date/time
: 2015-05-28, [Link], 196ms
computer name
: HP
user name
: BKPP 26 <admin>
registered owner : BKPP 26 / Hewlett-Packard Company
operating system : Windows NT New x64 build 9200
system language : Indonesian
system up time
: 7 days 3 hours
program up time : 43 seconds
processors
: 4x Intel(R) Core(TM) i3-4160 CPU @ 3.60GHz
physical memory : 571/1964 MB (free/total)
free disk space : (C:) 403,31 GB
display mode
: 1600x900, 32 bit
process id
: $17bc
allocated memory : 30,09 MB
executable
: Unofficial Ragnarok [Link]
exec. date/time : 2014-06-27 02:40
version
: [Link]
compiled with
: Delphi 2010
madExcept version : 3.0l
callstack crc
: $ee9367bc, $8e5143e4, $8e5143e4
exception number : 1
exception class : EAccessViolation
exception message : Access violation at address 005140E7 in module 'Unofficial R
agnarok [Link]'. Read of address 00000010.
main thread ($1650):
005140e7 +00f Unofficial
SizeStored
005140cd +005 Unofficial
ntSizeStored
005167e3 +58b Unofficial
Params
004f3002 +02e Unofficial
Wnd
00512aed +005 Unofficial
[Link]
0051685e +00a Unofficial
Wnd
004f3552 +016 Unofficial
Handle
004f722c +01c Unofficial
Needed
004f7239 +005 Unofficial
dle
0051c511 +02d Unofficial
74dba201 +015 [Link]
0049f5b8 +014 Unofficial
7735c68f +02b [Link]
atcher
00580ceb +01f Unofficial
y
004f18a6 +0ae Unofficial
y
00512ac4 +038 Unofficial
[Link]
005138bd +0f9 Unofficial
y
0049e2c3 +057 Unofficial
Components
005118b9 +035 Unofficial
Ragnarok [Link] Forms
[Link]
Ragnarok [Link] Forms
[Link]
Ragnarok [Link] Forms
[Link]
Ragnarok [Link] Controls
[Link]
Ragnarok [Link] Forms
TScrollingWinContr
Ragnarok [Link] Forms
[Link]
Ragnarok [Link] Controls
[Link]
Ragnarok [Link] Controls
[Link]
Ragnarok [Link] Controls
[Link]
Ragnarok [Link] Forms
Ragnarok [Link] Classes
GetTopMostWindows
EnumWindows
StdWndProc
KiUserCallbackDisp
Ragnarok [Link] OleCtrls
[Link]
Ragnarok [Link] Controls
[Link]
Ragnarok [Link] Forms
TScrollingWinContr
Ragnarok [Link] Forms
[Link]
Ragnarok [Link] Classes
[Link]
Ragnarok [Link] Forms
DoneApplication
0046ed76
00406669
00618d33
75c2919d
k
+026
+065
+3af
+00c
Unofficial Ragnarok [Link] SysUtils
DoExitProc
Unofficial Ragnarok [Link] System 985 +0 @Halt0
Unofficial Ragnarok [Link] Thor
236 +72 initialization
[Link]
BaseThreadInitThun
thread $1b90:
75c2919d +c [Link] BaseThreadInitThunk
thread $12f4:
75c2919d +c [Link] BaseThreadInitThunk
thread $1474:
00464631 +0d Unofficial Ragnarok [Link] madExcept CallThreadProcSafe
0046469b +37 Unofficial Ragnarok [Link] madExcept ThreadExceptFrame
75c2919d +0c [Link]
BaseThreadInitThunk
>> created by main thread ($1650) at:
7518eabc +00 [Link]
thread $a98:
75c2919d +c [Link] BaseThreadInitThunk
thread $11fc:
75c2919d +c [Link] BaseThreadInitThunk
thread $fd0:
74fe0921 +000
74dac29a +153
75129355 +058
75c2919d +00c
[Link]
[Link]
[Link]
[Link]
WaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
CoWaitForMultipleHandles
BaseThreadInitThunk
modules:
00400000 Unofficial Ragnarok [Link] [Link]
C:\Users\BKPP 26\Doc
uments\Andri Game File\uRagnarok
66190000 [Link]
11.0.9600.17278
C:\windows\SYSTEM32
6f400000 [Link]
11.0.9600.17278
C:\Windows\SYSTEM32
70e80000 [Link]
11.0.9600.17278
C:\windows\SYSTEM32
70fb0000 [Link]
7.0.9600.17278
C:\windows\SYSTEM32
71320000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
713c0000 [Link]
6.3.9600.17031
C:\windows\system32
71510000 [Link]
6.3.9600.17031
C:\windows\system32
71800000 [Link]
7.2.9600.16421
C:\Windows\SYSTEM32
718f0000 [Link]
6.10.9600.17031
C:\windows\WinSxS\x8
6_microsoft.[Link]-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8
b01377ea7
71af0000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
71b20000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
