====================================================================== Summary ====================================================================== Exception: 0xC0000005 - STATUS_ACCESS_VIOLATION Details: Memory at [0000000F Bad address] could not be written errno: 0x00000000 - No error LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC0000011 - Достигнут маркер конца файла. После этого маркера файл не содержит правильных данных. Address: +002A1EDF Far.exe!`pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2'::::operator()(void)const __ptr64+0x7F (plugapi.obj) Location: Open, plclass.cpp(911) Module: D:\Programs\Far\Plugins\AdvCmpEx\AdvCmpEx.dll Plugin: AdvCmpEx 3.5.0.0 (Advanced compare files plugin for Far Manager v3.0, Alexey Samlyukov & FarPlugins Team) ====================================================================== System information ====================================================================== Far: 3.0.6600.0 x64 (a210a14) Compiler: Microsoft Visual C++, version 19.41.33923.0 Library: Microsoft STL, version 14.3.202404 PE time: 2025-11-24 01:09:44.000 File time: 2025-11-24 01:09:45.835 Time: 2026-02-14 17:57:28.338 Local: 2026-02-14 20:57:28.338 +0300, RTZ 2 (зима) Uptime: 00:00:18 OS: Windows NT Workstation 10.0.19045, 0x100/0x4 (Windows 10 Enterprise, version 22H2, OS build 19045.6456) Locale: ru-RU | LCID=00000419 (Lang=0419 (Primary=019 Sub=01) Sort=0 SortVersion=0) | ANSI=1251 OEM=866 Host: C:\Windows\System32\conhost.exe 10.0.19041.4522 (WinBuild.160101.0800) Parent: C:\Windows\explorer.exe 10.0.19041.4522 (WinBuild.160101.0800) Command: "D:\Programs\Far\Far.exe" Elevated: Yes (Full) Memory: 10.4 G out of 18.3 G free (56%); 25.5 M used by the process ====================================================================== Exception ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +002A1EDF Far.exe!`pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2'::::operator()(void)const __ptr64+0x7F (plugapi.obj) +002A6D52 Far.exe!`function_ref::function_ref,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2'::,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +002A1E4D Far.exe!pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)+0xFD (plugapi.obj) +00008DC1 AdvCmpEx.dll!AdvCmpProc::Init(void) __ptr64+0x191 (AdvCmpProc.cpp.obj) +00002B6F AdvCmpEx.dll!OpenW+0x36F (AdvCmp.cpp.obj) +00294F89 Far.exe!`function_ref::function_ref,struct OpenInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<2,1> & __ptr64,struct OpenInfo * __ptr64 & __ptr64) __ptr64'::`2':: >(class `Plugin::ExecuteFunction,struct OpenInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<2,1> & __ptr64,struct OpenInfo * __ptr64 & __ptr64) __ptr64'::`2':: && __ptr64) __ptr64'::`1'::::(__int64)+0x19 (plclass.obj) +00294DB2 Far.exe!`function_ref::function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64>(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64) __ptr64'::`1'::::(__int64)+0x12 (plclass.obj) +0012C8C6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +00293D61 Far.exe!cpp_try,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: >(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,struct source_location const & __ptr64)+0x61 (plclass.obj) +00294EB0 Far.exe!`function_ref::function_ref,struct source_location const & __ptr64) __ptr64'::`2':: const & __ptr64>(class `Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2':: const & __ptr64) __ptr64'::`1'::::(__int64)+0x80 (plclass.obj) +0012C8F8 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) +00293CEE Far.exe!Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64+0xAE (plclass.obj) +00292148 Far.exe!Plugin::Open(struct OpenInfo * __ptr64) __ptr64+0xE8 (plclass.obj) +002D06B4 Far.exe!PluginManager::Open(class Plugin * __ptr64,int,struct _GUID const & __ptr64,__int64)const __ptr64+0x54 (plugins.obj) +002CBAC7 Far.exe!PluginManager::CommandsMenu(int,int,wchar_t const * __ptr64)const __ptr64+0xEC7 (plugins.obj) +00238702 Far.exe!Manager::PluginsMenu(void)const __ptr64+0xC2 (manager.obj) +00237F26 Far.exe!Manager::ProcessKey(class Manager::Key) __ptr64+0x3F6 (manager.obj) +002375D3 Far.exe!Manager::ProcessMainLoop(void) __ptr64+0xB3 (manager.obj) +002374F1 Far.exe!Manager::EnterMainLoop(void) __ptr64+0xC1 (manager.obj) +0022E601 Far.exe!MainProcess(class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,int,int)+0x1621 (main.obj) +0023315C Far.exe!`mainImpl(class std::span)'::`2'::::operator()(void)const __ptr64+0xEC (main.obj) +00233CE2 Far.exe!`function_ref::function_ref)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +0012C8C6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +00232C26 Far.exe!mainImpl(class std::span)+0xE16 (main.obj) +00233649 Far.exe!`wmain_seh(void)'::`2'::::operator()(void)const __ptr64+0x19 (main.obj) +00233D62 Far.exe!`function_ref::function_ref,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +0012C8C6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +0023357A Far.exe!wmain_seh(void)+0x3AA (main.obj) +00233DEC Far.exe!`function_ref::function_ref,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: >(class `seh_try,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: && __ptr64) __ptr64'::`1'::::(__int64)+0x4C (main.obj) +0012C8F8 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) +002337C8 Far.exe!main+0xC8 (main.obj) +003662F0 Far.exe!__scrt_common_main_seh(void)+0x10C (LIBCMT:exe_main.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000FACDB6DB60 RBX = FFFFFFFFFFFFFFFF RCX = 01DC9DDB61D23548 RDX = 01DC9DDB61D23548 RSI = 000000FACDB6DC90 RDI = 0000000000000038 R8 = 000000FACDB6DC83 R9 = 000000007FFE8000 R10 = 0000000000000001 R11 = FFFFFFFFFC092CFB R12 = 0000000000000046 R13 = 0000000000000000 R14 = 000000FACDB6DE00 R15 = 00000000022B812A RIP = 00007FF6FB091EDF RSP = 000000FACDB6DB20 RBP = 000000FACDB6DC69 EFL = 00010202 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +002A1EDF Far.exe!`pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2'::::operator()(void)const __ptr64+0x7F (plugapi.obj): 00007ff6`fb091ec3 0fb6c0 movzx eax,al 00007ff6`fb091ec6 4883c420 add rsp,20h 00007ff6`fb091eca 415e pop r14 00007ff6`fb091ecc 5e pop rsi 00007ff6`fb091ecd 5b pop rbx 00007ff6`fb091ece c3 ret 00007ff6`fb091ecf 488b18 mov rbx,qword ptr [rax] 00007ff6`fb091ed2 488d4c2440 lea rcx,[rsp+40h] 00007ff6`fb091ed7 e82471fcff call Far+0x269000 (00007ff6`fb059000) 00007ff6`fb091edc 488b08 mov rcx,qword ptr [rax] 00007ff6`fb091edf 48894b10 mov qword ptr [rbx+10h],rcx +002A6D52 Far.exe!`function_ref::function_ref,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2'::,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj): 00007ff6`faf1c8a3 488bc1 mov rax,rcx 00007ff6`faf1c8a6 803df387370000 cmp byte ptr [Far+0x4a50a0 (00007ff6`fb2950a0)],0 00007ff6`faf1c8ad 750b jne Far+0x12c8ba (00007ff6`faf1c8ba) 00007ff6`faf1c8af 488b09 mov rcx,qword ptr [rcx] 00007ff6`faf1c8b2 4883c438 add rsp,38h 00007ff6`faf1c8b6 48ff6008 jmp qword ptr [rax+8] 00007ff6`faf1c8ba 49833800 cmp qword ptr [r8],0 00007ff6`faf1c8be 740f je Far+0x12c8cf (00007ff6`faf1c8cf) 00007ff6`faf1c8c0 488b09 mov rcx,qword ptr [rcx] 00007ff6`faf1c8c3 ff5008 call qword ptr [rax+8] 00007ff6`faf1c8c6 eb00 jmp Far+0x12c8c8 (00007ff6`faf1c8c8) +002A1E4D Far.exe!pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)+0xFD (plugapi.obj): 00007ff6`fb091e22 488945ef mov qword ptr [rbp-11h],rax 00007ff6`fb091e26 0f2845a7 movaps xmm0,xmmword ptr [rbp-59h] 00007ff6`fb091e2a 660f7f45a7 movdqa xmmword ptr [rbp-59h],xmm0 00007ff6`fb091e2f 0f284d97 movaps xmm1,xmmword ptr [rbp-69h] 00007ff6`fb091e33 660f7f4d47 movdqa xmmword ptr [rbp+47h],xmm1 00007ff6`fb091e38 4c8d4db7 lea r9,[rbp-49h] 00007ff6`fb091e3c 4c8d45e7 lea r8,[rbp-19h] 00007ff6`fb091e40 488d55a7 lea rdx,[rbp-59h] 00007ff6`fb091e44 488d4d47 lea rcx,[rbp+47h] 00007ff6`fb091e48 e843aae8ff call Far+0x12c890 (00007ff6`faf1c890) 00007ff6`fb091e4d 488b4597 mov rax,qword ptr [rbp-69h] +00008DC1 AdvCmpEx.dll!AdvCmpProc::Init(void) __ptr64+0x191 (AdvCmpProc.cpp.obj): 00007ffe`17fe8d93 4533c0 xor r8d,r8d 00007ffe`17fe8d96 ba03000000 mov edx,3 00007ffe`17fe8d9b ff155f560500 call qword ptr [AdvCmpEx!ExitFARW+0x5b420 (00007ffe`1803e400)] 00007ffe`17fe8da1 392d15540400 cmp dword ptr [AdvCmpEx!ExitFARW+0x4b1dc (00007ffe`1802e1bc)],ebp 00007ffe`17fe8da7 7418 je AdvCmpEx!ExitFARW+0x5de1 (00007ffe`17fe8dc1) 00007ffe`17fe8da9 488b0db8540400 mov rcx,qword ptr [AdvCmpEx!ExitFARW+0x4b288 (00007ffe`1802e268)] 00007ffe`17fe8db0 4533c9 xor r9d,r9d 00007ffe`17fe8db3 4533c0 xor r8d,r8d 00007ffe`17fe8db6 ba03000000 mov edx,3 00007ffe`17fe8dbb ff153f560500 call qword ptr [AdvCmpEx!ExitFARW+0x5b420 (00007ffe`1803e400)] 00007ffe`17fe8dc1 be04010000 mov esi,104h +00002B6F AdvCmpEx.dll!OpenW+0x36F (AdvCmp.cpp.obj): 00007ffe`17fe2b48 0100 add dword ptr [rax],eax 00007ffe`17fe2b4a 004889 add byte ptr [rax-77h],cl 00007ffe`17fe2b4d 9d popfq 00007ffe`17fe2b4e 0801 or byte ptr [rcx],al 00007ffe`17fe2b50 0000 add byte ptr [rax],al 00007ffe`17fe2b52 48899d10010000 mov qword ptr [rbp+110h],rbx 00007ffe`17fe2b59 ff15e9c40200 call qword ptr [AdvCmpEx!ExitFARW+0x2c068 (00007ffe`1800f048)] 00007ffe`17fe2b5f 488d4d00 lea rcx,[rbp] 00007ffe`17fe2b63 48898528010000 mov qword ptr [rbp+128h],rax 00007ffe`17fe2b6a e8c1600000 call AdvCmpEx!ExitFARW+0x5c50 (00007ffe`17fe8c30) 00007ffe`17fe2b6f 83ff37 cmp edi,37h +00294F89 Far.exe!