b390000 propsys.dll                     7.0.19041.3636      C:\Windows\system32
6b5d0000 TextShaping.dll                                     C:\Windows\SYSTEM32
6b680000 PortableDeviceApi.dll           6.2.19041.3636      C:\Windows\System32
6b8b0000 shacct.dll                      6.2.19041.3636      C:\Windows\System32
6b8d0000 XmlLite.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
6b920000 twinapi.appcore.dll             6.2.19041.3758      C:\Windows\system32
6bac0000 dcomp.dll                       6.2.19041.3693      C:\Windows\system32
6bc30000 dataexchange.dll                6.2.19041.3636      C:\Windows\system32
6c880000 ondemandconnroutehelper.dll     6.2.19041.3636      C:\Windows\SYSTEM32
6ca40000 VCRUNTIME140.dll                14.29.30135.0       C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211\plugins\FileSmashPro
6d0a0000 MSVCR90.dll                     9.0.30729.9625      C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589
6d150000 MSVCP90.dll                     9.0.30729.9625      C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589
6db80000 ntshrui.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
6e930000 WINNSI.DLL                      6.2.19041.3636      C:\Windows\SYSTEM32
6e940000 ATL90.DLL                       9.0.30729.4148      C:\Windows\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806
6fb10000 gdiplus.dll                     6.2.19041.3636      C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3636_none_d94ec9f9e106bba9
6fc80000 drprov.dll                      6.2.19041.3636      C:\Windows\System32
6fe00000 winhttp.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
70340000 SAMLIB.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
70e10000 d3d11.dll                       6.2.19041.3636      C:\Windows\system32
715f0000 LINKINFO.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
71630000 cscapi.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
718a0000 pcacli.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
71c40000 uxtheme.dll                     6.2.19041.3636      C:\Windows\system32
71d30000 comctl32.dll                    6.10.19041.3636     C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db
71f40000 Secur32.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
72220000 dxgi.dll                        6.2.19041.3636      C:\Windows\system32
73440000 mswsock.dll                     6.2.19041.3636      C:\Windows\system32
73540000 CRYPTBASE.DLL                   6.2.19041.3636      C:\Windows\SYSTEM32
735c0000 rsaenh.dll                      6.2.19041.3636      C:\Windows\system32
735f0000 CRYPTSP.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
73620000 MPR.dll                         6.2.19041.3636      C:\Windows\SYSTEM32
73680000 rasadhlp.dll                    6.2.19041.3636      C:\Windows\System32
73690000 fwpuclnt.dll                    6.2.19041.3636      C:\Windows\System32
736f0000 winrnr.dll                      6.2.19041.3636      C:\Windows\System32
73700000 DNSAPI.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
73790000 NLAapi.dll                      6.2.19041.3636      C:\Windows\system32
737b0000 pnrpnsp.dll                     6.2.19041.3636      C:\Windows\system32
73820000 IPHLPAPI.DLL                    6.2.19041.3636      C:\Windows\SYSTEM32
73860000 wshbth.dll                      6.2.19041.3636      C:\Windows\system32
73870000 napinsp.dll                     6.2.19041.3636      C:\Windows\system32
73920000 SSPICLI.DLL                     6.2.19041.3636      C:\Windows\SYSTEM32
73950000 FLTLIB.DLL                      6.2.19041.3636      C:\Windows\SYSTEM32
