J
Jeff B
Running Win2K SP4, MSoffice sp3
Since two weeks ago, every time I quit Excel I get an error:
Excel.exe has generated errors and will be closed by Windows. An error log
is being created
The error log is pasted in the postscript. I'm not a programmer or very
savvy about stuff like this, I'm a power user of built-in Excel functions (up
to VBA and add-ins, I'm knowledgeable, but then it's a cliff). So I've tried
rebooting, reinstalling Excel, updating Office to sp3, removing Add-ins (the
strange thing is, I can't remove add-ins permanently - they go away for my
session, but then perhaps because the session doesn't end properly, when I
restart Excel they are all there again under Tools, Commands and Tools,
Add-ins.
Any tips would be highly appreciated.
Jeff
PS Here is the relevant portion of drwtsn32.log in C:\Docs and Settings\All
Users\Documents\DrWatson with private info blanked out:
Application exception occurred:
App: (pid=1304)
When: 11/29/2004 @ 14:54:12.473
Exception number: c0000005 (access violation)
*----> System Information <----*
Computer Name:
User Name:
Number of Processors: 1
Processor Type: x86 Family 6 Model 8 Stepping 10
Windows 2000 Version: 5.0
Current Build: 2195
Service Pack: 4
Current Type: Uniprocessor Free
Registered Organization:
Registered Owner:
*----> Task List <----*
0 Idle.exe
8 System.exe
172 smss.exe
196 csrss.exe
192 winlogon.exe
244 services.exe
256 lsass.exe
368 ibmpmsvc.exe
436 svchost.exe
480 svchost.exe
532 spoolsv.exe
556 netdde.exe
584 netdde.exe
612 msdtc.exe
720 defwatch.exe
764 mdm.exe
884 rtvscan.exe
912 regsvc.exe
928 MSTask.exe
980 tcpsvcs.exe
1004 snmp.exe
1052 WinMgmt.exe
1064 mspmspsv.exe
1080 svchost.exe
1096 inetinfo.exe
1328 Explorer.exe
1352 WinMgmt.exe
1448 tp4serv.exe
1476 tphkmgr.exe
1488 PRPCUI.exe
1496 vptray.exe
1516 ltmsg.exe
1524 tfswctrl.exe
1532 iTunesHelper.ex.exe
1540 SprintPortA.exe
1548 qttask.exe
1564 realsched.exe
1636 PdaNet.exe
1304 EXCEL.exe
1396 drwtsn32.exe
0 _Total.exe
(30000000 - 306D9000)
(77F80000 - 77FFA000)
(7C2D0000 - 7C332000)
(7C570000 - 7C623000)
(77D30000 - 77D9E000)
(77F40000 - 77F79000)
(77E10000 - 77E6F000)
(308C0000 - 30E1D000)
(77A50000 - 77B3C000)
(75E60000 - 75E7A000)
(775A0000 - 77626000)
(779B0000 - 77A4B000)
(78000000 - 78045000)
(00E10000 - 01014000)
(782F0000 - 78538000)
(70A70000 - 70AD5000)
(71710000 - 71794000)
(77840000 - 7787E000)
(770C0000 - 770E3000)
(65000000 - 65263000)
(65300000 - 65327000)
(10000000 - 100DF000)
(3FFE0000 - 3FFE9000)
(77800000 - 7781E000)
(76620000 - 76631000)
(020E0000 - 0216F000)
(02190000 - 02239000)
(02250000 - 02273000)
(02290000 - 022B2000)
(772B0000 - 7731C000)
State Dump for Thread Id 0x168
eax=00000000 ebx=017afa48 ecx=00000000 edx=bcfbd9d8 esi=02200868 edi=00000000
eip=021ca69a esp=0012e864 ebp=0012e8e0 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
function: RSK4_SetGetStreamOrBlobInputOutputInfo
021ca67d c3 ret
021ca67e 90 nop
021ca67f 90 nop
021ca680 8b442404 mov eax,[esp+0x4]
ss:00c2874b=????????
021ca684 53 push ebx
021ca685 25ffffff7f and eax,0x7fffffff
021ca68a 56 push esi
021ca68b 57 push edi
021ca68c 8d348568082002 lea esi,[02200868+eax*4]
ds:00000000=????????
021ca693 8b048568082002 mov eax,[02200868+eax*4]
ds:00000000=????????
FAULT ->021ca69a 8b5004 mov edx,[eax+0x4]
ds:00af9ee6=????????