`function_ref::function_ref,struct OpenInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<2,1> & __ptr64,struct OpenInfo * __ptr64 & __ptr64) __ptr64'::`2':: >(class `Plugin::ExecuteFunction,struct OpenInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<2,1> & __ptr64,struct OpenInfo * __ptr64 & __ptr64) __ptr64'::`2':: && __ptr64) __ptr64'::`1'::::(__int64)+0x19 (plclass.obj): 00007ff6`fb084f6e cc int 3 00007ff6`fb084f6f cc int 3 00007ff6`fb084f70 4053 push rbx 00007ff6`fb084f72 4883ec20 sub rsp,20h 00007ff6`fb084f76 488b01 mov rax,qword ptr [rcx] 00007ff6`fb084f79 488bd9 mov rbx,rcx 00007ff6`fb084f7c 488b4910 mov rcx,qword ptr [rcx+10h] 00007ff6`fb084f80 488b5018 mov rdx,qword ptr [rax+18h] 00007ff6`fb084f84 488b09 mov rcx,qword ptr [rcx] 00007ff6`fb084f87 ffd2 call rdx 00007ff6`fb084f89 488b4b08 mov rcx,qword ptr [rbx+8] +00294DB2 Far.exe!`function_ref::function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64>(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64) __ptr64'::`1'::::(__int64)+0x12 (plclass.obj): 00007ff6`fb084d98 5b pop rbx 00007ff6`fb084d99 e972ec0200 jmp Far+0x2c3a10 (00007ff6`fb0b3a10) 00007ff6`fb084d9e cc int 3 00007ff6`fb084d9f cc int 3 00007ff6`fb084da0 4053 push rbx 00007ff6`fb084da2 4883ec30 sub rsp,30h 00007ff6`fb084da6 488b01 mov rax,qword ptr [rcx] 00007ff6`fb084da9 488bd9 mov rbx,rcx 00007ff6`fb084dac 488b08 mov rcx,qword ptr [rax] 00007ff6`fb084daf ff5008 call qword ptr [rax+8] 00007ff6`fb084db2 488b4308 mov rax,qword ptr [rbx+8] +0012C8C6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj): 00007ff6`faf1c8a3 488bc1 mov rax,rcx 00007ff6`faf1c8a6 803df387370000 cmp byte ptr [Far+0x4a50a0 (00007ff6`fb2950a0)],0 00007ff6`faf1c8ad 750b jne Far+0x12c8ba (00007ff6`faf1c8ba) 00007ff6`faf1c8af 488b09 mov rcx,qword ptr [rcx] 00007ff6`faf1c8b2 4883c438 add rsp,38h 00007ff6`faf1c8b6 48ff6008 jmp qword ptr [rax+8] 00007ff6`faf1c8ba 49833800 cmp qword ptr [r8],0 00007ff6`faf1c8be 740f je Far+0x12c8cf (00007ff6`faf1c8cf) 00007ff6`faf1c8c0 488b09 mov rcx,qword ptr [rcx] 00007ff6`faf1c8c3 ff5008 call qword ptr [rax+8] 00007ff6`faf1c8c6 eb00 jmp Far+0x12c8c8 (00007ff6`faf1c8c8) +00293D61 Far.exe!cpp_try,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: >(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,struct source_location const & __ptr64)+0x61 (plclass.obj): 00007ff6`fb083d31 004889 add byte ptr [rax-77h],cl 00007ff6`fb083d34 4c2430 and al,30h 00007ff6`fb083d37 488d4c2430 lea rcx,[rsp+30h] 00007ff6`fb083d3c 0f284c2430 movaps xmm1,xmmword ptr [rsp+30h] 00007ff6`fb083d41 4c89442440 mov qword ptr [rsp+40h],r8 00007ff6`fb083d46 4c8d442440 lea r8,[rsp+40h] 00007ff6`fb083d4b 4889442448 mov qword ptr [rsp+48h],rax 00007ff6`fb083d50 660f7f4c2430 movdqa xmmword ptr [rsp+30h],xmm1 00007ff6`fb083d56 660f7f442420 movdqa xmmword ptr [rsp+20h],xmm0 00007ff6`fb083d5c e82f8be9ff call Far+0x12c890 (00007ff6`faf1c890) 00007ff6`fb083d61 4883c458 add rsp,58h ====================================================================== Exception handler thread ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00128278 Far.exe!collect_information(class exception_context const & __ptr64,struct source_location const & __ptr64,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,struct error_state_ex const & __ptr64,class std::span)+0x16D8 (exception_handler.obj) +0012A7CB Far.exe!handle_generic_exception(class exception_context const & __ptr64,struct source_location const & __ptr64,class Plugin const * __ptr64 const,class std::basic_string_view >,class std::basic_string_view >,struct error_state_ex const & __ptr64,class std::span)+0xA6B (exception_handler.obj) +0012BCEF Far.exe!handle_seh_exception(class exception_context const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)+0x32F (exception_handler.obj) +0012CAC3 Far.exe!detail::seh_filter(struct _EXCEPTION_POINTERS const * __ptr64,class Plugin const * __ptr64,struct source_location const & __ptr64)+0x173 (exception_handler.obj) +003B94D7 Far.exe!int `detail::seh_try(class function_ref,class function_ref,class function_ref)'::`1'::filt$0+0x37 (exception_handler.obj) +00367943 Far.exe!__C_specific_handler+0x9F (libvcruntime:riscchandler.obj) +000A296F ntdll.dll!_chkstk+0x11F +00052554 ntdll.dll!RtlRaiseException+0x484 +000A147E ntdll.dll!KiUserExceptionDispatcher+0x2E +002A1EDF Far.exe!`pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2'::::operator()(void)const __ptr64+0x7F (plugapi.obj) +002A6D52 Far.exe!`function_ref::function_ref,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2'::,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `cpp_try >(class `pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +002A1E4D Far.exe!pluginapi::apiFileFilterControl(void * __ptr64,enum FAR_FILE_FILTER_CONTROL_COMMANDS,__int64,void * __ptr64)+0xFD (plugapi.obj) +00008DC1 AdvCmpEx.dll!AdvCmpProc::Init(void) __ptr64+0x191 (AdvCmpProc.cpp.obj) +00002B6F AdvCmpEx.dll!OpenW+0x36F (AdvCmp.cpp.obj) +00294F89 Far.exe!`function_ref::function_ref,struct OpenInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<2,1> & __ptr64,struct OpenInfo * __ptr64 & __ptr64) __ptr64'::`2':: >(class `Plugin::ExecuteFunction,struct OpenInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<2,1> & __ptr64,struct OpenInfo * __ptr64 & __ptr64) __ptr64'::`2':: && __ptr64) __ptr64'::`1'::::(__int64)+0x19 (plclass.obj) +00294DB2 Far.exe!`function_ref::function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64>(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64) __ptr64'::`1'::::(__int64)+0x12 (plclass.obj) +0012C8C6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +00293D61 Far.exe!cpp_try,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: >(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,struct source_location const & __ptr64)+0x61 (plclass.obj) +00294EB0 Far.exe!`function_ref::function_ref,struct source_location const & __ptr64) __ptr64'::`2':: const & __ptr64>(class `Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2':: const & __ptr64) __ptr64'::`1'::::(__int64)+0x80 (plclass.obj) +0012C8F8 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) +00293CEE Far.exe!Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64+0xAE (plclass.obj) +00292148 Far.exe!Plugin::Open(struct OpenInfo * __ptr64) __ptr64+0xE8 (plclass.obj) +002D06B4 Far.exe!PluginManager::Open(class Plugin * __ptr64,int,struct _GUID const & __ptr64,__int64)const __ptr64+0x54 (plugins.obj) +002CBAC7 Far.exe!PluginManager::CommandsMenu(int,int,wchar_t const * __ptr64)const __ptr64+0xEC7 (plugins.obj) +00238702 Far.exe!Manager::PluginsMenu(void)const __ptr64+0xC2 (manager.obj) +00237F26 Far.exe!Manager::ProcessKey(class Manager::Key) __ptr64+0x3F6 (manager.obj) +002375D3 Far.exe!Manager::ProcessMainLoop(void) __ptr64+0xB3 (manager.obj) +002374F1 Far.exe!Manager::EnterMainLoop(void) __ptr64+0xC1 (manager.obj) +0022E601 Far.exe!MainProcess(class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,int,int)+0x1621 (main.obj) +0023315C Far.exe!`mainImpl(class std::span)'::`2'::::operator()(void)const __ptr64+0xEC (main.obj) +00233CE2 Far.exe!`function_ref::function_ref)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +0012C8C6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +00232C26 Far.exe!mainImpl(class std::span)+0xE16 (main.obj) +00233649 Far.exe!`wmain_seh(void)'::`2'::::operator()(void)const __ptr64+0x19 (main.obj) +00233D62 Far.exe!`function_ref::function_ref,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +0012C8C6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +0023357A Far.exe!wmain_seh(void)+0x3AA (main.obj) +00233DEC Far.exe!`function_ref::function_ref,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: >(class `seh_try,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: && __ptr64) __ptr64'::`1'::::(__int64)+0x4C (main.obj) +0012C8F8 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) +002337C8 Far.exe!main+0xC8 (main.obj) +003662F0 Far.exe!__scrt_common_main_seh(void)+0x10C (LIBCMT:exe_main.