73970000 apphelp.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
73a10000 MSASN1.dll                      6.2.19041.3636      C:\Windows\SYSTEM32
73a80000 winmm.dll                       6.2.19041.3636      C:\Windows\SYSTEM32
74300000 WINSTA.dll                      6.2.19041.3636      C:\Windows\System32
74600000 ntmarta.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
74630000 profapi.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
74650000 Wldp.dll                        6.2.19041.3636      C:\Windows\SYSTEM32
74680000 windows.storage.dll             6.2.19041.3758      C:\Windows\SYSTEM32
74ca0000 wkscli.dll                      6.2.19041.3636      C:\Windows\System32
74cf0000 netutils.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
74de0000 WININET.dll                     11.0.19041.3636     C:\Windows\SYSTEM32
75420000 kernel.appcore.dll              6.2.19041.3758      C:\Windows\SYSTEM32
75430000 QMLogEx.dll                     16.9.24712.211      C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211
75450000 QMStuck.dll                     1.1.0.1             C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211
75470000 WTSAPI32.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
75510000 USERENV.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
757d0000 version.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
757e0000 crypt32.dll                     6.2.19041.3636      C:\Windows\System32
758e0000 clbcatq.dll                     2001.12.10941.16384 C:\Windows\System32
75ad0000 combase.dll                     6.2.19041.3636      C:\Windows\System32
75d50000 SHLWAPI.dll                     6.2.19041.3636      C:\Windows\System32
75da0000 WS2_32.dll                      6.2.19041.3636      C:\Windows\System32
75e10000 shell32.dll                     6.2.19041.3758      C:\Windows\System32
763d0000 advapi32.dll                    6.2.19041.3693      C:\Windows\System32
76450000 NSI.dll                         6.2.19041.3636      C:\Windows\System32
76460000 bcrypt.dll                      6.2.19041.3636      C:\Windows\System32
76480000 WINTRUST.dll                    6.2.19041.3636      C:\Windows\System32
764d0000 GDI32.dll                       6.2.19041.3636      C:\Windows\System32
76590000 CFGMGR32.dll                    6.2.19041.3636      C:\Windows\System32
765d0000 gdi32full.dll                   6.2.19041.3803      C:\Windows\System32
766c0000 KERNEL32.DLL                    6.2.19041.3636      C:\Windows\System32
767b0000 oleaut32.dll                    6.2.19041.3636      C:\Windows\System32
76850000 shcore.dll                      6.2.19041.3636      C:\Windows\System32
768e0000 msvcp_win.dll                   6.2.19041.3636      C:\Windows\System32
76960000 sechost.dll                     6.2.19041.3636      C:\Windows\System32
76a50000 SETUPAPI.dll                    6.2.19041.3636      C:\Windows\System32
76e90000 msvcrt.dll                      7.0.19041.3636      C:\Windows\System32
76f50000 comdlg32.dll                    6.2.19041.3758      C:\Windows\System32
77000000 PSAPI.DLL                       6.2.19041.3636      C:\Windows\System32
77070000 bcryptPrimitives.dll            6.2.19041.3636      C:\Windows\System32
770d0000 MSCTF.dll                       6.2.19041.3636      C:\Windows\System32
771b0000 IMM32.DLL                       6.2.19041.3636      C:\Windows\System32
771e0000 KERNELBASE.dll                  6.2.19041.3803      C:\Windows\System32
77440000 win32u.dll                      6.2.19041.3803      C:\Windows\System32
77460000 ucrtbase.dll                    6.2.19041.3636      C:\Windows\System32