71d60000 [Link]
6.3.9600.17238
C:\windows\system32
71e20000 [Link]
6.3.9600.17042
C:\windows\SYSTEM32
71ff0000 [Link]
6.3.9600.17238
C:\windows\SYSTEM32
72140000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
72180000 [Link]
6.3.9600.16384
C:\Windows\System32
72190000 [Link]
6.3.9600.17031
C:\windows\SYSTEM32
721b0000 [Link]
6.3.9600.17200
C:\windows\system32
721e0000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
72200000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
72290000 [Link]
[Link]
C:\Program Files (x8
6)\Bonjour
722d0000 [Link]
6.3.9600.17039
C:\windows\SYSTEM32
72590000 [Link]
6.3.9600.17041
C:\windows\SYSTEM32
725b0000
72d10000
72d40000
72f10000
72f50000
743e0000
74b40000
74b50000
74c10000
74c90000
74ca0000
74cb0000
74d10000
74d20000
74da0000
74ef0000
74f80000
74fd0000
750a0000
750e0000
75110000
753b0000
754c0000
75570000
75680000
75920000
759a0000
75aa0000
75b30000
75b40000
75c10000
75f90000
771b0000
77320000
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
WS2_32.dll
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
processes:
0000 Idle
0004 System
0160 [Link]
0234 [Link]
0274 [Link]
02d0 [Link]
02d8 [Link]
0324 [Link]
0344 [Link]
03b8 [Link]
0050 [Link]
018c [Link]
0210 [Link]
02c8 [Link]
0384 [Link]
0444 [Link]
0470 [Link]
050c [Link]
0528 [Link]
05cc [Link]
05dc [Link]
061c [Link]
0654 [Link]
066c cmw_srv.exe
11.0.9600.17278
6.3.9600.16384
11.0.9600.17278
6.3.9600.16384
6.3.9600.16384
6.3.9600.16384
6.3.9600.16384
6.3.9600.16384
6.3.9600.17238
6.3.9600.16384
6.3.9600.16384
6.3.9600.17120
6.3.9600.16384
6.3.9600.16408
6.3.9600.17238
2001.12.10530.16384
6.3.9600.16384
6.3.9600.17278
6.3.9600.16384
6.3.9600.17031
6.3.9600.17031
6.3.9600.17246
6.3.9600.17216
6.3.9600.17042
6.3.9600.17664
6.3.9600.17031
6.3.9600.16506
6.3.9600.17238
6.3.9600.16384
7.0.9600.16384
6.3.9600.17056
6.3.9600.17278
6.3.9600.16384
6.3.9600.17278
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
C:\Windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\system32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\system32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
0684 [Link]
06a0 [Link]
071c [Link]
0738 [Link]
0a34 [Link]
0a68 [Link]
0dfc [Link]
0fc0 [Link]
0acc [Link]
0938 HPSA_Service.exe
0b54 [Link]
0ff4 jhi_service.exe
09fc [Link]
124c [Link]
0c24 [Link]
0c48 [Link]
0d9c [Link]
0f0c [Link]
18bc [Link]
1344 [Link]
1034 [Link]
1844 [Link]
0b38 [Link]
0d14 [Link]
1258 [Link]
0bc4 [Link]
0884 [Link]
0c2c [Link]
16a4 [Link]
1b6c [Link]
198c [Link]
1924 [Link]
0e74 [Link]
1b74 [Link]
09ec [Link]
1af8 [Link]
0f04 [Link]
)\CyberLink\YouCam
0e88 [Link]
ata\Local\Google\Chrome\Application
0cd4 [Link]
ata\Local\Google\Chrome\Application
0750 [Link]
ata\Local\Google\Chrome\Application
1714 [Link]
ata\Local\Google\Chrome\Application
142c [Link]
1294 [Link]
ata\Local\Google\Chrome\Application
1008 [Link]
ata\Local\Google\Chrome\Application
0c44 [Link]
140c [Link]
16d4 [Link]
0ac0 [Link]
ata\Local\Google\Chrome\Application
0ce0 [Link]
ata\Local\Google\Chrome\Application
14e4 [Link]
ata\Local\Google\Chrome\Application
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
1
1
1
1
1
1
1
1
1
1
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
859
13
13
13
0
20
35
55
55
26
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
693
17
18
13
0
28
10
17
17
46
normal
normal
normal
normal
normal
normal
normal
normal
below normal c:\Program Files (x86
1 117 66 normal
C:\Users\BKPP 26\AppD
1 4
11 normal
C:\Users\BKPP 26\AppD
1 0
normal
C:\Users\BKPP 26\AppD
1 0
idle
C:\Users\BKPP 26\AppD
1 19 36 normal
1 0 0 idle
C:\Users\BKPP 26\AppD
1 52 1
normal
C:\Users\BKPP 26\AppD
0
0
0
1
0
0
0
0
0
0
0
0
idle
C:\Users\BKPP 26\AppD
1 0
normal
C:\Users\BKPP 26\AppD