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ====================================================================== Thread 4228 / 0x1084 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000002A87FA0E630 RCX = 000000000000009C RDX = 000002A87FA0E2B0 RSI = 000002A87FA0B170 RDI = 000002A87FA0E630 R8 = 0000000000000008 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 000000FACDEFF6C0 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFE33691034 RSP = 000000FACDEFF6E8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffe`33691014 c3 ret 00007ffe`33691015 cd2e int 2Eh 00007ffe`33691017 c3 ret 00007ffe`33691018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffe`33691020 4c8bd1 mov r10,rcx 00007ffe`33691023 b8d5010000 mov eax,1D5h 00007ffe`33691028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`33691030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffe`33691035) 00007ffe`33691032 0f05 syscall 00007ffe`33691034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffe`3363d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffe`3363d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffe`3363d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffe`3363d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffe`3363d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffe`3363d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffe`3363d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffe`3363d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffe`3363d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffe`3363d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffe`33691020) 00007ffe`3363d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 11468 / 0x2CCC ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000002A87FA0F8B0 RCX = 000000000000009C RDX = 000002A87FA0F530 RSI = 000002A87FA0B170 RDI = 000002A87FA0F8B0 R8 = 0000000000000008 R9 = 0000000000000004 R10 = 0000000000000000 R11 = 00000000FFFFFFFF R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFE33691034 RSP = 000000FACDFFF4E8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffe`33691014 c3 ret 00007ffe`33691015 cd2e int 2Eh 00007ffe`33691017 c3 ret 00007ffe`33691018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffe`33691020 4c8bd1 mov r10,rcx 00007ffe`33691023 b8d5010000 mov eax,1D5h 00007ffe`33691028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`33691030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffe`33691035) 00007ffe`33691032 0f05 syscall 00007ffe`33691034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffe`3363d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffe`3363d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffe`3363d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffe`3363d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffe`3363d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffe`3363d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffe`3363d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffe`3363d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffe`3363d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffe`3363d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffe`33691020) 00007ffe`3363d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 2944 / 0xB80 (Window messages processor) ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC0000047 - Попытка освобождения семафора, при котором было бы превышено его максимальное значение счетчика. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14 +0002212E USER32.dll!GetMessageW+0x2E +0035F482 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x662 (wm_listener.obj) +0035FDEB Far.exe!os::concurrency::thread::wrapper >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x1B (wm_listener.obj) +00380F4A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001006 RBX = 000000FACE0FE710 RCX = 000000FACE0FE710 RDX = 0000000000000000 RSI = 000002A87FA7C4A0 RDI = 00007FF6FB22B808 R8 = 000000FACE0FE4F8 R9 = 000000FACE0FE710 R10 = 0000000000000000 R11 = 0000000000000246 R12 = 00007FF6FADFA770 R13 = 0000000000000000 R14 = 000000FACDB6EAB0 R15 = 00007FF6FB22B690 RIP = 00007FFE315B1104 RSP = 000000FACE0FE5A8 RBP = 000000FACE0FE710 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14: 00007ffe`315b10e4 c3 ret 00007ffe`315b10e5 cd2e int 2Eh 00007ffe`315b10e7 c3 ret 00007ffe`315b10e8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffe`315b10f0 4c8bd1 mov r10,rcx 00007ffe`315b10f3 b806100000 mov eax,1006h 00007ffe`315b10f8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`315b1100 7503 jne win32u!NtUserGetMessage+0x15 (00007ffe`315b1105) 00007ffe`315b1102 0f05 syscall 00007ffe`315b1104 c3 ret +0002212E USER32.dll!GetMessageW+0x2E: 00007ffe`32b12102 4883ec50 sub rsp,50h 00007ffe`32b12106 418bc1 mov eax,r9d 00007ffe`32b12109 488bd9 mov rbx,rcx 00007ffe`32b1210c 458bc8 mov r9d,r8d 00007ffe`32b1210f 440bc8 or r9d,eax 00007ffe`32b12112 41f7c10000feff test r9d,0FFFE0000h 00007ffe`32b12119 0f8591320200 jne USER32!SetWindowsHookExAW+0xee50 (00007ffe`32b353b0) 00007ffe`32b1211f 448bc8 mov r9d,eax 00007ffe`32b12122 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffe`32b12127 48ff156a1a0700 call qword ptr [USER32!gapfnScSendMessage+0x1208 (00007ffe`32b83b98)] 00007ffe`32b1212e 0f1f440000 nop dword ptr [rax+rax] +0035F482 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x662 (wm_listener.obj): 00007ff6`fb14f45f fd std 00007ff6`fb14f460 cdda int 0DAh 00007ff6`fb14f462 ff84c00f85fb01 inc dword ptr [rax+rax*8+1FB850Fh] 00007ff6`fb14f469 0000 add byte ptr [rax],al 00007ff6`fb14f46b 0f1f440000 nop dword ptr [rax+rax] 00007ff6`fb14f470 4533c9 xor r9d,r9d 00007ff6`fb14f473 4533c0 xor r8d,r8d 00007ff6`fb14f476 33d2 xor edx,edx 00007ff6`fb14f478 488d4d00 lea rcx,[rbp] 00007ff6`fb14f47c ff152e060700 call qword ptr [Far+0x3cfab0 (00007ff6`fb1bfab0)] 00007ff6`fb14f482 85c0 test eax,eax +0035FDEB Far.exe!os::concurrency::thread::wrapper >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x1B (wm_listener.obj): 00007ff6`fb14fdce 5e pop rsi 00007ff6`fb14fdcf c3 ret 00007ff6`fb14fdd0 4053 push rbx 00007ff6`fb14fdd2 4883ec20 sub rsp,20h 00007ff6`fb14fdd6 488bd9 mov rbx,rcx 00007ff6`fb14fdd9 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`fb14fdde 488b01 mov rax,qword ptr [rcx] 00007ff6`fb14fde1 488b5108 mov rdx,qword ptr [rcx+8] 00007ff6`fb14fde5 488b4910 mov rcx,qword ptr [rcx+10h] 00007ff6`fb14fde9 ffd0 call rax 00007ff6`fb14fdeb 90 nop +00380F4A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`fb170f21 7510 jne Far+0x380f33 (00007ff6`fb170f33) 00007ff6`fb170f23 8d48ff lea ecx,[rax-1] 00007ff6`fb170f26 e8ed230100 call Far+0x393318 (00007ff6`fb183318) 00007ff6`fb170f2b 85c0 test eax,eax 00007ff6`fb170f2d 0f94c0 sete al 00007ff6`fb170f30 884320 mov byte ptr [rbx+20h],al 00007ff6`fb170f33 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`fb170f3d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`fb170f41 488b03 mov rax,qword ptr [rbx] 00007ff6`fb170f44 ff152eef0400 call qword ptr [Far+0x3cfe78 (00007ff6`fb1bfe78)] 00007ff6`fb170f4a 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 3880 / 0xF28 (FS watcher) ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE +0025F4F3 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj) +0019B761 Far.exe!background_watcher::process(void) __ptr64+0x2A1 (filesystemwatcher.obj) +0019D284 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj) +00380F4A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000003 RCX = 0000000000000003 RDX = 000002A8017F33C0 RSI = 0000000000000000 RDI = 0000000000000003 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 00000000FFFFFFFF R13 = 000002A8017F33C0 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFE3368E0F4 RSP = 000000FACE3FF1D8 RBP = 000000FACE3FF720 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffe`3368e0d1 ab stos dword ptr [rdi] 00007ffe`3368e0d2 8efd mov st(-1),bp 00007ffe`3368e0d4 ff6666 jmp qword ptr [rsi+66h] 00007ffe`3368e0d7 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffe`3368e0e0 4c8bd1 mov r10,rcx 00007ffe`3368e0e3 b85b000000 mov eax,5Bh 00007ffe`3368e0e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`3368e0f0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffe`3368e0f5) 00007ffe`3368e0f2 0f05 syscall 00007ffe`3368e0f4 c3 ret +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffe`30ff0cd7 4c8d742450 lea r14,[rsp+50h] 00007ffe`30ff0cdc 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffe`30ff0ce1 4533c0 xor r8d,r8d 00007ffe`30ff0ce4 4585ff test r15d,r15d 00007ffe`30ff0ce7 410f94c0 sete r8b 00007ffe`30ff0ceb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffe`30ff0cf0 440fb6ce movzx r9d,sil 00007ffe`30ff0cf4 498bd5 mov rdx,r13 00007ffe`30ff0cf7 8bcb mov ecx,ebx 00007ffe`30ff0cf9 48ff1560281900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7240 (00007ffe`31183560)] 00007ffe`30ff0d00 0f1f440000 nop dword ptr [rax+rax] +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE: 00007ffe`30ff0bea cc int 3 00007ffe`30ff0beb cc int 3 00007ffe`30ff0bec cc int 3 00007ffe`30ff0bed cc int 3 00007ffe`30ff0bee cc int 3 00007ffe`30ff0bef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffe`30ff0bf0 4883ec38 sub rsp,38h 00007ffe`30ff0bf4 8364242000 and dword ptr [rsp+20h],0 00007ffe`30ff0bf9 e812000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffe`30ff0c10) 00007ffe`30ff0bfe 4883c438 add rsp,38h +0025F4F3 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj): 