77580000 ole32.dll                       6.2.19041.3636      C:\Windows\System32
776d0000 RPCRT4.dll                      6.2.19041.3758      C:\Windows\System32
77790000 user32.dll                      6.2.19041.3803      C:\Windows\System32
77940000 ntdll.dll                       6.2.19041.3693      C:\Windows\SYSTEM32
77af0000 wsock32.dll                     6.2.19041.1         C:\Windows\SYSTEM32
77b00000 thumbcache.dll                  6.2.19041.3636      C:\Windows\System32
77b50000 Windows.StateRepositoryPS.dll   6.2.19041.3636      C:\Windows\System32
78e80000 GROOVEEX.DLL                    14.0.4761.1000      C:\PROGRA~2\MICROS~2\Office14
794e0000 Windows.FileExplorer.Common.dll 6.2.19041.3636      C:\Windows\System32
79600000 dlnashext.dll                   6.2.19041.3636      C:\Windows\System32
796c0000 FileSmashMenu.dll               16.1.20399.201      C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211\plugins\FileSmashPro
79720000 QMContextScan.dll               16.9.24712.211      C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211
79770000 IDStore.dll                     6.2.19041.3636      C:\Windows\System32
797f0000 wlidprov.dll                    6.2.19041.3758      C:\Windows\System32
79f80000 provsvc.dll                     6.2.19041.3636      C:\Windows\System32
7a060000 explorerframe.dll               6.2.19041.3758      C:\Windows\system32
7a660000 MSVCP140.dll                    14.29.30135.0       C:\Program Files (x86)\Tencent\QQPCMgr\16.9.24712.211\plugins\FileSmashPro
7b1f0000 WindowsCodecs.dll               6.2.19041.3636      C:\Windows\SYSTEM32
7b370000 policymanager.dll               6.2.19041.3636      C:\Windows\SYSTEM32
7b400000 msvcp110_win.dll                6.2.19041.3636      C:\Windows\SYSTEM32
7b6e0000 davclnt.dll                     6.2.19041.3636      C:\Windows\System32
7b700000 DevDispItemProvider.dll         6.2.19041.3636      C:\Windows\System32
7b720000 audiodev.dll                    6.2.19041.1         C:\Windows\system32
7b760000 WMASF.DLL                       12.0.19041.1        C:\Windows\system32
7c200000 wpdshext.dll                    6.2.19041.3636      C:\Windows\system32
7c290000 edputil.dll                     6.2.19041.3636      C:\Windows\SYSTEM32
7c2b0000 appresolver.dll                 6.2.19041.3636      C:\Windows\System32
7c330000 SLC.dll                         6.2.19041.3636      C:\Windows\System32
7c350000 sppc.dll                        6.2.19041.3636      C:\Windows\System32
7c370000 OneCoreCommonProxyStub.dll      6.2.19041.3758      C:\Windows\System32
7c3b0000 olepro32.dll                    6.2.19041.3636      C:\Windows\SYSTEM32
7c8b0000 PlayToDevice.dll                6.2.19041.3636      C:\Windows\System32
7c900000 FileSyncShell.dll               23.221.1024.2       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Microsoft\OneDrive\23.221.1024.0002\i386

processes:
0000 Idle                        0 0   0
0004 System                      0 0   0
016c Registry                    0 0   0
0360 smss.exe                    0 0   0
0374 csrss.exe                   0 0   0
04b4 wininit.exe                 0 0   0
04bc csrss.exe                   1 0   0
04fc services.exe                0 0   0
0504 lsass.exe                   0 0   0
058c svchost.exe                 0 0   0
05ac fontdrvhost.exe             0 0   0
05d0 WUDFHost.exe                0 0   0
061c svchost.exe                 0 0   0
064c svchost.exe                 0 0   0
06a4 winlogon.exe                1 0   0
06fc fontdrvhost.exe             1 0   0
0744 dwm.exe                     1 0   0