021ca69d 4a dec edx
021ca69e 895004 mov [eax+0x4],edx
ds:00af9ee6=????????
021ca6a1 8b3e mov edi,[esi]
ds:02200868=00000000
021ca6a3 8b4f04 mov ecx,[edi+0x4]
ds:00af9ee6=????????
021ca6a6 85c9 test ecx,ecx
021ca6a8 0f94c3 sete bl
021ca6ab 84db test bl,bl
021ca6ad 741a jz 021d2bc9
021ca6af 85ff test edi,edi
021ca6b1 7410 jz 021d31c3
021ca6b3 8bcf mov ecx,edi
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0012E8E0 303A48F1 0012E900 017AFA48 00000000 0012EA58
!RSK4_SetGetStreamOrBlobInputOutputInfo
0012E90C 303A362D 024C0018 017AFA48 00000000 0012EA58 !Ordinal44
0012EA84 301D3F95 0012ED88 0012ED54 00000000 00000000 !Ordinal44
0012ED74 3005E769 00000000 8ED20000 00000000 00000000 !Ordinal44
0012F1F8 30036A1F 00000000 8ED20000 00000000 00000001 !Ordinal44
0012F398 301D165D 00000011 0012F3C8 00000001 00000000 !Ordinal44
0012F3D0 30059DB4 00010002 00000000 00000000 00000001 !Ordinal44
0012F3EC 30163A97 00010002 00000003 00000000 00000000 !Ordinal44
0012F408 30036A1F 00000000 00000000 00000000 00000000 !Ordinal44
0012F5A8 301638E4 00000003 00000000 00000000 00000000 !Ordinal44
0012F68C 30010488 0005010E 00000010 00000000 00000000 !Ordinal44
0012F7C0 300103A0 0005010E 00000010 00000000 00000000 !Ordinal44
0012F7E4 77E3A2D0 0005010E 00990010 00000000 00000000 !Ordinal44
0012F804 77E14730 30010351 0005010E 00000010 00000000
user32!SetWindowPlacement
0012F820 77E1558A 00427C48 00000010 00000000 00000000
user32!TranslateMessageEx
0012F848 77F9F04B 0012F858 00000018 00427C48 00000010 user32!DefWindowProcA
0012F8A4 77E17341 00427C48 00000010 00000000 00000000
ntdll!KiUserCallbackDispatcher
0012F8C4 301636C0 0005010E 00000010 00000000 00000000 user32!SendMessageW
0012F8FC 30036A1F 00000000 00000000 00000001 0099DFF8 !Ordinal44
0012FA9C 3007D516 0000000A 00000000 00000000 00000001 !Ordinal44
0012FAF0 30961FFC 3068B2A4 00000000 0000000A 0012FB6C !Ordinal44
0012FB5C 3096154A 00000000 00000000 00000001 0099DFF4 !MsoFPitbsFromHwnd
0012FBBC 309608C0 0099DFF4 00000001 0099DFF4 000000C8 !UnlockCab
0012FC30 30902409 0099DFF4 00000017 00000088 0199003C !UnlockCab
0012FD18 308F4246 00000017 0002017E 00000202 00000000 !MsoFGetEnvelopeClsid
0012FD90 77E3A2D0 0002017E 00000202 00000000 0199003C !MsoRegEnumKeyExW
0012FDB0 77E145E5 308F3FB7 0002017E 00000202 00000000
user32!SetWindowPlacement
0012FE3C 77E1A816 0012FEE4 00000000 30060E01 0012FEE4
user32!TranslateMessageEx
301731BC 047E8108 00000102 C2B6840F FF560007 00250C15 user32!DispatchMessageW
24748B56 00000000 00000000 00000000 00000000 00000000 <nosymbols>
*----> Raw Stack Dump <----*
0012e864 00 00 00 00 00 00 00 00 - 48 fa 7a 01 8a a8 1c 02 ........H.z.....
0012e874 00 00 00 00 09 04 00 00 - 00 00 00 00 48 fa 7a 01 ............H.z.
0012e884 3b 68 1b 02 00 00 00 00 - 54 02 00 00 00 00 00 00 ;h......T.......
0012e894 00 02 00 00 2c fe 12 00 - c8 a8 1e 02 00 00 00 00 ....,...........
0012e8a4 8c 9b 01 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012e8b4 e3 f9 3a 30 09 04 00 00 - 00 00 00 00 48 fa 7a 01 ..:0........H.z.