00007ff6`fb04f4c2 4881ec00010000 sub rsp,100h 00007ff6`fb04f4c9 488b05704d2400 mov rax,qword ptr [Far+0x4a4240 (00007ff6`fb294240)] 00007ff6`fb04f4d0 4833c4 xor rax,rsp 00007ff6`fb04f4d3 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`fb04f4db 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`fb04f4df 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`fb04f4e5 4533c0 xor r8d,r8d 00007ff6`fb04f4e8 488b11 mov rdx,qword ptr [rcx] 00007ff6`fb04f4eb 8bcb mov ecx,ebx 00007ff6`fb04f4ed ff1545fe1600 call qword ptr [Far+0x3cf338 (00007ff6`fb1bf338)] 00007ff6`fb04f4f3 8bc8 mov ecx,eax +0019B761 Far.exe!background_watcher::process(void) __ptr64+0x2A1 (filesystemwatcher.obj): 00007ff6`faf8b736 488b4c2438 mov rcx,qword ptr [rsp+38h] 00007ff6`faf8b73b 488b442430 mov rax,qword ptr [rsp+30h] 00007ff6`faf8b740 482bc8 sub rcx,rax 00007ff6`faf8b743 48c1f903 sar rcx,3 00007ff6`faf8b747 488945c0 mov qword ptr [rbp-40h],rax 00007ff6`faf8b74b 48894dc8 mov qword ptr [rbp-38h],rcx 00007ff6`faf8b74f 0f2845c0 movaps xmm0,xmmword ptr [rbp-40h] 00007ff6`faf8b753 660f7f4580 movdqa xmmword ptr [rbp-80h],xmm0 00007ff6`faf8b758 488d4d80 lea rcx,[rbp-80h] 00007ff6`faf8b75c e85f3d0c00 call Far+0x25f4c0 (00007ff6`fb04f4c0) 00007ff6`faf8b761 4c8be0 mov r12,rax +0019D284 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj): 00007ff6`faf8d26c cc int 3 00007ff6`faf8d26d cc int 3 00007ff6`faf8d26e cc int 3 00007ff6`faf8d26f cc int 3 00007ff6`faf8d270 4053 push rbx 00007ff6`faf8d272 4883ec20 sub rsp,20h 00007ff6`faf8d276 488bd9 mov rbx,rcx 00007ff6`faf8d279 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`faf8d27e 488b4908 mov rcx,qword ptr [rcx+8] 00007ff6`faf8d282 ff13 call qword ptr [rbx] 00007ff6`faf8d284 90 nop +00380F4A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`fb170f21 7510 jne Far+0x380f33 (00007ff6`fb170f33) 00007ff6`fb170f23 8d48ff lea ecx,[rax-1] 00007ff6`fb170f26 e8ed230100 call Far+0x393318 (00007ff6`fb183318) 00007ff6`fb170f2b 85c0 test eax,eax 00007ff6`fb170f2d 0f94c0 sete al 00007ff6`fb170f30 884320 mov byte ptr [rbx+20h],al 00007ff6`fb170f33 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`fb170f3d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`fb170f41 488b03 mov rax,qword ptr [rbx] 00007ff6`fb170f44 ff152eef0400 call qword ptr [Far+0x3cfe78 (00007ff6`fb1bfe78)] 00007ff6`fb170f4a 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 3444 / 0xD74 (Taskbar processor) ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC0000034 - Объект с указанным именем не найден. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE +0025F4F3 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj) +0031EF56 Far.exe!taskbar_impl::handler(void)const __ptr64+0x346 (taskbar.obj) +0019D284 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj) +00380F4A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000003 RCX = 0000000000000003 RDX = 000000FACE1FFDA8 RSI = 0000000000000000 RDI = 0000000000000003 R8 = 0000000000000005 R9 = 0000000000000000 R10 = 0000000000000B14 R11 = 0000000000000000 R12 = 00000000FFFFFFFF R13 = 000000FACE1FFDA8 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFE3368E0F4 RSP = 000000FACE1FF908 RBP = 000000FACE1FFDD9 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffe`3368e0d1 ab stos dword ptr [rdi] 00007ffe`3368e0d2 8efd mov st(-1),bp 00007ffe`3368e0d4 ff6666 jmp qword ptr [rsi+66h] 00007ffe`3368e0d7 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffe`3368e0e0 4c8bd1 mov r10,rcx 00007ffe`3368e0e3 b85b000000 mov eax,5Bh 00007ffe`3368e0e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`3368e0f0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffe`3368e0f5) 00007ffe`3368e0f2 0f05 syscall 00007ffe`3368e0f4 c3 ret +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffe`30ff0cd7 4c8d742450 lea r14,[rsp+50h] 00007ffe`30ff0cdc 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffe`30ff0ce1 4533c0 xor r8d,r8d 00007ffe`30ff0ce4 4585ff test r15d,r15d 00007ffe`30ff0ce7 410f94c0 sete r8b 00007ffe`30ff0ceb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffe`30ff0cf0 440fb6ce movzx r9d,sil 00007ffe`30ff0cf4 498bd5 mov rdx,r13 00007ffe`30ff0cf7 8bcb mov ecx,ebx 00007ffe`30ff0cf9 48ff1560281900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7240 (00007ffe`31183560)] 00007ffe`30ff0d00 0f1f440000 nop dword ptr [rax+rax] +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE: 00007ffe`30ff0bea cc int 3 00007ffe`30ff0beb cc int 3 00007ffe`30ff0bec cc int 3 00007ffe`30ff0bed cc int 3 00007ffe`30ff0bee cc int 3 00007ffe`30ff0bef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffe`30ff0bf0 4883ec38 sub rsp,38h 00007ffe`30ff0bf4 8364242000 and dword ptr [rsp+20h],0 00007ffe`30ff0bf9 e812000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffe`30ff0c10) 00007ffe`30ff0bfe 4883c438 add rsp,38h +0025F4F3 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj): 00007ff6`fb04f4c2 4881ec00010000 sub rsp,100h 00007ff6`fb04f4c9 488b05704d2400 mov rax,qword ptr [Far+0x4a4240 (00007ff6`fb294240)] 00007ff6`fb04f4d0 4833c4 xor rax,rsp 00007ff6`fb04f4d3 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`fb04f4db 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`fb04f4df 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`fb04f4e5 4533c0 xor r8d,r8d 00007ff6`fb04f4e8 488b11 mov rdx,qword ptr [rcx] 00007ff6`fb04f4eb 8bcb mov ecx,ebx 00007ff6`fb04f4ed ff1545fe1600 call qword ptr [Far+0x3cf338 (00007ff6`fb1bf338)] 00007ff6`fb04f4f3 8bc8 mov ecx,eax +0031EF56 Far.exe!taskbar_impl::handler(void)const __ptr64+0x346 (taskbar.obj): 00007ff6`fb10ef27 660f1f840000000000 nop word ptr [rax+rax] 00007ff6`fb10ef30 498b4718 mov rax,qword ptr [r15+18h] 00007ff6`fb10ef34 488945cf mov qword ptr [rbp-31h],rax 00007ff6`fb10ef38 498b4720 mov rax,qword ptr [r15+20h] 00007ff6`fb10ef3c 488945d7 mov qword ptr [rbp-29h],rax 00007ff6`fb10ef40 498b4728 mov rax,qword ptr [r15+28h] 00007ff6`fb10ef44 488945df mov qword ptr [rbp-21h],rax 00007ff6`fb10ef48 660f7f75b7 movdqa xmmword ptr [rbp-49h],xmm6 00007ff6`fb10ef4d 488d4db7 lea rcx,[rbp-49h] 00007ff6`fb10ef51 e86a05f4ff call Far+0x25f4c0 (00007ff6`fb04f4c0) 00007ff6`fb10ef56 4885c0 test rax,rax +0019D284 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj): 00007ff6`faf8d26c cc int 3 00007ff6`faf8d26d cc int 3 00007ff6`faf8d26e cc int 3 00007ff6`faf8d26f cc int 3 00007ff6`faf8d270 4053 push rbx 00007ff6`faf8d272 4883ec20 sub rsp,20h 00007ff6`faf8d276 488bd9 mov rbx,rcx 00007ff6`faf8d279 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`faf8d27e 488b4908 mov rcx,qword ptr [rcx+8] 00007ff6`faf8d282 ff13 call qword ptr [rbx] 00007ff6`faf8d284 90 nop +00380F4A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`fb170f21 7510 jne Far+0x380f33 (00007ff6`fb170f33) 00007ff6`fb170f23 8d48ff lea ecx,[rax-1] 00007ff6`fb170f26 e8ed230100 call Far+0x393318 (00007ff6`fb183318) 00007ff6`fb170f2b 85c0 test eax,eax 00007ff6`fb170f2d 0f94c0 sete al 00007ff6`fb170f30 884320 mov byte ptr [rbx+20h],al 00007ff6`fb170f33 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`fb170f3d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`fb170f41 488b03 mov rax,qword ptr [rbx] 00007ff6`fb170f44 ff152eef0400 call qword ptr [Far+0x3cfe78 (00007ff6`fb1bfe78)] 00007ff6`fb170f4a 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 4460 / 0x116C ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +000CF876 combase.dll!CoRevokeInitializeSpy+0xE16 +000CF6F0 combase.dll!CoRevokeInitializeSpy+0xC90 +000CF500 combase.dll!CoRevokeInitializeSpy+0xAA0 +000CF489 combase.dll!CoRevokeInitializeSpy+0xA29 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000001 RCX = 0000000000000001 RDX = 000000FACE2FF9D0 RSI = 0000000000000000 RDI = 0000000000000001 R8 = 000002A87FAFE8D0 R9 = 00007FFE3312F460 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 00000000FFFFFFFF R13 = 000000FACE2FF9D0 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFE3368E0F4 RSP = 000000FACE2FF688 RBP = 0000000000000340 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffe`3368e0d1 ab stos dword ptr [rdi] 00007ffe`3368e0d2 8efd mov st(-1),bp 00007ffe`3368e0d4 ff6666 jmp qword ptr [rsi+66h] 00007ffe`3368e0d7 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffe`3368e0e0 4c8bd1 mov r10,rcx 00007ffe`3368e0e3 b85b000000 mov eax,5Bh 00007ffe`3368e0e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`3368e0f0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffe`3368e0f5) 00007ffe`3368e0f2 0f05 syscall 00007ffe`3368e0f4 c3 ret +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffe`30ff0cd7 4c8d742450 lea r14,[rsp+50h] 00007ffe`30ff0cdc 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffe`30ff0ce1 4533c0 xor r8d,r8d 00007ffe`30ff0ce4 4585ff test r15d,r15d 00007ffe`30ff0ce7 410f94c0 sete r8b 00007ffe`30ff0ceb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffe`30ff0cf0 440fb6ce movzx r9d,sil 00007ffe`30ff0cf4 498bd5 mov rdx,r13 00007ffe`30ff0cf7 8bcb mov ecx,ebx 00007ffe`30ff0cf9 