07a8 svchost.exe                 0 0   0
07e4 svchost.exe                 0 0   0
07ec svchost.exe                 0 0   0
0434 svchost.exe                 0 0   0
0460 svchost.exe                 0 0   0
0464 svchost.exe                 0 0   0
0544 svchost.exe                 0 0   0
0834 svchost.exe                 0 0   0
0878 svchost.exe                 0 0   0
08a4 svchost.exe                 0 0   0
08d4 svchost.exe                 0 0   0
0910 svchost.exe                 0 0   0
0944 svchost.exe                 0 0   0
0994 svchost.exe                 0 0   0
0a4c QQPCRTP.exe                 0 0   0
0a54 qmbsrv.exe                  0 0   0
0a98 svchost.exe                 0 0   0
0b04 svchost.exe                 0 0   0
0b40 svchost.exe                 0 0   0
0ba0 svchost.exe                 0 0   0
0bcc svchost.exe                 0 0   0
0824 svchost.exe                 0 0   0
0a10 svchost.exe                 0 0   0
0c40 svchost.exe                 0 0   0
0c48 svchost.exe                 0 0   0
0ca8 svchost.exe                 0 0   0
0d74 amdfendrsr.exe              0 0   0
0d8c atiesrxx.exe                0 0   0
0e1c svchost.exe                 0 0   0
0e24 svchost.exe                 0 0   0
0e4c atieclxx.exe                1 0   0
0e5c svchost.exe                 0 0   0
0e64 svchost.exe                 0 0   0
0f10 svchost.exe                 0 0   0
0f58 svchost.exe                 0 0   0
0f60 svchost.exe                 0 0   0
1118 svchost.exe                 0 0   0
1184 svchost.exe                 0 0   0
11a4 dasHost.exe                 0 0   0
1264 svchost.exe                 0 0   0
12cc svchost.exe                 0 0   0
1368 svchost.exe                 0 0   0
1370 svchost.exe                 0 0   0
1398 svchost.exe                 0 0   0
10f8 svchost.exe                 0 0   0
1104 svchost.exe                 0 0   0
110c spoolsv.exe                 0 0   0
1430 svchost.exe                 0 0   0
1450 svchost.exe                 0 0   0
156c svchost.exe                 0 0   0
1580 svchost.exe                 0 0   0
1588 svchost.exe                 0 0   0
1590 svchost.exe                 0 0   0
1598 svchost.exe                 0 0   0
15a0 yyldrsvr.exe                0 0   0
15c0 SunloginClient.exe          0 0   0
16b4 svchost.exe                 0 0   0
16c4 svchost.exe                 0 0   0
1704 svchost.exe                 0 0   0
1a08 svchost.exe                 0 0   0
1a10 SearchIndexer.exe           0 0   0
1b70 SunloginClient.exe          0 0   0
1e00 sihost.exe                  1 0   7   normal       C:\Windows\System32
1e24 svchost.exe                 1 0   1   normal       C:\Windows\System32
1e4c svchost.exe                 1 0   4   normal       C:\Windows\System32
1ee4 svchost.exe                 0 0   0
1f1c taskhostw.exe               1 8   6   normal       C:\Windows\System32
1f7c svchost.exe                 0 0   0
1fdc ctfmon.exe                  1 0   0
1c74 explorer.exe                1 698 455 normal       C:\Windows
1cd4 svchost.exe                 0 0   0
20a0 svchost.exe                 1 0   8   normal       C:\Windows\System32
21c0 ChsIME.exe                  1 0   0
23d4 StartMenuExperienceHost.exe 1 7   18  normal       C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
2118 svchost.exe                 0 0   0
1dbc RuntimeBroker.exe           1 40  1   normal       C:\Windows\System32
2240 SearchApp.exe               1 14  58  normal       C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy
2360 RuntimeBroker.exe           1 40  4   normal       C:\Windows\System32
1390 svchost.exe                 0 0   0