1 0
idle
C:\Users\BKPP 26\AppD
0220 [Link]
0 0 0
03fc [Link]
0 0 0 idle
17bc Unofficial Ragnarok [Link] 1 109 49 normal
ments\Andri Game File\uRagnarok
C:\Users\BKPP 26\Docu
hardware:
+ {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
- Fax
- Foxit PhantomPDF Printer
- HP ePrint
- Microsoft XPS Document Writer
- Root Print Queue
- Send To OneNote 2010
+ {36fc9e60-c465-11cf-8056-444553540000}
- Generic USB Hub
- Generic USB Hub
- Intel(R) 8 Series/C220 Series USB EHCI #1 - 8C26
- Intel(R) 8 Series/C220 Series USB EHCI #2 - 8C2D
- Intel(R) USB 3.0 eXtensible Host Controller - 0100 (Microsoft)
- USB Composite Device
- USB Mass Storage Device
- USB Mass Storage Device
- USB Root Hub
- USB Root Hub
- USB Root Hub (xHCI)
+ {4d36e965-e325-11ce-bfc1-08002be10318}
- hp CDDVDW SH-216DB
+ {4d36e966-e325-11ce-bfc1-08002be10318}
- ACPI x64-based PC
+ {4d36e967-e325-11ce-bfc1-08002be10318}
- Generic- Multiple Reader USB Device
- SanDisk Cruzer Blade USB Device
- ST500DM002-1BD142
+ {4d36e968-e325-11ce-bfc1-08002be10318}
- Intel(R) HD Graphics 4400 (driver 10.18.10.3621)
+ {4d36e96a-e325-11ce-bfc1-08002be10318}
- Standard SATA AHCI Controller
+ {4d36e96b-e325-11ce-bfc1-08002be10318}
- HID Keyboard Device
+ {4d36e96c-e325-11ce-bfc1-08002be10318}
- CyberLink WebCam Virtual Driver (driver 1.0.27893.6128)
- Realtek High Definition Audio (driver 6.0.1.7283)
+ {4d36e96e-e325-11ce-bfc1-08002be10318}
- HP 20wd LED Backlit Monitor (driver [Link])
+ {4d36e96f-e325-11ce-bfc1-08002be10318}
- HID-compliant mouse
+ {4d36e972-e325-11ce-bfc1-08002be10318}
- 802.11n USB Wireless LAN Card
- Anchorfree HSS VPN Adapter (driver [Link])
- Realtek PCIe GBE Family Controller (driver 8.34.617.2014)
+ {4d36e97b-e325-11ce-bfc1-08002be10318}
- Microsoft Storage Spaces Controller
+ {4d36e97d-e325-11ce-bfc1-08002be10318}
- ACPI Fan
- ACPI Fan
- ACPI Fan
- ACPI Fan
- ACPI Fan
- ACPI Fixed Feature Button
- ACPI Power Button
- ACPI Processor Aggregator
- ACPI Sleep Button
- ACPI Thermal Zone
- ACPI Thermal Zone
- Composite Bus Enumerator
- Direct memory access controller
- High Definition Audio Controller
- High precision event timer
- Intel(R) 4th Gen Core processor DRAM Controller - 0C00 (driver 9.4.0.1023)
- Intel(R) 8 Series/C220 Series PCI Express Root Port #1 - 8C10 (driver 9.4.0.
1023)
- Intel(R) 8 Series/C220 Series PCI Express Root Port #4 - 8C16 (driver 9.4.0.
1023)
- Intel(R) 8 Series/C220 Series SMBus Controller - 8C22 (driver 9.4.0.1023)
- Intel(R) 82802 Firmware Hub Device
- Intel(R) H81 LPC Controller - 8C5C (driver 9.4.0.1023)
- Intel(R) Management Engine Interface (driver 9.5.24.1790)
- Intel(R) Xeon(R) processor E3-1200 v3/4th Gen Core processor PCI Express x16
Controller - 0C01 (driver 9.4.0.1023)
- IWD Bus Enumerator (driver [Link])
- Microsoft ACPI-Compliant System
- Microsoft Basic Display Driver
- Microsoft Basic Render Driver
- Microsoft System Management BIOS Driver
- Microsoft UEFI-Compliant System
- Microsoft Virtual Drive Enumerator
- Microsoft Windows Management Interface for ACPI
- Motherboard resources
- Motherboard resources
- Motherboard resources
- Motherboard resources
- Motherboard resources
- Motherboard resources
- NDIS Virtual Network Adapter Enumerator
- Numeric data processor
- PCI Express Root Complex
- Plug and Play Software Device Enumerator
- Programmable interrupt controller
- Remote Desktop Device Redirector Bus
- System CMOS/real time clock
- System timer
- UMBus Root Bus Enumerator
- Volume Manager
+ {50127dc3-0f36-415e-a6cc-4cb3be910b65}
- Intel(R) Core(TM) i3-4160 CPU @ 3.60GHz
- Intel(R) Core(TM) i3-4160 CPU @ 3.60GHz
- Intel(R) Core(TM) i3-4160 CPU @ 3.60GHz
- Intel(R) Core(TM) i3-4160 CPU @ 3.60GHz
+ {533c5b84-ec70-11d2-9505-00c04f79deaf}