48ff1560281900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7240 (00007ffe`31183560)] 00007ffe`30ff0d00 0f1f440000 nop dword ptr [rax+rax] +000CF876 combase.dll!CoRevokeInitializeSpy+0xE16: 00007ffe`3312f84c 85ff test edi,edi 00007ffe`3312f84e 7559 jne combase!CoRevokeInitializeSpy+0xe49 (00007ffe`3312f8a9) 00007ffe`3312f850 8b9424b8020000 mov edx,dword ptr [rsp+2B8h] 00007ffe`3312f857 8d4f01 lea ecx,[rdi+1] 00007ffe`3312f85a 89542420 mov dword ptr [rsp+20h],edx 00007ffe`3312f85e 4183c9ff or r9d,0FFFFFFFFh 00007ffe`3312f862 488d542450 lea rdx,[rsp+50h] 00007ffe`3312f867 48896cfc50 mov qword ptr [rsp+rdi*8+50h],rbp 00007ffe`3312f86c 4533c0 xor r8d,r8d 00007ffe`3312f86f 48ff15fae41a00 call qword ptr [combase!Ordinal79+0x61710 (00007ffe`332ddd70)] 00007ffe`3312f876 0f1f440000 nop dword ptr [rax+rax] +000CF6F0 combase.dll!CoRevokeInitializeSpy+0xC90: 00007ffe`3312f6c0 448b0d29452300 mov r9d,dword ptr [combase!Ordinal183+0x524e8 (00007ffe`33363bf0)] 00007ffe`3312f6c7 488d442450 lea rax,[rsp+50h] 00007ffe`3312f6cc 8364245000 and dword ptr [rsp+50h],0 00007ffe`3312f6d1 4533c0 xor r8d,r8d 00007ffe`3312f6d4 4889442430 mov qword ptr [rsp+30h],rax 00007ffe`3312f6d9 33d2 xor edx,edx 00007ffe`3312f6db 8364242800 and dword ptr [rsp+28h],0 00007ffe`3312f6e0 488bcb mov rcx,rbx 00007ffe`3312f6e3 c7442420a00f0000 mov dword ptr [rsp+20h],0FA0h 00007ffe`3312f6eb e8e0000000 call combase!CoRevokeInitializeSpy+0xd70 (00007ffe`3312f7d0) 00007ffe`3312f6f0 85c0 test eax,eax +000CF500 combase.dll!CoRevokeInitializeSpy+0xAA0: 00007ffe`3312f4cc 44397108 cmp dword ptr [rcx+8],r14d 00007ffe`3312f4d0 0f8538010000 jne combase!CoRevokeInitializeSpy+0xbae (00007ffe`3312f60e) 00007ffe`3312f4d6 65488b042530000000 mov rax,qword ptr gs:[30h] 00007ffe`3312f4df 488b8058170000 mov rax,qword ptr [rax+1758h] 00007ffe`3312f4e6 4885c0 test rax,rax 00007ffe`3312f4e9 7407 je combase!CoRevokeInitializeSpy+0xa92 (00007ffe`3312f4f2) 00007ffe`3312f4eb 4489b038010000 mov dword ptr [rax+138h],r14d 00007ffe`3312f4f2 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffe`3312f4f6 488b4310 mov rax,qword ptr [rbx+10h] 00007ffe`3312f4fa ff1598f01a00 call qword ptr [combase!Ordinal79+0x61f38 (00007ffe`332de598)] 00007ffe`3312f500 48ff15d9e51a00 call qword ptr [combase!Ordinal79+0x61480 (00007ffe`332ddae0)] +000CF489 combase.dll!CoRevokeInitializeSpy+0xA29: 00007ffe`3312f460 48895c2408 mov qword ptr [rsp+8],rbx 00007ffe`3312f465 57 push rdi 00007ffe`3312f466 4883ec20 sub rsp,20h 00007ffe`3312f46a 488bf9 mov rdi,rcx 00007ffe`3312f46d 48ff155ce61a00 call qword ptr [combase!Ordinal79+0x61470 (00007ffe`332ddad0)] 00007ffe`3312f474 0f1f440000 nop dword ptr [rax+rax] 00007ffe`3312f479 894728 mov dword ptr [rdi+28h],eax 00007ffe`3312f47c e847040000 call combase!CoRevokeInitializeSpy+0xe68 (00007ffe`3312f8c8) 00007ffe`3312f481 488bcf mov rcx,rdi 00007ffe`3312f484 e82b000000 call combase!CoRevokeInitializeSpy+0xa54 (00007ffe`3312f4b4) 00007ffe`3312f489 488b5f30 mov rbx,qword ptr [rdi+30h] +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 8824 / 0x2278 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000002A87FA9F280 RCX = 0000000000000014 RDX = 000002A87FA9EF00 RSI = 000002A87FA02340 RDI = 000002A87FA9F280 R8 = 0000000000000000 R9 = 4110001540115551 R10 = F7DC03F4C000C3CC R11 = 5555555555555555 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFE33691034 RSP = 000000FACE4FF5D8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffe`33691014 c3 ret 00007ffe`33691015 cd2e int 2Eh 00007ffe`33691017 c3 ret 00007ffe`33691018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffe`33691020 4c8bd1 mov r10,rcx 00007ffe`33691023 b8d5010000 mov eax,1D5h 00007ffe`33691028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`33691030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffe`33691035) 00007ffe`33691032 0f05 syscall 00007ffe`33691034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffe`3363d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffe`3363d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffe`3363d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffe`3363d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffe`3363d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffe`3363d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffe`3363d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffe`3363d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffe`3363d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffe`3363d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffe`33691020) 00007ffe`3363d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 10340 / 0x2864 ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 0000000000000000 RCX = 0000000000000014 RDX = 000002A802272AC0 RSI = 000002A87FA02340 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFE33691034 RSP = 000000FACE5FF448 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffe`33691014 c3 ret 00007ffe`33691015 cd2e int 2Eh 00007ffe`33691017 c3 ret 00007ffe`33691018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffe`33691020 4c8bd1 mov r10,rcx 00007ffe`33691023 b8d5010000 mov eax,1D5h 00007ffe`33691028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`33691030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffe`33691035) 00007ffe`33691032 0f05 syscall 00007ffe`33691034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffe`3363d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffe`3363d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffe`3363d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffe`3363d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffe`3363d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffe`3363d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffe`3363d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffe`3363d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffe`3363d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffe`3363d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffe`33691020) 00007ffe`3363d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 14332 / 0x37FC ====================================================================== LastError: 0x000003F0 - Попытка ссылки на несуществующий токен. NTSTATUS: 0xC000007C - Попытка ссылки на несуществующий токен. Как правило, это происходит при ссылке на токен, связанный с потоком команд, не олицетворяющим клиента. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14 +0002212E USER32.dll!GetMessageW+0x2E +000AEC08 combase.dll!Ordinal69+0xC28 +000AEB40 combase.dll!Ordinal69+0xB60 +000CF500 combase.dll!CoRevokeInitializeSpy+0xAA0 +000CF489 combase.dll!CoRevokeInitializeSpy+0xA29 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001006 RBX = 000000FACE6FFD20 RCX = 000000FACE6FFD20 RDX = 0000000000000000 RSI = 00000000000B0B40 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 00007FFE334D79B6 R10 = 00007FFE0CD8D0F0 R11 = 000000FACE6FE700 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000001000 R15 = 0000000000000000 RIP = 00007FFE315B1104 RSP = 000000FACE6FFC78 RBP = 0000000000000350 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14: 00007ffe`315b10e4 c3 ret 00007ffe`315b10e5 cd2e int 2Eh 00007ffe`315b10e7 c3 ret 00007ffe`315b10e8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffe`315b10f0 4c8bd1 mov r10,rcx 00007ffe`315b10f3 b806100000 mov eax,1006h 00007ffe`315b10f8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`315b1100 7503 jne win32u!NtUserGetMessage+0x15 (00007ffe`315b1105) 00007ffe`315b1102 0f05 syscall 00007ffe`315b1104 c3 ret +0002212E USER32.dll!GetMessageW+0x2E: 00007ffe`32b12102 4883ec50 sub rsp,50h 00007ffe`32b12106 418bc1 mov eax,r9d 00007ffe`32b12109 488bd9 mov rbx,rcx 00007ffe`32b1210c 458bc8 mov r9d,r8d 00007ffe`32b1210f 440bc8 or r9d,eax 00007ffe`32b12112 41f7c10000feff test r9d,0FFFE0000h 00007ffe`32b12119 0f8591320200 jne USER32!SetWindowsHookExAW+0xee50 (00007ffe`32b353b0) 00007ffe`32b1211f 448bc8 mov r9d,eax 00007ffe`32b12122 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffe`32b12127 48ff156a1a0700 call qword ptr [USER32!gapfnScSendMessage+0x1208 (00007ffe`32b83b98)] 00007ffe`32b1212e 0f1f440000 nop dword ptr [rax+rax] +000AEC08 combase.dll!Ordinal69+0xC28: 00007ffe`3310ebd7 488bb1c0000000 mov rsi,qword ptr [rcx+0C0h] 00007ffe`3310ebde 488bce mov rcx,rsi 00007ffe`3310ebe1 48ff15b8292800 call qword ptr [combase!Ordinal183+0x7fe98 (00007ffe`333915a0)] 00007ffe`3310ebe8 0f1f440000 nop dword ptr [rax+rax] 00007ffe`3310ebed 488905c4512500 mov qword ptr [combase!Ordinal183+0x526b0 (00007ffe`33363db8)],rax 00007ffe`3310ebf4 4533c9 xor r9d,r9d 00007ffe`3310ebf7 488d4c2440 lea rcx,[rsp+40h] 00007ffe`3310ebfc 4533c0 xor r8d,r8d 00007ffe`3310ebff 33d2 xor edx,edx 00007ffe`3310ec01 48ff1580292800 call qword ptr [combase!Ordinal183+0x7fe80 (00007ffe`33391588)] 00007ffe`3310ec08 0f1f440000 nop dword ptr [rax+rax] +000AEB40 combase.dll!Ordinal69+0xB60: 00007ffe`3310eb1c 488bcd mov rcx,rbp 