View Issue Details

IDProjectCategoryView StatusLast Update
0004097Far Manager_Commonpublic2026-03-12 21:22
ReporterAK666 Assigned To 
PriorityimmediateSeveritycrashReproducibilityrandom
Status closedResolutionno change required 
Platformx64OSWindowsOS Version10
Product Version3.0 
Summary0004097: termination on start
Descriptiontermination on start
Steps To Reproducerun FarManager
Additional Informationstandart start
TagsNo tags attached.
Build0

Activities

AK666

2026-03-12 15:23

reporter  

README.txt (572 bytes)   
Please send bug_report.txt and far.mdmp to the developers:

  https://github.com/FarGroup/FarManager/issues
  https://bugs.farmanager.com
  https://forum.farmanager.com/viewforum.php?f=37
  https://forum.farmanager.com/viewforum.php?f=9

Please include the steps needed to reproduce the problem
and any other potentially useful information.

------------------------------------------------------------
DO NOT SHARE far_full.mdmp UNLESS EXPLICITLY ASKED TO DO SO.
It could contain sensitive data.
------------------------------------------------------------
README.txt (572 bytes)   
bug_report.txt (255,690 bytes)   
��

======================================================================

Summary

======================================================================

Exception: 0xC0000005 - STATUS_ACCESS_VIOLATION

Details:   Memory at [00007FFACF6AAE70 <unknown>!<unknown> (get the pdb)] could not be executed

errno:     0x00000000 - No error

LastError: 0x00000057 - The parameter is incorrect.

NTSTATUS:  0xC000000D - An invalid parameter was passed to a service or function.

Address:    00007FFACF6AAE70 <unknown>!<unknown> (get the pdb)

Location:  unhandled_exception_filter_impl, exception_handler.cpp(2212)

Module:    C:\Program Files\Far Manager\Far.exe

Plugin:    N/A



======================================================================

System information

======================================================================

Far:       3.0.6644.0 x64 (1a4340d)

Compiler:  Microsoft Visual C++, version 19.41.33923.0

Library:   Microsoft STL, version 14.3.202404

PE time:   2026-02-12 01:10:04.000

File time: 2026-02-11 23:10:34.000

Time:      2026-03-12 15:13:32.402

Local:     2026-03-12 17:13:32.402 +0200, $V=;O=4VO (78<0)

Uptime:    00:00:02

OS:        Windows NT Workstation 10.0.19045, 0x100/0x30 (Windows 10 Pro, version 22H2, OS build 19045.7058)

Locale:    uk-UA | LCID=00000422 (Lang=0422 (Primary=022 Sub=01) Sort=0 SortVersion=0) | ANSI=1251 OEM=866

Host:      C:\Windows\System32\conhost.exe 10.0.19041.320 (WinBuild.160101.0800)

Parent:    C:\Windows\explorer.exe 10.0.19041.4522 (WinBuild.160101.0800)

Command:   "C:\Program Files\Far Manager\Far.exe" 

Elevated:  No (Limited)

Memory:    14.1 G out of 27.9 G free (50%); 8.86 M used by the process



======================================================================

Exception

======================================================================



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

 00007FFACF6AAE70 <unknown>!<unknown> (get the pdb)

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 00007FFACF6AAE70

RBX = 0000000000000000

RCX = 000001DFD46815C0

RDX = 00007FFACF6AAE70

RSI = 0000000000000000

RDI = 0000000000000000

R8  = 000001DFD46815C0

R9  = 00007FFACF6AAE70

R10 = 0000000000000000

R11 = 0000000000000000

R12 = 0000000000000000

R13 = 0000000000000000

R14 = 0000000000000000

R15 = 0000000000000000

RIP = 00007FFACF6AAE70

RSP = 0000000EDDAFFAB8

RBP = 0000000000000000

EFL = 00010246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

 00007FFACF6AAE70 <unknown>!<unknown> (get the pdb):

No prior disassembly possible
                           00007ffa`cf6aae70 ??              ???
                           00007ffa`cf6aae71 ??              ???
                           00007ffa`cf6aae72 ??              ???
                           00007ffa`cf6aae73 ??              ???
                           00007ffa`cf6aae74 ??              ???
                           00007ffa`cf6aae75 ??              ???
                           00007ffa`cf6aae76 ??              ???
                           00007ffa`cf6aae77 ??              ???
                           00007ffa`cf6aae78 ??              ???
                           00007ffa`cf6aae79 ??              ???