0012e8c4 41 00 00 00 00 00 00 00 - 41 00 00 00 ff ff ff ff A.......A.......
0012e8d4 00 00 00 00 41 00 00 00 - b8 e8 12 00 0c e9 12 00 ....A...........
0012e8e4 f1 48 3a 30 00 e9 12 00 - 48 fa 7a 01 00 00 00 00 .H:0....H.z.....
0012e8f4 58 ea 12 00 54 ed 12 00 - 01 00 00 00 1c 00 4c 02 X...T.........L.
0012e904 c0 9a 01 10 00 00 00 00 - 84 ea 12 00 2d 36 3a 30 ............-6:0
0012e914 18 00 4c 02 48 fa 7a 01 - 00 00 00 00 58 ea 12 00 ..L.H.z.....X...
0012e924 00 00 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012e934 00 00 00 00 48 f1 7a 01 - 00 00 00 00 ff ff ff ff ....H.z.........
0012e944 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012e954 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012e964 00 00 00 00 00 00 00 00 - 00 00 00 00 01 00 00 00 ................
0012e974 48 f1 7a 01 00 00 00 00 - 00 00 00 00 00 00 00 00 H.z.............
0012e984 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012e994 00 00 00 00 00 00 00 00 - a4 ea 12 00 84 ea 12 00 ................
State Dump for Thread Id 0x47c
eax=00000174 ebx=00140720 ecx=00141c10 edx=00000000 esi=00141c10 edi=00000100
eip=77f82230 esp=0112fe28 ebp=0112ff74 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
function: NtReplyWaitReceivePortEx
77f82225 b8ac000000 mov eax,0xac
77f8222a 8d542404 lea edx,[esp+0x4]
ss:01c29d0f=????????
77f8222e cd2e int 2e
77f82230 c21400 ret 0x14
77f82233 55 push ebp
77f82234 8bec mov ebp,esp
77f82236 56 push esi
77f82237 57 push edi
77f82238 53 push ebx
77f82239 8bf4 mov esi,esp
77f8223b ff7514 push dword ptr [ebp+0x14]
ss:01c29e5a=????????
77f8223e ff7510 push dword ptr [ebp+0x10]
ss:01c29e5a=????????
77f82241 ff750c push dword ptr [ebp+0xc]
ss:01c29e5a=????????
77f82244 ff5508 call dword ptr [ebp+0x8]
ss:01c29e5a=????????
77f82247 8be6 mov esp,esi
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0112FF74 77D56D9E 77D39A00 00141C10 40141728 00000070
ntdll!NtReplyWaitReceivePortEx
0112FFA8 77D41C6C 00140A78 0112FFEC 7C57B382 00140720 rpcrt4!TowerConstruct
0112FFB4 7C57B382 00140720 40141728 00000070 00140720
rpcrt4!I_RpcServerInqTransportType
0112FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW
State Dump for Thread Id 0x644
eax=77a50000 ebx=00000102 ecx=00144a78 edx=00000000 esi=77f820b1 edi=0122ff74
eip=77f820bc esp=0122ff60 ebp=0122ff7c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
function: NtDelayExecution
77f820b1 b832000000 mov eax,0x32
77f820b6 8d542404 lea edx,[esp+0x4]
ss:01d29e47=????????
77f820ba cd2e int 2e
77f820bc c20800 ret 0x8
77f820bf 53 push ebx
77f820c0 51 push ecx
77f820c1 6a00 push 0x0
77f820c3 c70701000000 mov dword ptr [edi],0x1
ds:0122ff74=dc3cba00
77f820c9 ff750c push dword ptr [ebp+0xc]
ss:01d29e62=????????
77f820cc 50 push eax
77f820cd e88af8ffff call RtlMultiByteToUnicodeN (77f8195c)
77f820d2 e97ffeffff jmp RtlConsoleMultiByteToUnicodeN+0x333
(77f81f56)
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0122FF7C 7C59A0B8 0000EA60 00000000 77AB85FC 0000EA60 ntdll!NtDelayExecution
00007530 00000000 00000000 00000000 00000000 00000000 kernel32!Sleep
*----> Raw Stack Dump <----*
0122ff60 ed a0 59 7c 00 00 00 00 - 74 ff 22 01 1d 9e 59 7c ..Y|....t."...Y|
0122ff70 78 4a 14 00 00 ba 3c dc - ff ff ff ff 30 75 00 00 xJ....<.....0u..