2144 ShellExperienceHost.exe     1 6   48  normal       C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy
24f8 TextInputHost.exe           1 0   49  normal       C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy
28d8 svchost.exe                 0 0   0
2b14 RuntimeBroker.exe           1 0   1   normal       C:\Windows\System32
2d18 svchost.exe                 0 0   0
2e80 PhoneExperienceHost.exe     1 0   18  normal       C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23092.158.0_x64__8wekyb3d8bbwe
2c84 RuntimeBroker.exe           1 0   1   normal       C:\Windows\System32
3154 SecurityHealthService.exe   0 0   0
3214 RuntimeBroker.exe           1 40  6   normal       C:\Windows\System32
3338 RAVCpl64.exe                1 70  18  normal       C:\Program Files\Realtek\Audio\HDA
31b4 SunloginClient.exe          1 198 168 normal       C:\Program Files\Oray\SunLogin\SunloginClient
3284 dllhost.exe                 1 0   3   normal       C:\Windows\System32
2d10 QQ.exe                      1 159 212 normal       C:\Program Files (x86)\Tencent\QQ\Bin
36cc svchost.exe                 1 0   1   normal       C:\Windows\System32
1f84 SgrmBroker.exe              0 0   0
372c svchost.exe                 0 0   0
0e7c TXPlatform.exe              1 0   2   normal       C:\Program Files (x86)\Tencent\QQ\Bin
3510 QQ.exe                      1 162 171 normal       C:\Program Files (x86)\Tencent\QQ\Bin
2398 QQ.exe                      1 144 154 normal       C:\Program Files (x86)\Tencent\QQ\Bin
3544 QQGuild.exe                 1 52  52  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2f60 QQGuild.exe                 1 3   17  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1c5c QQGuild.exe                 1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
3398 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2338 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
0a74 QQGuild.exe                 1 52  53  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
20f4 QQGuild.exe                 1 3   17  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2d2c QQGuild.exe                 1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2c28 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
2de8 QQGuild.exe                 1 52  52  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1d2c QQGuild.exe                 1 3   17  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
07fc QQGuild.exe                 1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
0c34 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1b50 QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
1bdc QQGuild.exe                 1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Local\Tencent\QQGuild\9.7.18-397
0b98 ߰.exe                  1 134 45  normal       E:\\߰
28d4 .exe              1 103 116 normal       D:\
3ae0 ѯ.exe                    1 182 83  normal       E:\\ճ\
3fcc MsMpEng.exe                 0 0   0
32a0 ApplicationFrameHost.exe    1 12  2   normal       C:\Windows\System32
3b00 svchost.exe                 0 0   0
269c svchost.exe                 0 0   0
15dc UserOOBEBroker.exe          1 0   1   normal       C:\Windows\System32\oobe
3e54 svchost.exe                 0 0   0
3dfc NisSrv.exe                  0 0   0
3f08 svchost.exe                 0 0   0
3e94 sesvc.exe                   1 0   17  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\360se6\Application\components\sesvc
3d48 sesvr.exe                   1 14  10  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\360se6\Application\components\sesvr\13.0.0.1323