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Exception handler thread

======================================================================



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+0012E692 Far.exe!collect_information(class exception_context const & __ptr64,struct source_location const & __ptr64,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,struct error_state_ex const & __ptr64,class std::span<struct os::debug::stack_frame const ,-1>)+0x1902 (exception_handler.obj)

+00130DA5 Far.exe!handle_generic_exception(class exception_context const & __ptr64,struct source_location const & __ptr64,class Plugin const * __ptr64 const,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,struct error_state_ex const & __ptr64,class std::span<struct os::debug::stack_frame const ,-1>)+0x955 (exception_handler.obj)

+0013217E Far.exe!handle_seh_exception(class exception_context const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)+0x30E (exception_handler.obj)

+00132EA3 Far.exe!detail::seh_filter(struct _EXCEPTION_POINTERS const * __ptr64,class Plugin const * __ptr64,struct source_location const & __ptr64)+0x173 (exception_handler.obj)

+001326F0 Far.exe!unhandled_exception_filter_impl(struct _EXCEPTION_POINTERS * __ptr64 const)+0x30 (exception_handler.obj)

+0012C7E7 KERNELBASE.dll!UnhandledExceptionFilter+0x1E7

+000A5958 ntdll.dll!memset+0x1218

+0008CE76 ntdll.dll!_C_specific_handler+0x96

+000A29DF ntdll.dll!_chkstk+0x11F

+00052554 ntdll.dll!RtlRaiseException+0x484

+000A14EE ntdll.dll!KiUserExceptionDispatcher+0x2E

 00007FFACF6AAE70 <unknown>!<unknown> (get the pdb)



======================================================================

Thread 22368 / 0x5760 (Main Thread)

======================================================================

LastError: 0x00000012 - There are no more files.

NTSTATUS:  0x80000006 - {No More Files} No more files were found which match the file specification.



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14

+00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0

+00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE

+0026A966 Far.exe!os::detail::multi_wait(class std::span<void * __ptr64 const,-1>,bool,class std::optional<class std::chrono::duration<__int64,struct std::ratio<1,1000> > >)+0x56 (platform.obj)

+0020FBAA Far.exe!GetInputRecordImpl(struct _INPUT_RECORD * __ptr64,bool,bool)+0x43A (keyboard.obj)

+002106F9 Far.exe!GetInputRecord(struct _INPUT_RECORD * __ptr64,bool,bool)+0x29 (keyboard.obj)

+0024208A Far.exe!Manager::ProcessMainLoop(void) __ptr64+0x2A (manager.obj)

+00242031 Far.exe!Manager::EnterMainLoop(void) __ptr64+0xC1 (manager.obj)

+00239231 Far.exe!MainProcess(class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,int,int)+0x1621 (main.obj)

+0023DC2C Far.exe!`mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_5>::operator()(void)const __ptr64+0xEC (main.obj)

+0023E802 Far.exe!`function_ref<void __cdecl(void)>::function_ref<void __cdecl(void)><class `cpp_try<class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_5>,class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_7>,class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_6> >(class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_5> const & __ptr64,class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_6> const & __ptr64,class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_7> const & __ptr64,struct source_location const & __ptr64)'::`7'::<lambda_2> >(class `cpp_try<class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_5>,class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_7>,class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_6> >(class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_5> const & __ptr64,class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_6> const & __ptr64,class `mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_7> const & __ptr64,struct source_location const & __ptr64)'::`7'::<lambda_2> && __ptr64) __ptr64'::`1'::<lambda_3_>::<lambda_invoker_cdecl>(__int64)+0x12 (main.obj)

+00132CA6 Far.exe!detail::cpp_try(class function_ref<void __cdecl(void)>,class function_ref<void __cdecl(struct source_location const & __ptr64)>,class function_ref<void __cdecl(class std::exception const & __ptr64,struct source_location const & __ptr64)>,struct source_location const & __ptr64)+0x36 (exception_handler.obj)

+0023D6F6 Far.exe!mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)+0xE16 (main.obj)

+0023E119 Far.exe!`wmain_seh(void)'::`2'::<lambda_1>::operator()(void)const __ptr64+0x19 (main.obj)