0122ff80 b8 a0 59 7c 60 ea 00 00 - 00 00 00 00 fc 85 ab 77 ..Y|`..........w
0122ff90 60 ea 00 00 fb 46 ab 77 - 00 00 00 00 00 00 a5 77 `....F.w.......w
0122ffa0 78 4a 14 00 ec ff 22 01 - 78 4a 14 00 53 46 ab 77 xJ....".xJ..SF.w
0122ffb0 d8 7a a6 77 c3 7a a6 77 - 82 b3 57 7c 78 4a 14 00 .z.w.z.w..W|xJ..
0122ffc0 d8 7a a6 77 c3 7a a6 77 - 78 4a 14 00 00 c0 fd 7f .z.w.z.wxJ......
0122ffd0 05 00 00 00 c0 ff 22 01 - 05 00 00 00 ff ff ff ff ......".........
0122ffe0 b4 1b 5c 7c f0 2a 57 7c - 00 00 00 00 00 00 00 00 ..\|.*W|........
0122fff0 00 00 00 00 39 46 ab 77 - 78 4a 14 00 00 00 00 00 ....9F.wxJ......
01230000 00 00 00 00 00 00 ff ff - 00 00 00 00 00 20 00 00 ............. ..
01230010 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230040 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230050 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230060 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230070 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230080 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230090 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
State Dump for Thread Id 0x56c
eax=65009ec9 ebx=00000000 ecx=006c006f edx=00000000 esi=77f820b1 edi=020cff98
eip=77f820bc esp=020cff84 ebp=020cffa0 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
function: NtDelayExecution
77f820b1 b832000000 mov eax,0x32
77f820b6 8d542404 lea edx,[esp+0x4]
ss:02bc9e6b=????????
77f820ba cd2e int 2e
77f820bc c20800 ret 0x8
77f820bf 53 push ebx
77f820c0 51 push ecx
77f820c1 6a00 push 0x0
77f820c3 c70701000000 mov dword ptr [edi],0x1
ds:020cff98=ffe17b80
77f820c9 ff750c push dword ptr [ebp+0xc]
ss:02bc9e86=????????
77f820cc 50 push eax
77f820cd e88af8ffff call RtlMultiByteToUnicodeN (77f8195c)
77f820d2 e97ffeffff jmp RtlConsoleMultiByteToUnicodeN+0x333
(77f81f56)
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
020CFFA0 7C59A0B8 000000C8 00000000 65009ED4 000000C8 ntdll!NtDelayExecution
020CFFEC 00000000 65009EC9 00000000 00000000 000000C8 kernel32!Sleep
*----> Raw Stack Dump <----*
020cff84 ed a0 59 7c 00 00 00 00 - 98 ff 0c 02 73 00 2e 00 ..Y|........s...
020cff94 2e 00 2e 00 80 7b e1 ff - ff ff ff ff ec ff 0c 02 .....{..........
020cffa4 b8 a0 59 7c c8 00 00 00 - 00 00 00 00 d4 9e 00 65 ..Y|...........e
020cffb4 c8 00 00 00 82 b3 57 7c - 00 00 00 00 73 00 2e 00 ......W|....s...
020cffc4 2e 00 2e 00 00 00 00 00 - 00 b0 fd 7f 6f 00 6c 00 ............o.l.
020cffd4 c0 ff 0c 02 6f 00 6c 00 - ff ff ff ff b4 1b 5c 7c ....o.l.......\|
020cffe4 f0 2a 57 7c 00 00 00 00 - 00 00 00 00 00 00 00 00 .*W|............
020cfff4 c9 9e 00 65 00 00 00 00 - 00 00 00 00 c8 00 00 00 ...e............
020d0004 00 01 00 00 ff ee ff ee - 02 10 00 00 00 00 00 00 ................
020d0014 00 fe 00 00 00 00 10 00 - 00 20 00 00 00 02 00 00 ......... ......
020d0024 00 20 00 00 f6 02 00 00 - ff ef fd 7f 07 00 08 06 . ..............
020d0034 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d0044 98 05 0d 02 0f 00 00 00 - f8 ff ff ff 50 00 0d 02 ............P...
020d0054 50 00 0d 02 40 06 0d 02 - 00 00 00 00 00 00 00 00 P...@...........