00007ffe`3310eb1f 894658 mov dword ptr [rsi+58h],eax 00007ffe`3310eb22 48ff155ff21c00 call qword ptr [combase!Ordinal79+0x61728 (00007ffe`332ddd88)] 00007ffe`3310eb29 0f1f440000 nop dword ptr [rax+rax] 00007ffe`3310eb2e 8b4630 mov eax,dword ptr [rsi+30h] 00007ffe`3310eb31 83e01f and eax,1Fh 00007ffe`3310eb34 ffc8 dec eax 00007ffe`3310eb36 83f801 cmp eax,1 00007ffe`3310eb39 7705 ja combase!Ordinal69+0xb60 (00007ffe`3310eb40) 00007ffe`3310eb3b e864000000 call combase!Ordinal69+0xbc4 (00007ffe`3310eba4) 00007ffe`3310eb40 488b442440 mov rax,qword ptr [rsp+40h] +000CF500 combase.dll!CoRevokeInitializeSpy+0xAA0: 00007ffe`3312f4cc 44397108 cmp dword ptr [rcx+8],r14d 00007ffe`3312f4d0 0f8538010000 jne combase!CoRevokeInitializeSpy+0xbae (00007ffe`3312f60e) 00007ffe`3312f4d6 65488b042530000000 mov rax,qword ptr gs:[30h] 00007ffe`3312f4df 488b8058170000 mov rax,qword ptr [rax+1758h] 00007ffe`3312f4e6 4885c0 test rax,rax 00007ffe`3312f4e9 7407 je combase!CoRevokeInitializeSpy+0xa92 (00007ffe`3312f4f2) 00007ffe`3312f4eb 4489b038010000 mov dword ptr [rax+138h],r14d 00007ffe`3312f4f2 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffe`3312f4f6 488b4310 mov rax,qword ptr [rbx+10h] 00007ffe`3312f4fa ff1598f01a00 call qword ptr [combase!Ordinal79+0x61f38 (00007ffe`332de598)] 00007ffe`3312f500 48ff15d9e51a00 call qword ptr [combase!Ordinal79+0x61480 (00007ffe`332ddae0)] +000CF489 combase.dll!CoRevokeInitializeSpy+0xA29: 00007ffe`3312f460 48895c2408 mov qword ptr [rsp+8],rbx 00007ffe`3312f465 57 push rdi 00007ffe`3312f466 4883ec20 sub rsp,20h 00007ffe`3312f46a 488bf9 mov rdi,rcx 00007ffe`3312f46d 48ff155ce61a00 call qword ptr [combase!Ordinal79+0x61470 (00007ffe`332ddad0)] 00007ffe`3312f474 0f1f440000 nop dword ptr [rax+rax] 00007ffe`3312f479 894728 mov dword ptr [rdi+28h],eax 00007ffe`3312f47c e847040000 call combase!CoRevokeInitializeSpy+0xe68 (00007ffe`3312f8c8) 00007ffe`3312f481 488bcf mov rcx,rdi 00007ffe`3312f484 e82b000000 call combase!CoRevokeInitializeSpy+0xa54 (00007ffe`3312f4b4) 00007ffe`3312f489 488b5f30 mov rbx,qword ptr [rdi+30h] +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 8936 / 0x22E8 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000002A8022781D0 RCX = 000000000000009C RDX = 000002A802277E50 RSI = 000002A87FA0B170 RDI = 000002A8022781D0 R8 = 0000000000000000 R9 = 0000000000000001 R10 = 00000000000000FF R11 = 0000000000007000 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFE33691034 RSP = 000000FACE7FF788 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffe`33691014 c3 ret 00007ffe`33691015 cd2e int 2Eh 00007ffe`33691017 c3 ret 00007ffe`33691018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffe`33691020 4c8bd1 mov r10,rcx 00007ffe`33691023 b8d5010000 mov eax,1D5h 00007ffe`33691028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`33691030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffe`33691035) 00007ffe`33691032 0f05 syscall 00007ffe`33691034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffe`3363d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffe`3363d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffe`3363d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffe`3363d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffe`3363d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffe`3363d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffe`3363d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffe`3363d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffe`3363d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffe`3363d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffe`33691020) 00007ffe`3363d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 10900 / 0x2A94 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14 +0002212E USER32.dll!GetMessageW+0x2E +0000C938 PortaDev.dll! (get the pdb) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001006 RBX = 000000FACE9FF930 RCX = 000000FACE9FF930 RDX = 0000000000000000 RSI = 000002A8022AFC80 RDI = 0000000000000000 R8 = 000002A87FA025B0 R9 = 0000000000000001 R10 = 0000000000000000 R11 = 000000FACE9FF140 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFE315B1104 RSP = 000000FACE9FF818 RBP = 000000FACE9FF980 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14: 00007ffe`315b10e4 c3 ret 00007ffe`315b10e5 cd2e int 2Eh 00007ffe`315b10e7 c3 ret 00007ffe`315b10e8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffe`315b10f0 4c8bd1 mov r10,rcx 00007ffe`315b10f3 b806100000 mov eax,1006h 00007ffe`315b10f8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`315b1100 7503 jne win32u!NtUserGetMessage+0x15 (00007ffe`315b1105) 00007ffe`315b1102 0f05 syscall 00007ffe`315b1104 c3 ret +0002212E USER32.dll!GetMessageW+0x2E: 00007ffe`32b12102 4883ec50 sub rsp,50h 00007ffe`32b12106 418bc1 mov eax,r9d 00007ffe`32b12109 488bd9 mov rbx,rcx 00007ffe`32b1210c 458bc8 mov r9d,r8d 00007ffe`32b1210f 440bc8 or r9d,eax 00007ffe`32b12112 41f7c10000feff test r9d,0FFFE0000h 00007ffe`32b12119 0f8591320200 jne USER32!SetWindowsHookExAW+0xee50 (00007ffe`32b353b0) 00007ffe`32b1211f 448bc8 mov r9d,eax 00007ffe`32b12122 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffe`32b12127 48ff156a1a0700 call qword ptr [USER32!gapfnScSendMessage+0x1208 (00007ffe`32b83b98)] 00007ffe`32b1212e 0f1f440000 nop dword ptr [rax+rax] +0000C938 PortaDev.dll! (get the pdb): 00007ffe`1fe8c910 742a je PortaDev+0xc93c (00007ffe`1fe8c93c) 00007ffe`1fe8c912 488d4db0 lea rcx,[rbp-50h] 00007ffe`1fe8c916 ff1564da0100 call qword ptr [PortaDev!ExitFARW+0x1b3bc (00007ffe`1feaa380)] 00007ffe`1fe8c91c 488d4db0 lea rcx,[rbp-50h] 00007ffe`1fe8c920 ff1562da0100 call qword ptr [PortaDev!ExitFARW+0x1b3c4 (00007ffe`1feaa388)] 00007ffe`1fe8c926 4533c9 xor r9d,r9d 00007ffe`1fe8c929 488d4db0 lea rcx,[rbp-50h] 00007ffe`1fe8c92d 4533c0 xor r8d,r8d 00007ffe`1fe8c930 33d2 xor edx,edx 00007ffe`1fe8c932 ff1560da0100 call qword ptr [PortaDev!ExitFARW+0x1b3d4 (00007ffe`1feaa398)] 00007ffe`1fe8c938 85c0 test eax,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 11104 / 0x2B60 (Async history config) ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE +0025F4F3 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj) +00078D7D Far.exe!`anonymous namespace'::HistoryConfigCustom::ThreadProc(void) __ptr64+0x49D (configdb.obj) +00084DAE Far.exe!os::concurrency::thread::wrapper(void (__cdecl `anonymous namespace'::HistoryConfigCustom::*&& __ptr64)(void) __ptr64,class A0x6002ce20::HistoryConfigCustom * __ptr64 const && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x2E (configdb.obj) +00380F4A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000002 RCX = 0000000000000002 RDX = 000000FACE8FF958 RSI = 0000000000000000 RDI = 0000000000000002 R8 = 0000000000000000 R9 = 0000000000000008 R10 = 0000000000000000 R11 = 00000000FFFFFFFF R12 = 00000000FFFFFFFF R13 = 000000FACE8FF958 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFE3368E0F4 RSP = 000000FACE8FF488 RBP = 000000FACE8FF9D0 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffe`3368e0d1 ab stos dword ptr [rdi] 00007ffe`3368e0d2 8efd mov st(-1),bp 00007ffe`3368e0d4 ff6666 jmp qword ptr [rsi+66h] 00007ffe`3368e0d7 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffe`3368e0e0 4c8bd1 mov r10,rcx 00007ffe`3368e0e3 b85b000000 mov eax,5Bh 00007ffe`3368e0e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`3368e0f0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffe`3368e0f5) 00007ffe`3368e0f2 0f05 syscall 00007ffe`3368e0f4 c3 ret +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffe`30ff0cd7 4c8d742450 lea r14,[rsp+50h] 00007ffe`30ff0cdc 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffe`30ff0ce1 4533c0 xor r8d,r8d 00007ffe`30ff0ce4 4585ff test r15d,r15d 00007ffe`30ff0ce7 410f94c0 sete r8b 00007ffe`30ff0ceb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffe`30ff0cf0 440fb6ce movzx r9d,sil 00007ffe`30ff0cf4 498bd5 mov rdx,r13 00007ffe`30ff0cf7 8bcb mov ecx,ebx 00007ffe`30ff0cf9 48ff1560281900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7240 (00007ffe`31183560)] 00007ffe`30ff0d00 0f1f440000 nop dword ptr [rax+rax] +00050BFE KERNELBASE.dll!WaitForMultipleObjects+0xE: 00007ffe`30ff0bea cc int 3 00007ffe`30ff0beb cc int 3 00007ffe`30ff0bec cc int 3 00007ffe`30ff0bed cc int 3 00007ffe`30ff0bee cc int 3 00007ffe`30ff0bef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffe`30ff0bf0 4883ec38 sub rsp,38h 00007ffe`30ff0bf4 8364242000 and dword ptr [rsp+20h],0 00007ffe`30ff0bf9 e812000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffe`30ff0c10) 00007ffe`30ff0bfe 4883c438 add rsp,38h +0025F4F3 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj): 00007ff6`fb04f4c2 4881ec00010000 sub rsp,100h 00007ff6`fb04f4c9 488b05704d2400 mov rax,qword ptr [Far+0x4a4240 (00007ff6`fb294240)] 00007ff6`fb04f4d0 4833c4 xor rax,rsp 00007ff6`fb04f4d3 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`fb04f4db 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`fb04f4df 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`fb04f4e5 4533c0 xor r8d,r8d 00007ff6`fb04f4e8 488b11 mov rdx,qword ptr [rcx] 00007ff6`fb04f4eb 8bcb mov ecx,ebx 00007ff6`fb04f4ed ff1545fe1600 call qword ptr [Far+0x3cf338 (00007ff6`fb1bf338)] 00007ff6`fb04f4f3 8bc8 mov ecx,eax +00078D7D Far.exe!