- Generic volume shadow copy
- Generic volume shadow copy
- Generic volume shadow copy
- Generic volume shadow copy
+ {62f9c741-b25a-46ce-b54c-9bccce08b6f2}
- ARIE-PC: ARIE:
- Microsoft Device Association Root Enumerator
- Microsoft IPv4 IPv6 Transition Adapter Bus
+ {745a17a0-74d3-11d0-b6fe-00a0c90f57da}
- HID-compliant consumer control device
- HID-compliant system controller
- USB Input Device
- USB Input Device
- USB Input Device
+ {d94ee5d8-d189-4994-83d2-f68d7d41b0e6}
- Trusted Platform Module 1.2
+ {eec5ad98-8080-425f-922a-dabf3de3f69a}
- G:\
+ {f2e7dd72-6468-4e36-b6f1-6488f42c1b52}
- System Firmware
cpu
eax
ebx
ecx
edx
esi
edi
eip
esp
ebp
registers:
= 01f10180
= 01f10180
= 0018f834
= 00000000
= 0051504c
= 0018f82c
= 005140e7
= 0018f7b0
= 00000000
stack dump:
0018f7b0 d2
0018f7c0 b0
0018f7d0 80
0018f7e0 b4
0018f7f0 80
0018f800 00
0018f810 5e
0018f820 86
0018f830 00
0018f840 6a
0018f850 08
0018f860 00
0018f870 00
0018f880 6e
0018f890 00
0018f8a0 00
0018f8b0 00
0018f8c0 00
0018f8d0 00
0018f8e0 00
40
20
01
f9
01
00
00
00
00
01
00
00
00
00
00
00
00
00
00
00
disassembling:
[...]
0040664c
00406651
00406656
0040665a
0040665c
0040665f
00406661
00406663
00406665
00406667
00406669
>
0040666b
0040666e
00406670
00406674
51
00
f1
18
f1
00
00
00
00
00
00
40
00
46
00
00
00
00
00
00
mov
call
cmp
jnz
cmp
jz
mov
mov
xor
mov
call
cmp
jnz
cmp
jnz
00
90
01
00
01
00
00
01
86
00
00
00
00
00
00
00
00
00
00
00
80
ff
80
b0
80
4c
f0
1a
00
ff
60
00
00
72
00
00
00
00
00
00
01
ff
01
5e
01
f8
02
5d
00
01
d4
00
00
00
00
00
00
00
00
00
f1
ff
f1
40
f1
18
00
53
0d
00
40
00
00
6d
00
00
00
00
00
00
01
ff
01
00
01
00
00
f3
00
00
00
00
00
00
00
00
00
00
00
00
e8
1e
80
f8
00
00
01
50
f6
00
00
03
54
00
00
00
00
00
00
00
67
a5
01
f8
00
00
00
53
01
00
00
00
00
00
00
00
00
00
00
00
51
da
f1
18
00
00
00
84
00
00
00
01
4d
00
00
00
00
00
00
00
00
74
01
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
f8
08
ff
20
20
00
d4
2d
00
00
00
61
00
00
00
00
00
00
00
00
f8
30
ff
b1
b1
00
85
01
00
00
00
00
00
00
00
00
00
00
00
00
18
4f
ff
af
af
00
f7
00
00
00
00
69
00
00
00
00
00
00
00
00
00
00
ff
00
00
00
01
00
00
00
00
00
00
00
00
00
00
00
00
.@Q......gQ.....
...........t....
.............0O.
.....^@.........
................
....L...........
^...............
.....][Link]......
............-...
j...............
....`.@.........
..@.............
........T.M.a.i.
n.F.r.m.........
................
................
................
................
................
................
eax, $62eb1c
-$10e ($406548)
; [Link]
byte ptr [ebx+$28], 0
loc_406670
dword ptr [edi], 0
loc_406670
eax, [edi]
esi, eax
eax, eax
[edi], eax
esi
dword ptr [edi], 0
loc_406661
byte ptr [ebx+$28], 2
loc_406684
00406676
0040667d
0040667f
00406681
00406684
00406689
[...]
cmp
jnz
xor
mov
call
cmp
dword ptr [$619000], 0
loc_406684
eax, eax
[ebx+$c], eax
+$5d3e7 ($463a70)
; [Link]
byte ptr [ebx+$28], 1
date/time
: 2015-05-28, [Link], 92ms
computer name
: HP
user name
: BKPP 26 <admin>
registered owner : BKPP 26 / Hewlett-Packard Company
operating system : Windows NT New x64 build 9200
system language : Indonesian
system up time
: 7 days 9 hours
program up time : 55 seconds
processors
: 4x Intel(R) Core(TM) i3-4160 CPU @ 3.60GHz
physical memory : 749/1964 MB (free/total)
free disk space : (C:) 403,30 GB
display mode
: 1600x900, 32 bit
process id
: $1af4
allocated memory : 30,25 MB
executable
: Unofficial Ragnarok [Link]
exec. date/time : 2014-06-27 02:40
version
: [Link]
compiled with
: Delphi 2010
madExcept version : 3.0l
callstack crc
: $ee9367bc, $72747e59, $72747e59
exception number : 1
exception class : EAccessViolation
exception message : Access violation at address 005140E7 in module 'Unofficial R
agnarok [Link]'. Read of address 00000010.