020d0064 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d0074 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d0084 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d0094 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d00a4 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d00b4 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
Since two weeks ago, every time I quit Excel I get an error:
Excel.exe has generated errors and will be closed by Windows. An error log
is being created
The error log is pasted in the postscript. I'm not a programmer or very
savvy about stuff like this, I'm a power user of built-in Excel functions (up
to VBA and add-ins, I'm knowledgeable, but then it's a cliff). So I've tried
rebooting, reinstalling Excel, updating Office to sp3, removing Add-ins (the
strange thing is, I can't remove add-ins permanently - they go away for my
session, but then perhaps because the session doesn't end properly, when I
restart Excel they are all there again under Tools, Commands and Tools,
Add-ins.
Any tips would be highly appreciated.
Jeff
PS Here is the relevant portion of drwtsn32.log in C:\Docs and Settings\All
Users\Documents\DrWatson with private info blanked out:
Application exception occurred:
App: (pid=1304)
When: 11/29/2004 @ 14:54:12.473
Exception number: c0000005 (access violation)
*----> System Information <----*
Computer Name:
User Name:
Number of Processors: 1
Processor Type: x86 Family 6 Model 8 Stepping 10
Windows 2000 Version: 5.0
Current Build: 2195
Service Pack: 4
Current Type: Uniprocessor Free
Registered Organization:
Registered Owner:
*----> Task List <----*
0 Idle.exe
8 System.exe
172 smss.exe
196 csrss.exe
192 winlogon.exe
244 services.exe
256 lsass.exe
368 ibmpmsvc.exe
436 svchost.exe
480 svchost.exe
532 spoolsv.exe
556 netdde.exe
584 netdde.exe
612 msdtc.exe
720 defwatch.exe
764 mdm.exe
884 rtvscan.exe
912 regsvc.exe
928 MSTask.exe
980 tcpsvcs.exe
1004 snmp.exe
1052 WinMgmt.exe
1064 mspmspsv.exe
1080 svchost.exe
1096 inetinfo.exe
1328 Explorer.exe
1352 WinMgmt.exe
1448 tp4serv.exe
1476 tphkmgr.exe
1488 PRPCUI.exe
1496 vptray.exe
1516 ltmsg.exe
1524 tfswctrl.exe
1532 iTunesHelper.ex.exe
1540 SprintPortA.exe
1548 qttask.exe
1564 realsched.exe
1636 PdaNet.exe
1304 EXCEL.exe
1396 drwtsn32.exe
0 _Total.exe
(30000000 - 306D9000)
(77F80000 - 77FFA000)
(7C2D0000 - 7C332000)
(7C570000 - 7C623000)
(77D30000 - 77D9E000)
(77F40000 - 77F79000)
(77E10000 - 77E6F000)
(308C0000 - 30E1D000)
(77A50000 - 77B3C000)
(75E60000 - 75E7A000)
(775A0000 - 77626000)
(779B0000 - 77A4B000)
(78000000 - 78045000)
(00E10000 - 01014000)
(782F0000 - 78538000)
(70A70000 - 70AD5000)
(71710000 - 71794000)
(77840000 - 7787E000)
(770C0000 - 770E3000)
(65000000 - 65263000)
(65300000 - 65327000)
(10000000 - 100DF000)
(3FFE0000 - 3FFE9000)
(77800000 - 7781E000)
(76620000 - 76631000)
(020E0000 - 0216F000)
(02190000 - 02239000)
(02250000 - 02273000)
(02290000 - 022B2000)
(772B0000 - 7731C000)
State Dump for Thread Id 0x168
eax=00000000 ebx=017afa48 ecx=00000000 edx=bcfbd9d8 esi=02200868 edi=00000000
eip=021ca69a esp=0012e864 ebp=0012e8e0 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
function: RSK4_SetGetStreamOrBlobInputOutputInfo
021ca67d c3 ret
021ca67e 90 nop
021ca67f 90 nop
021ca680 8b442404 mov eax,[esp+0x4]
ss:00c2874b=????????
021ca684 53 push ebx
021ca685 25ffffff7f and eax,0x7fffffff
021ca68a 56 push esi
021ca68b 57 push edi
021ca68c 8d348568082002 lea esi,[02200868+eax*4]
ds:00000000=????????
021ca693 8b048568082002 mov eax,[02200868+eax*4]
ds:00000000=????????
FAULT ->021ca69a 8b5004 mov edx,[eax+0x4]
ds:00af9ee6=????????
