g
ModLoad: 75830000 75887000 C:\Windows\syswow64\SHLWAPI.dll
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=7efdd000 edi=0018f4a8
eip=76f2fc5e esp=0018f37c ebp=0018f3d0 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!ZwMapViewOfSection+0x12:
76f2fc5e 83c404 add esp,4
0:000> kn
# ChildEBP RetAddr
00 0018f37c 76f4a3f8 ntdll!ZwMapViewOfSection+0x12
01 0018f3d0 76f4b0ca ntdll!LdrpMapViewOfSection+0xc7
02 0018f4c4 76f4cda4 ntdll!LdrpFindOrMapDll+0x345
03 0018f734 76f4d534 ntdll!LdrpLoadImportModule+0x287
04 0018f764 76f4d5ac ntdll!LdrpHandleOneOldFormatImportDescriptor+0x88
05 0018f778 76f4d4a7 ntdll!LdrpHandleOldFormatImportDescriptors+0x1c
06 0018f800 76f4b44b ntdll!LdrpProcessStaticImports+0x256
07 0018fa60 76f4d534 ntdll!LdrpLoadImportModule+0x340
08 0018fa90 76f4d5ac ntdll!LdrpHandleOneOldFormatImportDescriptor+0x88
09 0018faa4 76f4d4a7 ntdll!LdrpHandleOldFormatImportDescriptors+0x1c
0a 0018fb2c 76f56c06 ntdll!LdrpProcessStaticImports+0x256
0b 0018fcb0 76f5584d ntdll!LdrpInitializeProcess+0x120d
0c 0018fd00 76f49239 ntdll!_LdrpInitialize+0x78
0d 0018fd10 00000000 ntdll!LdrInitializeThunk+0x10
0:000> r
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=7efdd000 edi=0018f4a8
eip=76f2fc5e esp=0018f37c ebp=0018f3d0 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!ZwMapViewOfSection+0x12:
76f2fc5e 83c404 add esp,4
0:000> t
eax=00000000 ebx=00000000 ecx=41e00000 edx=0008e3c8 esi=fffffffe edi=00000000
eip=76fb129b esp=0018fb08 ebp=0018fb34 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!LdrpDoDebuggerBreak+0x2c:
76fb129b cc int 3