`anonymous namespace'::HistoryConfigCustom::ThreadProc(void) __ptr64+0x49D (configdb.obj): 00007ff6`fae68d4c 48894588 mov qword ptr [rbp-78h],rax 00007ff6`fae68d50 488b8788000000 mov rax,qword ptr [rdi+88h] 00007ff6`fae68d57 48894590 mov qword ptr [rbp-70h],rax 00007ff6`fae68d5b 488d4588 lea rax,[rbp-78h] 00007ff6`fae68d5f 488945a0 mov qword ptr [rbp-60h],rax 00007ff6`fae68d63 48c745a802000000 mov qword ptr [rbp-58h],2 00007ff6`fae68d6b 0f2845a0 movaps xmm0,xmmword ptr [rbp-60h] 00007ff6`fae68d6f 660f7f45b0 movdqa xmmword ptr [rbp-50h],xmm0 00007ff6`fae68d74 488d4db0 lea rcx,[rbp-50h] 00007ff6`fae68d78 e843671e00 call Far+0x25f4c0 (00007ff6`fb04f4c0) 00007ff6`fae68d7d 4883f801 cmp rax,1 +00084DAE Far.exe!os::concurrency::thread::wrapper(void (__cdecl `anonymous namespace'::HistoryConfigCustom::*&& __ptr64)(void) __ptr64,class A0x6002ce20::HistoryConfigCustom * __ptr64 const && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x2E (configdb.obj): 00007ff6`fae74d89 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`fae74d8e 4c8b4910 mov r9,qword ptr [rcx+10h] 00007ff6`fae74d92 4863510c movsxd rdx,dword ptr [rcx+0Ch] 00007ff6`fae74d96 498b4108 mov rax,qword ptr [r9+8] 00007ff6`fae74d9a 48630c02 movsxd rcx,dword ptr [rdx+rax] 00007ff6`fae74d9e 48635308 movsxd rdx,dword ptr [rbx+8] 00007ff6`fae74da2 4903c9 add rcx,r9 00007ff6`fae74da5 4883c208 add rdx,8 00007ff6`fae74da9 4803ca add rcx,rdx 00007ff6`fae74dac ff13 call qword ptr [rbx] 00007ff6`fae74dae 90 nop +00380F4A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`fb170f21 7510 jne Far+0x380f33 (00007ff6`fb170f33) 00007ff6`fb170f23 8d48ff lea ecx,[rax-1] 00007ff6`fb170f26 e8ed230100 call Far+0x393318 (00007ff6`fb183318) 00007ff6`fb170f2b 85c0 test eax,eax 00007ff6`fb170f2d 0f94c0 sete al 00007ff6`fb170f30 884320 mov byte ptr [rbx+20h],al 00007ff6`fb170f33 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`fb170f3d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`fb170f41 488b03 mov rax,qword ptr [rbx] 00007ff6`fb170f44 ff152eef0400 call qword ptr [Far+0x3cfe78 (00007ff6`fb1bfe78)] 00007ff6`fb170f4a 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 1260 / 0x4EC ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 0000000000000000 RCX = 000000000000052C RDX = 000002A804D09220 RSI = 000002A804B67D70 RDI = 0000000000000000 R8 = 0000000000000390 R9 = 0101010101010101 R10 = 00000000000000FF R11 = 0000000000003000 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFE33691034 RSP = 000000FACEAFF6B8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A1034 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffe`33691014 c3 ret 00007ffe`33691015 cd2e int 2Eh 00007ffe`33691017 c3 ret 00007ffe`33691018 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffe`33691020 4c8bd1 mov r10,rcx 00007ffe`33691023 b8d5010000 mov eax,1D5h 00007ffe`33691028 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`33691030 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffe`33691035) 00007ffe`33691032 0f05 syscall 00007ffe`33691034 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffe`3363d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffe`3363d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffe`3363d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffe`3363d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffe`3363d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffe`3363d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffe`3363d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffe`3363d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffe`3363d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffe`3363d402 e8193c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffe`33691020) 00007ffe`3363d407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Thread 8040 / 0x1F68 ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +0004B7B7 CRYPT32.dll!CertFreeCRLContext+0x697 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000001 RCX = 0000000000000001 RDX = 000002A804EB9050 RSI = 0000000000000000 RDI = 0000000000000001 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 0000000000003A98 R13 = 000002A804EB9050 R14 = 000000FACEBFF480 R15 = 0000000000000000 RIP = 00007FFE3368E0F4 RSP = 000000FACEBFF428 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E0F4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffe`3368e0d1 ab stos dword ptr [rdi] 00007ffe`3368e0d2 8efd mov st(-1),bp 00007ffe`3368e0d4 ff6666 jmp qword ptr [rsi+66h] 00007ffe`3368e0d7 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffe`3368e0e0 4c8bd1 mov r10,rcx 00007ffe`3368e0e3 b85b000000 mov eax,5Bh 00007ffe`3368e0e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffe`3368e0f0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffe`3368e0f5) 00007ffe`3368e0f2 0f05 syscall 00007ffe`3368e0f4 c3 ret +00050D00 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffe`30ff0cd7 4c8d742450 lea r14,[rsp+50h] 00007ffe`30ff0cdc 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffe`30ff0ce1 4533c0 xor r8d,r8d 00007ffe`30ff0ce4 4585ff test r15d,r15d 00007ffe`30ff0ce7 410f94c0 sete r8b 00007ffe`30ff0ceb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffe`30ff0cf0 440fb6ce movzx r9d,sil 00007ffe`30ff0cf4 498bd5 mov rdx,r13 00007ffe`30ff0cf7 8bcb mov ecx,ebx 00007ffe`30ff0cf9 48ff1560281900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7240 (00007ffe`31183560)] 00007ffe`30ff0d00 0f1f440000 nop dword ptr [rax+rax] +0004B7B7 CRYPT32.dll!CertFreeCRLContext+0x697: 00007ffe`313eb793 488bd9 mov rbx,rcx 00007ffe`313eb796 48f7d8 neg rax 00007ffe`313eb799 1bff sbb edi,edi 00007ffe`313eb79b f7df neg edi 00007ffe`313eb79d 448b4b30 mov r9d,dword ptr [rbx+30h] 00007ffe`313eb7a1 488d5310 lea rdx,[rbx+10h] 00007ffe`313eb7a5 8364242000 and dword ptr [rsp+20h],0 00007ffe`313eb7aa 8d4f01 lea ecx,[rdi+1] 00007ffe`313eb7ad 4533c0 xor r8d,r8d 00007ffe`313eb7b0 48ff15f1ee0c00 call qword ptr [CRYPT32!CryptMsgSignCTL+0x1f8e8 (00007ffe`314ba6a8)] 00007ffe`313eb7b7 0f1f440000 nop dword ptr [rax+rax] +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffe`3222735d cc int 3 00007ffe`3222735e cc int 3 00007ffe`3222735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffe`32227360 4883ec28 sub rsp,28h 00007ffe`32227364 85c9 test ecx,ecx 00007ffe`32227366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffe`32227383) 00007ffe`32227368 498bc8 mov rcx,r8 00007ffe`3222736b 488bc2 mov rax,rdx 00007ffe`3222736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffe`32296648)] 00007ffe`32227374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffe`3363cc72 ec in al,dx 00007ffe`3363cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffe`3363ccc1) 00007ffe`3363cc75 8bc9 mov ecx,ecx 00007ffe`3363cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffe`3375bff0)] 00007ffe`3363cc7e 4885c0 test rax,rax 00007ffe`3363cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffe`3363cc93) 00007ffe`3363cc83 4c8bc2 mov r8,rdx 00007ffe`3363cc86 488bd1 mov rdx,rcx 00007ffe`3363cc89 33c9 xor ecx,ecx 00007ffe`3363cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffe`33775000)] 00007ffe`3363cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffe`3363ccb3) ====================================================================== Modules ====================================================================== 0x00007FF6FADF0000 - 0x00007FF6FB383000 | D:\Programs\Far\Far.exe | File and archive manager | 3.0.6600.0 x64 0x00007FFE335F0000 - 0x00007FFE337E8000 | C:\windows\SYSTEM32\ntdll.dll | Системная библиотека NT | 10.0.19041.4842 (WinBuild.160101.0800) 0x00007FFE32210000 - 0x00007FFE322D2000 | C:\windows\System32\KERNEL32.DLL | Библиотека клиента Windows NT BASE API | 10.0.19041.5915 (WinBuild.160101.0800) 0x00007FFE30FA0000 - 0x00007FFE31296000 | C:\windows\System32\KERNELBASE.dll | Библиотека клиента Windows NT BASE API | 10.0.19041.5915 (WinBuild.160101.0800) 0x00007FFE2E1C0000 - 0x00007FFE2E254000 | C:\windows\SYSTEM32\apphelp.dll | Клиентская библиотека совместимости приложений | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE32DF0000 - 0x00007FFE32EA1000 | C:\windows\System32\ADVAPI32.dll | Расширенная библиотека API Windows 32 | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE31670000 - 0x00007FFE3170E000 | C:\windows\System32\msvcrt.dll | Windows NT CRT DLL | 7.