021ca69d 4a dec edx
021ca69e 895004 mov [eax+0x4],edx
ds:00af9ee6=????????
021ca6a1 8b3e mov edi,[esi]
ds:02200868=00000000
021ca6a3 8b4f04 mov ecx,[edi+0x4]
ds:00af9ee6=????????
021ca6a6 85c9 test ecx,ecx
021ca6a8 0f94c3 sete bl
021ca6ab 84db test bl,bl
021ca6ad 741a jz 021d2bc9
021ca6af 85ff test edi,edi
021ca6b1 7410 jz 021d31c3
021ca6b3 8bcf mov ecx,edi
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0012E8E0 303A48F1 0012E900 017AFA48 00000000 0012EA58
!RSK4_SetGetStreamOrBlobInputOutputInfo
0012E90C 303A362D 024C0018 017AFA48 00000000 0012EA58 !Ordinal44
0012EA84 301D3F95 0012ED88 0012ED54 00000000 00000000 !Ordinal44
0012ED74 3005E769 00000000 8ED20000 00000000 00000000 !Ordinal44
0012F1F8 30036A1F 00000000 8ED20000 00000000 00000001 !Ordinal44
0012F398 301D165D 00000011 0012F3C8 00000001 00000000 !Ordinal44
0012F3D0 30059DB4 00010002 00000000 00000000 00000001 !Ordinal44
0012F3EC 30163A97 00010002 00000003 00000000 00000000 !Ordinal44
0012F408 30036A1F 00000000 00000000 00000000 00000000 !Ordinal44
0012F5A8 301638E4 00000003 00000000 00000000 00000000 !Ordinal44
0012F68C 30010488 0005010E 00000010 00000000 00000000 !Ordinal44
0012F7C0 300103A0 0005010E 00000010 00000000 00000000 !Ordinal44
0012F7E4 77E3A2D0 0005010E 00990010 00000000 00000000 !Ordinal44
0012F804 77E14730 30010351 0005010E 00000010 00000000
user32!SetWindowPlacement
0012F820 77E1558A 00427C48 00000010 00000000 00000000
user32!TranslateMessageEx
0012F848 77F9F04B 0012F858 00000018 00427C48 00000010 user32!DefWindowProcA
0012F8A4 77E17341 00427C48 00000010 00000000 00000000
ntdll!KiUserCallbackDispatcher
0012F8C4 301636C0 0005010E 00000010 00000000 00000000 user32!SendMessageW
0012F8FC 30036A1F 00000000 00000000 00000001 0099DFF8 !Ordinal44
0012FA9C 3007D516 0000000A 00000000 00000000 00000001 !Ordinal44
0012FAF0 30961FFC 3068B2A4 00000000 0000000A 0012FB6C !Ordinal44
0012FB5C 3096154A 00000000 00000000 00000001 0099DFF4 !MsoFPitbsFromHwnd
0012FBBC 309608C0 0099DFF4 00000001 0099DFF4 000000C8 !UnlockCab
0012FC30 30902409 0099DFF4 00000017 00000088 0199003C !UnlockCab
0012FD18 308F4246 00000017 0002017E 00000202 00000000 !MsoFGetEnvelopeClsid
0012FD90 77E3A2D0 0002017E 00000202 00000000 0199003C !MsoRegEnumKeyExW
0012FDB0 77E145E5 308F3FB7 0002017E 00000202 00000000
user32!SetWindowPlacement
0012FE3C 77E1A816 0012FEE4 00000000 30060E01 0012FEE4
user32!TranslateMessageEx
301731BC 047E8108 00000102 C2B6840F FF560007 00250C15 user32!DispatchMessageW
24748B56 00000000 00000000 00000000 00000000 00000000 <nosymbols>
*----> Raw Stack Dump <----*
0012e864 00 00 00 00 00 00 00 00 - 48 fa 7a 01 8a a8 1c 02 ........H.z.....
0012e874 00 00 00 00 09 04 00 00 - 00 00 00 00 48 fa 7a 01 ............H.z.
0012e884 3b 68 1b 02 00 00 00 00 - 54 02 00 00 00 00 00 00 ;h......T.......
0012e894 00 02 00 00 2c fe 12 00 - c8 a8 1e 02 00 00 00 00 ....,...........
0012e8a4 8c 9b 01 10 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012e8b4 e3 f9 3a 30 09 04 00 00 - 00 00 00 00 48 fa 7a 01 ..:0........H.z.