322c SeAppService.exe            1 17  18  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\360se6\Application\components\seapp
240c svchost.exe                 0 0   0
4958 svchost.exe                 0 0   0
4b94 CompPkgSrv.exe              1 0   1   normal       C:\Windows\System32
50cc svchost.exe                 0 0   0
6710 taskhostw.exe               1 0   0
6f18 OSPPSVC.EXE                 0 0   0
6e24 svchost.exe                 1 0   1   normal       C:\Windows\System32
61bc MpCmdRun.exe                0 0   0
73b0 svchost.exe                 0 0   0
544c FlashFXP.exe                1 274 226 normal       E:\\ճ\\FlashFXP
8424 FlashFXP.exe                1 253 182 normal       E:\\ճ\\FlashFXP
6794 v2.0[].exe        1 0   0
6f40 mstsc.exe                   1 115 76  normal       C:\Windows\System32
7af0 explorer.exe                1 404 150 normal       C:\Windows
3fac v2.0.exe            1 0   0
7b98 WeChat.exe                  1 131 81  normal       C:\Program Files\Tencent\WeChat
274c mmcrashpad_handler64.exe    1 0   4   normal       C:\Program Files\Tencent\WeChat\[3.9.8.15]
32b0 WeChatAppEx.exe             1 14  42  normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
7f50 WeChatAppEx.exe             1 0   4   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
5774 WeChatAppEx.exe             1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
7318 WeChatAppEx.exe             1 6   50  above normal C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
77e8 WeChatPlayer.exe            1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\ThumbPlayer\4067\extracted
72fc WeChatUtility.exe           1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\WeChatUtility\8085\extracted
0b18 WeChatOCR.exe               1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\WeChatOCR\7061\extracted
4024 WeChatAppEx.exe             1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
53b8 WeChatAppEx.exe             1 0   1   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
70a0 WeChatAppEx.exe             1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
35bc WeChatAppEx.exe             1 0   0   idle         C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
407c WeChatAppEx.exe             1 0   0   normal       C:\Users\Administrator.DESKTOP-J1A4IIM\AppData\Roaming\Tencent\WeChat\XPlugin\Plugins\RadiumWMPF\8501\extracted\runtime
793c svchost.exe                 0 0   0
87a8 backgroundTaskHost.exe      1 0   2   normal       C:\Windows\System32
60a4 RuntimeBroker.exe           1 0   1   normal       C:\Windows\System32
7a60 audiodg.exe                 0 0   0
545c SearchProtocolHost.exe      0 0   0
78c8 SearchFilterHost.exe        0 0   0

hardware:
+ {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
  - Fax
  - Microsoft Print to PDF
  - Microsoft XPS Document Writer
  - OneNote for Windows 10
  -  OneNote 2010
  - ӡ
+ {36fc9e60-c465-11cf-8056-444553540000}
  - Generic USB Hub
  - Generic USB Hub
  - Intel(R) USB 3.0 չ - 1.0 (Microsoft)
  - Standard Enhanced PCI to USB Host Controller
  - Standard Enhanced PCI to USB Host Controller
  - USB Composite Device
  - USB Composite Device
  - USB Composite Device
  - USB Composite Device
  - USB Root Hub
  - USB Root Hub
  - USB 洢豸
  - USB (USB 3.0)
  - ͨ USB 
+ {4d36e966-e325-11ce-bfc1-08002be10318}
  -  ACPI x64 ĵ
+ {4d36e967-e325-11ce-bfc1-08002be10318}
  - REECHO V3000 512GB
  - TOSHIBA MK6465GSX
  - XSTAR SS D 480GB USB Device
+ {4d36e968-e325-11ce-bfc1-08002be10318}
  - AMD Radeon RX 580 2048SP (driver 31.0.12027.9001)
  - OrayIddDriver Device (driver 17.1.58.818)
+ {4d36e96a-e325-11ce-bfc1-08002be10318}
  - ׼ SATA AHCI 