+0023E882 Far.exe!`function_ref<void __cdecl(void)>::function_ref<void __cdecl(void)><class `cpp_try<class `wmain_seh(void)'::`2'::<lambda_1>,class `wmain_seh(void)'::`2'::<lambda_3>,class `wmain_seh(void)'::`2'::<lambda_2> >(class `wmain_seh(void)'::`2'::<lambda_1> const & __ptr64,class `wmain_seh(void)'::`2'::<lambda_2> const & __ptr64,class `wmain_seh(void)'::`2'::<lambda_3> const & __ptr64,struct source_location const & __ptr64)'::`7'::<lambda_2> >(class `cpp_try<class `wmain_seh(void)'::`2'::<lambda_1>,class `wmain_seh(void)'::`2'::<lambda_3>,class `wmain_seh(void)'::`2'::<lambda_2> >(class `wmain_seh(void)'::`2'::<lambda_1> const & __ptr64,class `wmain_seh(void)'::`2'::<lambda_2> const & __ptr64,class `wmain_seh(void)'::`2'::<lambda_3> const & __ptr64,struct source_location const & __ptr64)'::`7'::<lambda_2> && __ptr64) __ptr64'::`1'::<lambda_6_>::<lambda_invoker_cdecl>(__int64)+0x12 (main.obj)

+00132CA6 Far.exe!detail::cpp_try(class function_ref<void __cdecl(void)>,class function_ref<void __cdecl(struct source_location const & __ptr64)>,class function_ref<void __cdecl(class std::exception const & __ptr64,struct source_location const & __ptr64)>,struct source_location const & __ptr64)+0x36 (exception_handler.obj)

+0023E04A Far.exe!wmain_seh(void)+0x3AA (main.obj)

+0023E90C Far.exe!`function_ref<void __cdecl(void)>::function_ref<void __cdecl(void)><class `seh_try<class `main(void)'::`2'::<lambda_1>,class `seh_try_with_ui<class `main(void)'::`2'::<lambda_1>,class `main(void)'::`2'::<lambda_2> >(class `main(void)'::`2'::<lambda_1> const & __ptr64,class `main(void)'::`2'::<lambda_2> const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::<lambda_1>,class `main(void)'::`2'::<lambda_2> >(class `main(void)'::`2'::<lambda_1> const & __ptr64,class `seh_try_with_ui<class `main(void)'::`2'::<lambda_1>,class `main(void)'::`2'::<lambda_2> >(class `main(void)'::`2'::<lambda_1> const & __ptr64,class `main(void)'::`2'::<lambda_2> const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::<lambda_1> const & __ptr64,class `main(void)'::`2'::<lambda_2> const & __ptr64)'::`3'::<lambda_1> >(class `seh_try<class `main(void)'::`2'::<lambda_1>,class `seh_try_with_ui<class `main(void)'::`2'::<lambda_1>,class `main(void)'::`2'::<lambda_2> >(class `main(void)'::`2'::<lambda_1> const & __ptr64,class `main(void)'::`2'::<lambda_2> const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::<lambda_1>,class `main(void)'::`2'::<lambda_2> >(class `main(void)'::`2'::<lambda_1> const & __ptr64,class `seh_try_with_ui<class `main(void)'::`2'::<lambda_1>,class `main(void)'::`2'::<lambda_2> >(class `main(void)'::`2'::<lambda_1> const & __ptr64,class `main(void)'::`2'::<lambda_2> const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::<lambda_1> const & __ptr64,class `main(void)'::`2'::<lambda_2> const & __ptr64)'::`3'::<lambda_1> && __ptr64) __ptr64'::`1'::<lambda_8_>::<lambda_invoker_cdecl>(__int64)+0x4C (main.obj)

+00132CD8 Far.exe!detail::seh_try(class function_ref<void __cdecl(void)>,class function_ref<unsigned long __cdecl(struct _EXCEPTION_POINTERS * __ptr64)>,class function_ref<void __cdecl(unsigned long)>)+0x18 (exception_handler.obj)

+0023E298 Far.exe!main+0xC8 (main.obj)

+00375D00 Far.exe!__scrt_common_main_seh(void)+0x10C (LIBCMT:exe_main.obj)