0012e8c4 41 00 00 00 00 00 00 00 - 41 00 00 00 ff ff ff ff A.......A.......
0012e8d4 00 00 00 00 41 00 00 00 - b8 e8 12 00 0c e9 12 00 ....A...........
0012e8e4 f1 48 3a 30 00 e9 12 00 - 48 fa 7a 01 00 00 00 00 .H:0....H.z.....
0012e8f4 58 ea 12 00 54 ed 12 00 - 01 00 00 00 1c 00 4c 02 X...T.........L.
0012e904 c0 9a 01 10 00 00 00 00 - 84 ea 12 00 2d 36 3a 30 ............-6:0
0012e914 18 00 4c 02 48 fa 7a 01 - 00 00 00 00 58 ea 12 00 ..L.H.z.....X...
0012e924 00 00 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012e934 00 00 00 00 48 f1 7a 01 - 00 00 00 00 ff ff ff ff ....H.z.........
0012e944 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012e954 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012e964 00 00 00 00 00 00 00 00 - 00 00 00 00 01 00 00 00 ................
0012e974 48 f1 7a 01 00 00 00 00 - 00 00 00 00 00 00 00 00 H.z.............
0012e984 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012e994 00 00 00 00 00 00 00 00 - a4 ea 12 00 84 ea 12 00 ................
State Dump for Thread Id 0x47c
eax=00000174 ebx=00140720 ecx=00141c10 edx=00000000 esi=00141c10 edi=00000100
eip=77f82230 esp=0112fe28 ebp=0112ff74 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
function: NtReplyWaitReceivePortEx
77f82225 b8ac000000 mov eax,0xac
77f8222a 8d542404 lea edx,[esp+0x4]
ss:01c29d0f=????????
77f8222e cd2e int 2e
77f82230 c21400 ret 0x14
77f82233 55 push ebp
77f82234 8bec mov ebp,esp
77f82236 56 push esi
77f82237 57 push edi
77f82238 53 push ebx
77f82239 8bf4 mov esi,esp
77f8223b ff7514 push dword ptr [ebp+0x14]
ss:01c29e5a=????????
77f8223e ff7510 push dword ptr [ebp+0x10]
ss:01c29e5a=????????
77f82241 ff750c push dword ptr [ebp+0xc]
ss:01c29e5a=????????
77f82244 ff5508 call dword ptr [ebp+0x8]
ss:01c29e5a=????????
77f82247 8be6 mov esp,esi
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0112FF74 77D56D9E 77D39A00 00141C10 40141728 00000070
ntdll!NtReplyWaitReceivePortEx
0112FFA8 77D41C6C 00140A78 0112FFEC 7C57B382 00140720 rpcrt4!TowerConstruct
0112FFB4 7C57B382 00140720 40141728 00000070 00140720
rpcrt4!I_RpcServerInqTransportType
0112FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW
State Dump for Thread Id 0x644
eax=77a50000 ebx=00000102 ecx=00144a78 edx=00000000 esi=77f820b1 edi=0122ff74
eip=77f820bc esp=0122ff60 ebp=0122ff7c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
function: NtDelayExecution
77f820b1 b832000000 mov eax,0x32
77f820b6 8d542404 lea edx,[esp+0x4]
ss:01d29e47=????????
77f820ba cd2e int 2e
77f820bc c20800 ret 0x8
77f820bf 53 push ebx
77f820c0 51 push ecx
77f820c1 6a00 push 0x0
77f820c3 c70701000000 mov dword ptr [edi],0x1
ds:0122ff74=dc3cba00
77f820c9 ff750c push dword ptr [ebp+0xc]
ss:01d29e62=????????
77f820cc 50 push eax
77f820cd e88af8ffff call RtlMultiByteToUnicodeN (77f8195c)
77f820d2 e97ffeffff jmp RtlConsoleMultiByteToUnicodeN+0x333
(77f81f56)
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0122FF7C 7C59A0B8 0000EA60 00000000 77AB85FC 0000EA60 ntdll!NtDelayExecution
00007530 00000000 00000000 00000000 00000000 00000000 kernel32!Sleep
*----> Raw Stack Dump <----*
0122ff60 ed a0 59 7c 00 00 00 00 - 74 ff 22 01 1d 9e 59 7c ..Y|....t."...Y|
0122ff70 78 4a 14 00 00 ba 3c dc - ff ff ff ff 30 75 00 00 xJ....<.....0u..