+ {4d36e96b-e325-11ce-bfc1-08002be10318}
  - HID Keyboard Device
  - HID Keyboard Device
  - HID Keyboard Device
+ {4d36e96c-e325-11ce-bfc1-08002be10318}
  - AMD High Definition Audio Device (driver 10.0.1.7)
  - BCC950 ConferenceCam
  - Realtek High Definition Audio (driver 6.0.8924.1)
+ {4d36e96e-e325-11ce-bfc1-08002be10318}
  - ͨü弴ü
+ {4d36e96f-e325-11ce-bfc1-08002be10318}
  - HID-compliant mouse
  - HID-compliant mouse
  - HID-compliant mouse
+ {4d36e972-e325-11ce-bfc1-08002be10318}
  - Realtek PCIe GbE Family Controller
+ {4d36e978-e325-11ce-bfc1-08002be10318}
  - ͨŶ˿ (COM1)
+ {4d36e97b-e325-11ce-bfc1-08002be10318}
  - Microsoft 洢ռ
  - ׼ NVM Express 
+ {4d36e97d-e325-11ce-bfc1-08002be10318}
  - ACPI Դť
  - ACPI ̶ܰť
  - ACPI ģ豸
  - ACPI ģ豸
  - AMD Crash Defender (driver 22.20.0.2)
  - High Definition Audio 
  - High Definition Audio 
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel Device (driver 10.0.27.0)
  - Intel(R) C610 series/X99 chipset LPC Controller - 8D44 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset PCI Express Root Port #1 - 8D10 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset PCI Express Root Port #4 - 8D16 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset SMBus Controller - 8D22 (driver 10.1.1.38)
  - Intel(R) C610 series/X99 chipset SPSR - 8D7C (driver 10.1.1.38)
  - Intel(R) Xeon(R) E7 v3/Xeon(R) E5 v3/Core i7 DMI2 - 2F00 (driver 10.1.2.9)
  - Intel(R) Xeon(R) E7 v3/Xeon(R) E5 v3/Core i7 PCI Express Root Port 1 - 2F02 (driver 10.1.2.9)
  - Intel(R) Xeon(R) E7 v3/Xeon(R) E5 v3/Core i7 PCI Express Root Port 3 - 2F08 (driver 10.1.2.9)
  - Microsoft ACPI-Compliant System
  - Microsoft Hyper-V ⻯ṹ
  - Microsoft System Management BIOS Driver
  - Microsoft Windows Management Interface for ACPI
  - Microsoft Windows Management Interface for ACPI
  - Microsoft 
  - Microsoft ʾ
  - Microsoft ö
  - NDIS ö
  - Pci Bus (driver 22.20.0.1)
  - PCI Express 
  - PCI 
  - PCI 
  - UMBus Root Bus Enumerator
  - ö
  - ߼ɱжϿ
  - ߾¼ʱ
  - 弴豸ö
  - 
  - ɱжϿ
  - ĸԴ
  - ĸԴ
  - ֵݴ
  - ϵͳ CMOS/ʵʱʱ
  - ϵͳʱ
  - ϵͳ
  - Զ豸ض
  - ֱڴʿ
+ {50127dc3-0f36-415e-a6cc-4cb3be910b65}
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
  - Intel(R) Xeon(R) CPU E5-2673 v3 @ 2.40GHz
+ {5c4c3332-344d-483c-8739-259e934c9cc8}
  - ͨ
+ {62f9c741-b25a-46ce-b54c-9bccce08b6f2}
  - Microsoft Device Association Root Enumerator
  - Microsoft GS ϳ
  - Microsoft Radio Device Enumeration Bus
  - Microsoft RRAS Root Enumerator
  - J8
+ {745a17a0-74d3-11d0-b6fe-00a0c90f57da}
  - HID-compliant game controller
  - Microsoft Input Configuration Device
  - Oray VHID (driver 6.1.7600.16385)
  - USB 豸
  - USB 豸
  - USB 豸
  - USB 豸
  - USB 豸
  - USB 豸
  -  HID ׼ĵ绰
  -  HID ׼ĹӦ̶豸
  -  HID ׼ĹӦ̶豸
  -  HID ׼ĹӦ̶豸
  -  HID ׼ֻ
  -  HID ׼ϵͳ
  -  HID ׼û豸
  -  HID ׼û豸
  -  HID ׼û豸
  -  HID ׼û豸
+ {c166523c-fe0c-4a94-a586-f1a80cfbbf3e}
  - 4 - U34G2G4R3 (AMD High Definition Audio Device)
  - Realtek Digital Output (Realtek High Definition Audio)
  - Ͳ (2- BCC950 ConferenceCam)
  - Ͳ (2- BCC950 ConferenceCam)
+ {ca3e7ab9-b4c3-4ae6-8251-579ef933890f}
  - BCC950 ConferenceCam

cpu registers:
eax = 00000021
ebx = 027abc30
ecx = 00000001
edx = 03111ca8
esi = 00000000
edi = 027abc30
eip = 004ebab3
esp = 0019f8f8
ebp = 0019f930

stack dump:
0019f8f8  a6 ba 4e 00 30 bc 7a 02 - 49 c2 4e 00 00 00 00 00  ..N.0.z.I.N.....
0019f908  00 00 00 00 6f 87 75 00 - 34 2a 41 00 d0 f0 81 02  ....o.u.4*A.....
0019f918  02 00 00 00 73 6e 41 00 - 48 f9 19 02 d0 2b 11 03  ....snA.H....+..
0019f928  d0 f0 81 02 00 8f 82 02 - 9c f9 19 00 78 2e 75 00  ............x.u.
0019f938  30 bc 7a 02 02 00 00 00 - 68 b6 7e 04 f8 c2 7e 04  0.z.....h.~...~.