main thread ($1284):
005140e7 +00f Unofficial
SizeStored
005140cd +005 Unofficial
ntSizeStored
005167e3 +58b Unofficial
Params
004f3002 +02e Unofficial
Wnd
00512aed +005 Unofficial
[Link]
0051685e +00a Unofficial
Wnd
004f3552 +016 Unofficial
Handle
004f722c +01c Unofficial
Needed
004f7239 +005 Unofficial
dle
0051c511 +02d Unofficial
74dba201 +015 [Link]
0051c5c5 +02d Unofficial
malizeTopMosts
0051c69a +002 Unofficial
lizeTopMosts
0051ced0 +31c Unofficial
oc
Ragnarok [Link] Forms
[Link]
Ragnarok [Link] Forms
[Link]
Ragnarok [Link] Forms
[Link]
Ragnarok [Link] Controls
[Link]
Ragnarok [Link] Forms
TScrollingWinContr
Ragnarok [Link] Forms
[Link]
Ragnarok [Link] Controls
[Link]
Ragnarok [Link] Controls
[Link]
Ragnarok [Link] Controls
[Link]
Ragnarok [Link] Forms
Ragnarok [Link] Forms
GetTopMostWindows
EnumWindows
[Link]
Ragnarok [Link] Forms
[Link]
Ragnarok [Link] Forms
[Link]
0049f5b8 +014
7735c68f +02b
atcher
00580ceb +01f
y
004f18a6 +0ae
y
00512ac4 +038
[Link]
005138bd +0f9
y
0049e2c3 +057
Components
005118b9 +035
0046ed76 +026
00406669 +065
00618d33 +3af
75c2919d +00c
k
Unofficial Ragnarok [Link] Classes
[Link]
StdWndProc
KiUserCallbackDisp
Unofficial Ragnarok [Link] OleCtrls
[Link]
Unofficial Ragnarok [Link] Controls
[Link]
Unofficial Ragnarok [Link] Forms
TScrollingWinContr
Unofficial Ragnarok [Link] Forms
[Link]
Unofficial Ragnarok [Link] Classes
[Link]
Unofficial Ragnarok
Unofficial Ragnarok
Unofficial Ragnarok
Unofficial Ragnarok
[Link]
DoneApplication
DoExitProc
@Halt0
initialization
BaseThreadInitThun
[Link]
[Link]
[Link]
[Link]
Forms
SysUtils
System 985 +0
Thor
236 +72
thread $1650:
75c2919d +c [Link] BaseThreadInitThunk
thread $bc0:
75c2919d +c [Link] BaseThreadInitThunk
thread $15dc:
00464631 +0d Unofficial Ragnarok [Link] madExcept CallThreadProcSafe
0046469b +37 Unofficial Ragnarok [Link] madExcept ThreadExceptFrame
75c2919d +0c [Link]
BaseThreadInitThunk
>> created by main thread ($1284) at:
7518eabc +00 [Link]
thread $15cc:
75c2919d +c [Link] BaseThreadInitThunk
thread $1990:
75c2919d +c [Link] BaseThreadInitThunk
thread $7ec:
75c2919d +c [Link] BaseThreadInitThunk
thread $14e0:
74fe0921 +000
74dac29a +153
75129355 +058
75c2919d +00c
[Link]
[Link]
[Link]
[Link]
WaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
CoWaitForMultipleHandles
BaseThreadInitThunk
modules:
00400000 Unofficial Ragnarok [Link]
uments\Andri Game File\uRagnarok
5c1d0000 [Link]
5d280000 [Link]
5e720000 [Link]
5eba0000 [Link]
6bbf0000 [Link]
70e80000 [Link]
70fb0000 [Link]
71320000 [Link]
713c0000 [Link]
[Link]
C:\Users\BKPP 26\Doc
11.0.9600.17278
11.0.9600.17278
7.2.9600.16421
6.3.9600.16384
6.3.9600.16384
11.0.9600.17278
7.0.9600.17278
6.3.9600.16384
6.3.9600.17031
C:\windows\SYSTEM32
C:\Windows\SYSTEM32
C:\Windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\SYSTEM32
C:\windows\system32
71510000 [Link]
6.3.9600.17031
C:\windows\system32
718f0000 [Link]
6.10.9600.17031
C:\windows\WinSxS\x8
6_microsoft.[Link]-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8
b01377ea7
71d60000 [Link]
6.3.9600.17238
C:\windows\system32
71e20000 [Link]
6.3.9600.17042
C:\windows\SYSTEM32
71ff0000 [Link]
6.3.9600.17238
C:\windows\SYSTEM32
72140000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