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE32170000 - 0x00007FFE3220F000 | C:\windows\System32\sechost.dll | Host for SCM/SDDL/LSA Lookup APIs | 10.0.19041.1 (WinBuild.160101.0800) 0x00007FFE33460000 - 0x00007FFE33580000 | C:\windows\System32\RPCRT4.dll | Библиотека удаленного вызова процедур | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE31580000 - 0x00007FFE315A7000 | C:\windows\System32\bcrypt.dll | Библиотека криптографических примитивов Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE32AF0000 - 0x00007FFE32C91000 | C:\windows\System32\USER32.dll | Многопользовательская библиотека клиента USER API Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE315B0000 - 0x00007FFE315D2000 | C:\windows\System32\win32u.dll | Win32u | 10.0.19041.6456 (WinBuild.160101.0800) 0x00007FFE32890000 - 0x00007FFE328BB000 | C:\windows\System32\GDI32.dll | GDI Client DLL | 10.0.19041.6157 (WinBuild.160101.0800) 0x00007FFE30DE0000 - 0x00007FFE30EF9000 | C:\windows\System32\gdi32full.dll | GDI Client DLL | 10.0.19041.6157 (WinBuild.160101.0800) 0x00007FFE30F00000 - 0x00007FFE30F9D000 | C:\windows\System32\msvcp_win.dll | Microsoft® C Runtime Library | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE312A0000 - 0x00007FFE313A0000 | C:\windows\System32\ucrtbase.dll | Microsoft® C Runtime Library | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE31710000 - 0x00007FFE31E80000 | C:\windows\System32\SHELL32.dll | Общая библиотека оболочки Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE32760000 - 0x00007FFE3288B000 | C:\windows\System32\ole32.dll | Microsoft OLE для Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE33060000 - 0x00007FFE333B4000 | C:\windows\System32\combase.dll | Microsoft COM для Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE32CA0000 - 0x00007FFE32CA8000 | C:\windows\System32\PSAPI.DLL | Process Status Helper | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE322F0000 - 0x00007FFE32760000 | C:\windows\System32\SETUPAPI.dll | Windows Setup API | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE1E690000 - 0x00007FFE1E6A9000 | C:\windows\SYSTEM32\NETAPI32.dll | Net Win32 API DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE23D60000 - 0x00007FFE23E04000 | C:\windows\SYSTEM32\WINSPOOL.DRV | Драйвер диспетчера очереди Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE328C0000 - 0x00007FFE3296D000 | C:\windows\System32\shcore.dll | SHCORE | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE286E0000 - 0x00007FFE286FD000 | C:\windows\SYSTEM32\MPR.dll | Библиотека маршрутизации для нескольких служб доступа | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE21C70000 - 0x00007FFE21C7C000 | C:\windows\SYSTEM32\Secur32.dll | Security Support Provider Interface | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE30C50000 - 0x00007FFE30C9E000 | C:\windows\System32\cfgmgr32.dll | Configuration Manager DLL | 10.0.19041.3996 (WinBuild.160101.0800) 0x00007FFE32D10000 - 0x00007FFE32DEA000 | C:\windows\System32\COMDLG32.dll | Библиотека общих диалоговых окон | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE32970000 - 0x00007FFE329CB000 | C:\windows\System32\SHLWAPI.dll | Библиотека небольших программ оболочки | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE31640000 - 0x00007FFE3166F000 | C:\windows\System32\IMM32.dll | Multi-User Windows IMM32 API Client DLL | 10.0.19041.6157 (WinBuild.160101.0800) 0x00007FFE29940000 - 0x00007FFE2994A000 | C:\windows\SYSTEM32\VERSION.dll | Version Checking and File Installation Libraries | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE30B40000 - 0x00007FFE30B6E000 | C:\windows\SYSTEM32\USERENV.dll | Userenv | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE24B80000 - 0x00007FFE24E1B000 | C:\windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\COMCTL32.dll | Библиотека элементов управления взаимодействия с пользователем | 6.10 (WinBuild.160101.0800) 0x00007FFE18220000 - 0x00007FFE18347000 | D:\Programs\Far\sqlite3.dll | SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine. | 3.51.0 0x00007FFE30140000 - 0x00007FFE3014C000 | C:\windows\SYSTEM32\NETUTILS.DLL | Net Win32 API Helpers DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE28680000 - 0x00007FFE28699000 | C:\windows\SYSTEM32\SAMCLI.DLL | Security Accounts Manager Client DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE28650000 - 0x00007FFE28678000 | C:\windows\SYSTEM32\SRVCLI.DLL | Server Service Client DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE30B00000 - 0x00007FFE30B32000 | C:\windows\SYSTEM32\SSPICLI.DLL | Security Support Provider Interface | 10.0.19041.6328 (WinBuild.160101.0800) 0x00007FFE2EA80000 - 0x00007FFE2EA92000 | C:\windows\SYSTEM32\kernel.appcore.dll | AppModel API Host | 10.0.19041.3758 (WinBuild.160101.0800) 0x00007FFE2E510000 - 0x00007FFE2E5AE000 | C:\windows\system32\uxtheme.dll | Библиотека тем UxTheme (Microsoft) | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE329D0000 - 0x00007FFE32AE5000 | C:\windows\System32\MSCTF.dll | Серверная библиотека MSCTF | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE32020000 - 0x00007FFE320ED000 | C:\windows\System32\OLEAUT32.dll | OLEAUT32.DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE30CA0000 - 0x00007FFE30D22000 | C:\windows\System32\bcryptPrimitives.dll | Windows Cryptographic Primitives Library | 10.0.19041.5007 (WinBuild.160101.0800) 0x00007FFE31F70000 - 0x00007FFE32019000 | C:\windows\System32\clbcatq.dll | COM+ Configuration Catalog | 2001.12.10941.16384 (WinBuild.160101.0800) 0x00007FFE0CC30000 - 0x00007FFE0CE88000 | C:\windows\system32\explorerframe.dll | ExplorerFrame | 10.0.19041.4842 (WinBuild.160101.0800) 0x00007FFE2C050000 - 0x00007FFE2C610000 | C:\windows\system32\d2d1.dll | Библиотека Microsoft D2D | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE27DC0000 - 0x00007FFE28594000 | C:\Windows\System32\OneCoreUAPCommonProxyStub.dll | OneCoreUAP Common Proxy Stub | 10.0.19041.5915 (WinBuild.160101.0800) 0x00007FFE20040000 - 0x00007FFE20063000 | D:\Programs\Far\Plugins\LuaMacro\LuaMacro.dll | Lua Macros for Far Manager | 3.0.908.0 0x00007FFE180F0000 - 0x00007FFE1819E000 | D:\Programs\Far\luafar3.dll | LuaFar library | 3.0.908.0 0x0000000066D80000 - 0x0000000066E00000 | D:\Programs\Far\lua51.dll | 0x00000715 - Указанный тип ресурса в файле образа отсутствует. 0x00007FFE30510000 - 0x00007FFE3051C000 | C:\windows\SYSTEM32\CRYPTBASE.DLL | Base cryptographic API DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE1FE80000 - 0x00007FFE1FEC3000 | D:\Programs\Far\Plugins\PortaDev\PortaDev.dll | Windows Portable Devices wrapper plugin for Far 3.0 | 3.15.4040.4 0x00007FFE29D50000 - 0x00007FFE29DF3000 | C:\Windows\System32\PortableDeviceApi.dll | Компоненты API для переносных устройств Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE309E0000 - 0x00007FFE30A13000 | C:\windows\SYSTEM32\DEVOBJ.dll | Device Information Set DLL | 10.0.19041.5794 (WinBuild.160101.0800) 0x00007FFE31500000 - 0x00007FFE31573000 | C:\windows\System32\WINTRUST.dll | Microsoft Trust Verification APIs | 10.0.19041.6456 (WinBuild.160101.0800) 0x00007FFE313A0000 - 0x00007FFE314FD000 | C:\windows\System32\CRYPT32.dll | API32 криптографии | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFE30810000 - 0x00007FFE30822000 | C:\windows\SYSTEM32\MSASN1.dll | ASN.1 Runtime APIs | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE1FE40000 - 0x00007FFE1FE79000 | D:\Programs\Far\Plugins\TmpPanel\TmpPanel.dll | Temporary Panel for Far Manager | 3.0.122.0 0x00007FFE17FE0000 - 0x00007FFE18045000 | D:\Programs\Far\Plugins\AdvCmpEx\AdvCmpEx.dll | Advanced compare files for Far Manager 3 x64 | 3.5.0 0x0000000000400000 - 0x000000000044C000 | D:\Programs\Far\Plugins\VisualCompare\VisComp.dll | Visual Compare Far plugin (Far 3 x64) | 1.18 0x00007FFE1C260000 - 0x00007FFE1C461000 | C:\windows\SYSTEM32\dbghelp.DLL | Windows Image Helper | 10.0.19041.5848 (WinBuild.160101.0800) 0x00007FFE17080000 - 0x00007FFE170B4000 | C:\windows\SYSTEM32\dbgcore.DLL | Windows Core Debugging Helpers | 10.0.19041.5794 (WinBuild.160101.0800) 0x00007FFE00B20000 - 0x00007FFE011A7000 | C:\windows\SYSTEM32\dbgeng.DLL | Windows Symbolic Debugger Engine | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE2B510000 - 0x00007FFE2B546000 | C:\windows\SYSTEM32\XmlLite.dll | Microsoft XmlLite Library | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE02E00000 - 0x00007FFE02EB4000 | C:\windows\SYSTEM32\dbgmodel.dll | Windows Debugger Data Model | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFE305E0000 - 0x00007FFE305F8000 | C:\windows\SYSTEM32\CRYPTSP.dll | Cryptographic Service Provider API | 10.0.19041.5856 (WinBuild.160101.0800) 0x00007FFE2FC50000 - 0x00007FFE2FC88000 | C:\windows\system32\rsaenh.dll | Microsoft Enhanced Cryptographic Provider | 10.0.19041.1 (WinBuild.160101.0800) 0x00007FFE333C0000 - 0x00007FFE333DD000 | C:\windows\System32\imagehlp.dll | Windows NT Image Helper | 10.0.19041.3636 (WinBuild.160101.0800) ====================================================================== Environment ====================================================================== FARADMINMODE=1 FARHOME=D:\Programs\Far FARLANG=Russian FARLOCALPROFILE=D:\Programs\Far\Profile FARPROFILE=D:\Programs\Far\Profile