0122ff80 b8 a0 59 7c 60 ea 00 00 - 00 00 00 00 fc 85 ab 77 ..Y|`..........w
0122ff90 60 ea 00 00 fb 46 ab 77 - 00 00 00 00 00 00 a5 77 `....F.w.......w
0122ffa0 78 4a 14 00 ec ff 22 01 - 78 4a 14 00 53 46 ab 77 xJ....".xJ..SF.w
0122ffb0 d8 7a a6 77 c3 7a a6 77 - 82 b3 57 7c 78 4a 14 00 .z.w.z.w..W|xJ..
0122ffc0 d8 7a a6 77 c3 7a a6 77 - 78 4a 14 00 00 c0 fd 7f .z.w.z.wxJ......
0122ffd0 05 00 00 00 c0 ff 22 01 - 05 00 00 00 ff ff ff ff ......".........
0122ffe0 b4 1b 5c 7c f0 2a 57 7c - 00 00 00 00 00 00 00 00 ..\|.*W|........
0122fff0 00 00 00 00 39 46 ab 77 - 78 4a 14 00 00 00 00 00 ....9F.wxJ......
01230000 00 00 00 00 00 00 ff ff - 00 00 00 00 00 20 00 00 ............. ..
01230010 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230040 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230050 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230060 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230070 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230080 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01230090 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
State Dump for Thread Id 0x56c
eax=65009ec9 ebx=00000000 ecx=006c006f edx=00000000 esi=77f820b1 edi=020cff98
eip=77f820bc esp=020cff84 ebp=020cffa0 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
function: NtDelayExecution
77f820b1 b832000000 mov eax,0x32
77f820b6 8d542404 lea edx,[esp+0x4]
ss:02bc9e6b=????????
77f820ba cd2e int 2e
77f820bc c20800 ret 0x8
77f820bf 53 push ebx
77f820c0 51 push ecx
77f820c1 6a00 push 0x0
77f820c3 c70701000000 mov dword ptr [edi],0x1
ds:020cff98=ffe17b80
77f820c9 ff750c push dword ptr [ebp+0xc]
ss:02bc9e86=????????
77f820cc 50 push eax
77f820cd e88af8ffff call RtlMultiByteToUnicodeN (77f8195c)
77f820d2 e97ffeffff jmp RtlConsoleMultiByteToUnicodeN+0x333
(77f81f56)
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
020CFFA0 7C59A0B8 000000C8 00000000 65009ED4 000000C8 ntdll!NtDelayExecution
020CFFEC 00000000 65009EC9 00000000 00000000 000000C8 kernel32!Sleep
*----> Raw Stack Dump <----*
020cff84 ed a0 59 7c 00 00 00 00 - 98 ff 0c 02 73 00 2e 00 ..Y|........s...
020cff94 2e 00 2e 00 80 7b e1 ff - ff ff ff ff ec ff 0c 02 .....{..........
020cffa4 b8 a0 59 7c c8 00 00 00 - 00 00 00 00 d4 9e 00 65 ..Y|...........e
020cffb4 c8 00 00 00 82 b3 57 7c - 00 00 00 00 73 00 2e 00 ......W|....s...
020cffc4 2e 00 2e 00 00 00 00 00 - 00 b0 fd 7f 6f 00 6c 00 ............o.l.
020cffd4 c0 ff 0c 02 6f 00 6c 00 - ff ff ff ff b4 1b 5c 7c ....o.l.......\|
020cffe4 f0 2a 57 7c 00 00 00 00 - 00 00 00 00 00 00 00 00 .*W|............
020cfff4 c9 9e 00 65 00 00 00 00 - 00 00 00 00 c8 00 00 00 ...e............
020d0004 00 01 00 00 ff ee ff ee - 02 10 00 00 00 00 00 00 ................
020d0014 00 fe 00 00 00 00 10 00 - 00 20 00 00 00 02 00 00 ......... ......
020d0024 00 20 00 00 f6 02 00 00 - ff ef fd 7f 07 00 08 06 . ..............
020d0034 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d0044 98 05 0d 02 0f 00 00 00 - f8 ff ff ff 50 00 0d 02 ............P...
020d0054 50 00 0d 02 40 06 0d 02 - 00 00 00 00 00 00 00 00 P...@...........
020d0064 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d0074 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d0084 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d0094 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d00a4 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
020d00b4 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................