72180000 [Link]
6.3.9600.16384
C:\Windows\System32
72190000 [Link]
6.3.9600.17031
C:\windows\SYSTEM32
721b0000 [Link]
6.3.9600.17200
C:\windows\system32
721e0000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
72200000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
72290000 [Link]
[Link]
C:\Program Files (x8
6)\Bonjour
722d0000 [Link]
6.3.9600.17039
C:\windows\SYSTEM32
72590000 [Link]
6.3.9600.17041
C:\windows\SYSTEM32
725b0000 [Link]
11.0.9600.17278
C:\Windows\SYSTEM32
72d10000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
72d40000 [Link]
11.0.9600.17278
C:\windows\SYSTEM32
72f10000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
72f50000 [Link]
6.3.9600.16384
C:\windows\system32
743e0000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
74b40000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
74b50000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
74c10000 [Link]
6.3.9600.17238
C:\windows\SYSTEM32
74c90000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
74ca0000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
74cb0000 [Link]
6.3.9600.17120
C:\windows\SYSTEM32
74d10000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
74d20000 [Link]
6.3.9600.16408
C:\windows\SYSTEM32
74da0000 [Link]
6.3.9600.17238
C:\windows\SYSTEM32
74ef0000 [Link]
2001.12.10530.16384 C:\windows\SYSTEM32
74f80000 WS2_32.dll
6.3.9600.16384
C:\windows\SYSTEM32
74fd0000 [Link]
6.3.9600.17278
C:\windows\SYSTEM32
750a0000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
750e0000 [Link]
6.3.9600.17031
C:\windows\system32
75110000 [Link]
6.3.9600.17031
C:\windows\SYSTEM32
753b0000 [Link]
6.3.9600.17246
C:\windows\SYSTEM32
754c0000 [Link]
6.3.9600.17216
C:\windows\SYSTEM32
75570000 [Link]
6.3.9600.17042
C:\windows\SYSTEM32
75680000 [Link]
6.3.9600.17664
C:\windows\SYSTEM32
75920000 [Link]
6.3.9600.17031
C:\windows\SYSTEM32
759a0000 [Link]
6.3.9600.16506
C:\windows\SYSTEM32
75aa0000 [Link]
6.3.9600.17238
C:\windows\SYSTEM32
75b30000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
75b40000 [Link]
7.0.9600.16384
C:\windows\SYSTEM32
75c10000 [Link]
6.3.9600.17056
C:\windows\SYSTEM32
75f90000 [Link]
6.3.9600.17278
C:\windows\SYSTEM32
771b0000 [Link]
6.3.9600.16384
C:\windows\SYSTEM32
77320000 [Link]
6.3.9600.17278
C:\windows\SYSTEM32
processes:
0000 Idle
0004 System
0160 [Link]
0234 [Link]
0274 [Link]
02d0 [Link]
02d8 [Link]
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0324 [Link]
0344 [Link]
03b8 [Link]
0050 [Link]
018c [Link]
0210 [Link]
02c8 [Link]
0384 [Link]
0444 [Link]
0470 [Link]
050c [Link]
0528 [Link]
05cc [Link]
05dc [Link]
061c [Link]
0654 [Link]
066c cmw_srv.exe
0684 [Link]
06a0 [Link]
071c [Link]
0738 [Link]
0a34 [Link]
0a68 [Link]
0dfc [Link]
0fc0 [Link]
0acc [Link]
0938 HPSA_Service.exe
0b54 [Link]
0ff4 jhi_service.exe
09fc [Link]
124c [Link]
0c24 [Link]
0c48 [Link]
0d9c [Link]
0f0c [Link]
18bc [Link]
1344 [Link]
1034 [Link]
1844 [Link]
0b38 [Link]
0d14 [Link]
1258 [Link]
0bc4 [Link]
0884 [Link]
0c2c [Link]
16a4 [Link]
1b6c [Link]
198c [Link]
1924 [Link]
0e74 [Link]
1b74 [Link]
09ec [Link]
1af8 [Link]
0f04 [Link]
)\CyberLink\YouCam
0e88 [Link]
ata\Local\Google\Chrome\Application
0cd4 [Link]
ata\Local\Google\Chrome\Application
142c [Link]