0019f948  54 f9 19 00 ac 3a 40 00 - 9c f9 19 00 a4 f9 19 00  T....:@.........
0019f958  ac 3a 40 00 9c f9 19 00 - 00 8f 82 02 2e 02 00 00  .:@.............
0019f968  00 00 00 00 00 00 00 00 - 00 00 00 00 02 00 00 00  ................
0019f978  00 00 00 00 00 00 00 00 - a8 6c 13 03 00 00 00 00  .........l......
0019f988  d0 f9 19 01 00 00 00 00 - 90 f8 7b 02 b0 5f 78 02  ..........{.._x.
0019f998  00 8f 82 02 d0 f9 19 00 - 51 92 76 00 e4 f9 19 00  ........Q.v.....
0019f9a8  ac 3a 40 00 d0 f9 19 00 - 01 00 00 00 00 00 00 00  .:@.............
0019f9b8  00 00 00 00 00 00 00 00 - f5 ff 01 01 00 00 00 00  ................
0019f9c8  b0 5f 78 02 00 8f 82 02 - 30 fa 19 00 e3 5a 77 00  ._x.....0....Zw.
0019f9d8  5e fa 19 00 01 00 00 00 - 01 00 00 00 f0 f9 19 00  ^...............
0019f9e8  ac 3a 40 00 30 fa 19 00 - 40 fa 19 00 ac 3a 40 00  .:@.0...@....:@.
0019f9f8  30 fa 19 00 00 8f 82 02 - 2e 02 00 00 02 20 7f 02  0...............
0019fa08  00 00 00 00 84 00 00 00 - ff ff ff ff 00 00 00 00  ................
0019fa18  00 00 00 00 00 00 00 00 - cc 67 45 00 00 00 00 00  .........gE.....
0019fa28  b0 5f 78 02 00 8f 82 02 - 70 fa 19 00 84 64 76 00  ._x.....p....dv.

disassembling:
[...]
00758729         mov     edx, $75888c
0075872e         call    -$35429b ($404498)     ; System.@LStrCmp
00758733         jz      loc_758744
00758735         mov     eax, [ebp+$10]
00758738         mov     edx, $758898
0075873d         call    -$3542aa ($404498)     ; System.@LStrCmp
00758742         jnz     loc_75874b
00758744 19318   mov     eax, edi
00758746 19319   jmp     loc_758879
0075874b 19322   mov     ecx, [ebp-$c]
0075874e         mov     edx, [ebp-8]
00758751         mov     eax, [ebp-4]
00758754         call    +$100bb ($768814)      ; FrmMain1.TFrmMain.NodeTable_Lookup
00758759         mov     esi, eax
0075875b 19323   test    esi, esi
0075875d         jz      loc_758766
0075875f 19325   mov     eax, esi
00758761 19326   jmp     loc_758879
00758766 19329   xor     ebx, ebx
00758768 19330   mov     eax, edi
0075876a       > call    -$26c533 ($4ec23c)     ; ComCtrls.TTreeNode.getFirstChild
0075876f         mov     esi, eax
00758771         jmp     loc_75878d
00758773 19334   mov     eax, [esi+8]
00758776         mov     edx, [ebp+$10]
00758779         call    -$3542e6 ($404498)     ; System.@LStrCmp
0075877e         jnz     loc_758784
00758780 19335   mov     bl, 1
00758782         jmp     loc_75878d
00758784 19337   mov     eax, esi
00758786         call    -$26c5d7 ($4ec1b4)     ; ComCtrls.TTreeNode.getNextSibling
0075878b         mov     esi, eax
0075878d 19332   test    esi, esi
0075878f         jz      loc_758795
00758791         test    bl, bl
00758793         jz      loc_758773
00758795 19340   test    bl, bl
00758797         jnz     loc_758877
0075879d 19342   mov     eax, [ebp-8]
007587a0         mov     eax, [eax+$254]
007587a6         mov     ecx, [ebp+$10]
[...]