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
1
1
1
1
1
1
1
1
1
1
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
908
13
13
13
0
20
35
55
55
26
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
720
17
18
13
0
28
10
17
17
46
normal
normal
normal
normal
normal
normal
normal
normal
below normal c:\Program Files (x86
1 141 70 normal
C:\Users\BKPP 26\AppD
1 4
C:\Users\BKPP 26\AppD
11 normal
1 19 36 normal
155c [Link]
1554 [Link]
ata\Local\Google\Chrome\Application
06cc [Link]
1a00 [Link]
)\Microsoft Office\Office14
0ad4 [Link]
)\Microsoft Office\Office14
18d0 [Link]
ata\Local\Google\Chrome\Application
16c4 [Link]
1af4 Unofficial Ragnarok [Link]
ments\Andri Game File\uRagnarok
1 9
1 0
3
0
normal
normal
C:\Users\BKPP 26\AppD
0 0 0
1 318 90 normal
C:\Program Files (x86
1 641 182 normal
C:\Program Files (x86
1 0
normal
C:\Users\BKPP 26\AppD
1 9 3 normal
1 109 49 normal
C:\Users\BKPP 26\Docu
hardware:
+ {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
- Fax
- Foxit PhantomPDF Printer
- HP ePrint
- HPA403CD (HP Officejet 7500 E910)
- Microsoft XPS Document Writer
- Root Print Queue
- Send To OneNote 2010
+ {36fc9e60-c465-11cf-8056-444553540000}
- Generic USB Hub
- Generic USB Hub
- Intel(R) 8 Series/C220 Series USB EHCI #1 - 8C26
- Intel(R) 8 Series/C220 Series USB EHCI #2 - 8C2D
- Intel(R) USB 3.0 eXtensible Host Controller - 0100 (Microsoft)
- USB Composite Device
- USB Mass Storage Device
- USB Mass Storage Device
- USB Root Hub
- USB Root Hub
- USB Root Hub (xHCI)
+ {4d36e965-e325-11ce-bfc1-08002be10318}
- hp CDDVDW SH-216DB
+ {4d36e966-e325-11ce-bfc1-08002be10318}
- ACPI x64-based PC
+ {4d36e967-e325-11ce-bfc1-08002be10318}
- Generic- Multiple Reader USB Device
- SanDisk Cruzer Blade USB Device
- ST500DM002-1BD142
+ {4d36e968-e325-11ce-bfc1-08002be10318}
- Intel(R) HD Graphics 4400 (driver 10.18.10.3621)
+ {4d36e96a-e325-11ce-bfc1-08002be10318}
- Standard SATA AHCI Controller
+ {4d36e96b-e325-11ce-bfc1-08002be10318}
- HID Keyboard Device
+ {4d36e96c-e325-11ce-bfc1-08002be10318}
- CyberLink WebCam Virtual Driver (driver 1.0.27893.6128)
- Realtek High Definition Audio (driver 6.0.1.7283)
+ {4d36e96e-e325-11ce-bfc1-08002be10318}
- HP 20wd LED Backlit Monitor (driver [Link])
+ {4d36e96f-e325-11ce-bfc1-08002be10318}
- HID-compliant mouse
+ {4d36e972-e325-11ce-bfc1-08002be10318}
- 802.11n USB Wireless LAN Card
- Anchorfree HSS VPN Adapter (driver [Link])
- Realtek PCIe GBE Family Controller (driver 8.34.617.2014)
+ {4d36e979-e325-11ce-bfc1-08002be10318}
- HP Officejet 7500 E910 Class Driver (driver 6.3.9600.16384)
+ {4d36e97b-e325-11ce-bfc1-08002be10318}
- Microsoft Storage Spaces Controller
+ {4d36e97d-e325-11ce-bfc1-08002be10318}
- ACPI Fan
- ACPI Fan
- ACPI Fan
- ACPI Fan
- ACPI Fan
- ACPI Fixed Feature Button
- ACPI Power Button
- ACPI Processor Aggregator
- ACPI Sleep Button
- ACPI Thermal Zone
- ACPI Thermal Zone
- Composite Bus Enumerator
- Direct memory access controller
- High Definition Audio Controller
- High precision event timer
- Intel(R) 4th Gen Core processor DRAM Controller - 0C00 (driver 9.4.0.1023)
- Intel(R) 8 Series/C220 Series PCI Express Root Port #1 - 8C10 (driver 9.4.0.
1023)
- Intel(R) 8 Series/C220 Series PCI Express Root Port #4 - 8C16 (driver 9.4.0.
1023)
- Intel(R) 8 Series/C220 Series SMBus Controller - 8C22 (driver 9.4.0.1023)
- Intel(R) 82802 Firmware Hub Device
- Intel(R) H81 LPC Controller - 8C5C (driver 9.4.0.1023)
- Intel(R) Management Engine Interface (driver 9.5.24.1790)
- Intel(R) Xeon(R) processor E3-1200 v3/4th Gen Core processor PCI Express x16
Controller - 0C01 (driver 9.4.0.1023)
- IWD Bus Enumerator (driver [Link])
- Microsoft ACPI-Compliant System
- Microsoft Basic Display Driver
- Microsoft Basic Render Driver
- Microsoft System Management BIOS Driver
- Microsoft UEFI-Compliant System
- Microsoft Virtual Drive Enumerator
- Microsoft Windows Management Interface for ACPI
- Motherboard resources
- Motherboard resources
- Motherboard resources
- Motherboard resources
- Motherboard resources
- Motherboard resources
- NDIS Virtual Network Adapter Enumerator
- Numeric data processor
- PCI Express Root Complex
- Plug and Play Software Device Enumerator
- Programmable interrupt controller
- Remote Desktop Device Redirector Bus
- System CMOS/real time clock
- System timer
- UMBus Root Bus Enumerator
- Volume Manager
+ {50127dc3-0f36-415e-a6cc-4cb3be910b65}
- Intel(R) Core(TM) i3-4160 CPU @ 3.60GHz
- Intel(R) Core(TM) i3-4160 CPU @ 3.60GHz
- Intel(R) Core(TM) i3-4160 CPU @ 3.60GHz
- Intel(R) Core(TM) i3-4160 CPU @ 3.60GHz
+ {533c5b84-ec70-11d2-9505-00c04f79deaf}
- Generic volume shadow copy
- Generic volume shadow copy
- Generic volume shadow copy
- Generic volume shadow copy
+ {62f9c741-b25a-46ce-b54c-9bccce08b6f2}
- HPA403CD (HP Officejet 7500 E910)
- Microsoft Device Association Root Enumerator
- Microsoft IPv4 IPv6 Transition Adapter Bus
+ {745a17a0-74d3-11d0-b6fe-00a0c90f57da}
- HID-compliant consumer control device
- HID-compliant system controller
- USB Input Device
- USB Input Device
- USB Input Device
+ {c30ecea0-11ef-4ef9-b02e-6af81e6e65c0}
- HPA403CD (HP Officejet 7500 E910)
+ {d94ee5d8-d189-4994-83d2-f68d7d41b0e6}
- Trusted Platform Module 1.2
+ {eec5ad98-8080-425f-922a-dabf3de3f69a}
- G:\
+ {f2e7dd72-6468-4e36-b6f1-6488f42c1b52}
- System Firmware
cpu
eax
ebx
ecx
edx
esi
edi
eip
esp
ebp
registers:
= 01e70180
= 01e70180
= 0018f834
= 00000000
= 0051504c
= 0018f82c
= 005140e7
= 0018f7b0
= 00000000
stack dump:
0018f7b0 d2
0018f7c0 c8
0018f7d0 80
0018f7e0 b4
0018f7f0 80
0018f800 03
0018f810 79
0018f820 86
0018f830 00
0018f840 6a
0018f850 08
0018f860 00
0018f870 00
0018f880 6e
0018f890 00
0018f8a0 00
0018f8b0 00
0018f8c0 00
0018f8d0 00
0018f8e0 00
40
2b
01
f9
01
00
00
00
00
01
00
00
00
00
00
00
00
00
00
00
51
00
e7
18
e7
00
00
00
00
00
00
40
00
46
00
00
00
00
00
00
disassembling:
[...]
0040664c
mov
00
e3
01
00
01
00
00
01
86
00
00
00
00
00
00
00
00
00
00
00
80
ff
80
b0
80
4c
b0
03
00
ff
60
00
00
72
00
00
00
00
00
00
01
ff
01
5e
01
f8
03
00
00
01
d4
00
00
00
00
00
00
00
00
00
e7
ff
e7
40
e7
18
00
00
0d
00
40
00
00
6d
00
00
00
00
00
00
01
ff
01
00
01
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
eax, $62eb1c
e8
1e
80
f8
00
00
01
e8
6b
00
00
03
54
00
00
00
00
00
00
00
67
a5
01
f8
00
00
00
8f
02
00
00
00
00
00
00
00
00
00
00
00
51
da
e7
18
00
00
00
29
00
00
00
01
4d
00
00
00
00
00
00
00
00
74
01
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
f8
08
ff
60
60
00
d4
ae
00
00
00
61
00
00
00
00
00
00
00
00
f8
30
ff
7b
7b
00
85
00
00
00
00
00
00
00
00
00
00
00
00
00
18
4f
ff
a6
a6
00
ed
00
00
00
00
69
00
00
00
00
00
00
00
00
00
00
ff
00
00
00
01
00
00
00
00
00
00
00
00
00
00
00
00
.@Q......gQ.....
.+.........t....
.............0O.
.....^@.........
............`{..
....L.......`{..
y...............
..........).....
........k.......
j...............
....`.@.........
..@.............
........T.M.a.i.
n.F.r.m.........
................
................
................
................
................
................
00406651
00406656
0040665a
0040665c
0040665f
00406661
00406663
00406665
00406667
00406669
0040666b
0040666e
00406670
00406674
00406676
0040667d
0040667f
00406681
00406684
00406689
[...]
call
cmp
jnz
cmp
jz
mov
mov
xor
mov
> call
cmp
jnz
cmp
jnz
cmp
jnz
xor
mov
call
cmp
-$10e ($406548)
; [Link]
byte ptr [ebx+$28], 0
loc_406670
dword ptr [edi], 0
loc_406670
eax, [edi]
esi, eax
eax, eax
[edi], eax
esi
dword ptr [edi], 0
loc_406661
byte ptr [ebx+$28], 2
loc_406684
dword ptr [$619000], 0
loc_406684
eax, eax
[ebx+$c], eax
+$5d3e7 ($463a70)
; [Link]
byte ptr [ebx+$28], 1