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 000000000000005B

RBX = 0000000000000002

RCX = 0000000000000002

RDX = 0000000EDCD8E680

RSI = 0000000000000000

RDI = 0000000000000002

R8  = 000001DFD3547E60

R9  = 00000000000000A0

R10 = 0000000001A22000

R11 = 000001DFD3547E60

R12 = 0000000000006A89

R13 = 0000000EDCD8E680

R14 = 0000000EDCD8DD30

R15 = 0000000000000000

RIP = 00007FFB7BE0E164

RSP = 0000000EDCD8DCD8

RBP = 0000000EDCD8E110

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14:

                           00007ffb`7be0e13d 0000            add     byte ptr [rax],al
                           00007ffb`7be0e13f 00e9            add     cl,ch
                           00007ffb`7be0e141 6b8efdff666666  imul    ecx,dword ptr [rsi+6666FFFDh],66h
                           00007ffb`7be0e148 0f1f840000000000 nop     dword ptr [rax+rax]
ntdll!NtWaitForMultipleObjects:
                           00007ffb`7be0e150 4c8bd1          mov     r10,rcx
                           00007ffb`7be0e153 b85b000000      mov     eax,5Bh
                           00007ffb`7be0e158 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`7be0e160 7503            jne     ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`7be0e165)
                           00007ffb`7be0e162 0f05            syscall
                           00007ffb`7be0e164 c3              ret


+00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0:

                           00007ffb`79940ce7 4c8d742450      lea     r14,[rsp+50h]
                           00007ffb`79940cec 448b7c2444      mov     r15d,dword ptr [rsp+44h]
                           00007ffb`79940cf1 4533c0          xor     r8d,r8d
                           00007ffb`79940cf4 4585ff          test    r15d,r15d
                           00007ffb`79940cf7 410f94c0        sete    r8b
                           00007ffb`79940cfb 4c89742420      mov     qword ptr [rsp+20h],r14
                           00007ffb`79940d00 440fb6ce        movzx   r9d,sil
                           00007ffb`79940d04 498bd5          mov     rdx,r13
                           00007ffb`79940d07 8bcb            mov     ecx,ebx
                           00007ffb`79940d09 48ff1570391900  call    qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb8080 (00007ffb`79ad4680)]
                           00007ffb`79940d10 0f1f440000      nop     dword ptr [rax+rax]


+00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE:

                           00007ffb`79940bfa cc              int     3
                           00007ffb`79940bfb cc              int     3
                           00007ffb`79940bfc cc              int     3
                           00007ffb`79940bfd cc              int     3
                           00007ffb`79940bfe cc              int     3
                           00007ffb`79940bff cc              int     3
KERNELBASE!WaitForMultipleObjects:
                           00007ffb`79940c00 4883ec38        sub     rsp,38h
                           00007ffb`79940c04 8364242000      and     dword ptr [rsp+20h],0
                           00007ffb`79940c09 e812000000      call    KERNELBASE!WaitForMultipleObjectsEx (00007ffb`79940c20)
                           00007ffb`79940c0e 4883c438        add     rsp,38h


+0026A966 Far.exe!os::detail::multi_wait(class std::span<void * __ptr64 const,-1>,bool,class std::optional<class std::chrono::duration<__int64,struct std::ratio<1,1000> > >)+0x56 (platform.obj):

                           00007ff6`0699a942 45387908        cmp     byte ptr [r9+8],r15b
                           00007ff6`0699a946 7405            je      Far+0x26a94d (00007ff6`0699a94d)
                           00007ff6`0699a948 4d8b09          mov     r9,qword ptr [r9]
                           00007ff6`0699a94b eb06            jmp     Far+0x26a953 (00007ff6`0699a953)
                           00007ff6`0699a94d 41b9ffffffff    mov     r9d,0FFFFFFFFh
                           00007ff6`0699a953 4c8b32          mov     r14,qword ptr [rdx]
                           00007ff6`0699a956 450fb6c0        movzx   r8d,r8b
                           00007ff6`0699a95a 498bd6          mov     rdx,r14
                           00007ff6`0699a95d 8b4f08          mov     ecx,dword ptr [rdi+8]
                           00007ff6`0699a960 ff15d2591700    call    qword ptr [Far+0x3e0338 (00007ff6`06b10338)]
                           00007ff6`0699a966 488b7f08        mov     rdi,qword ptr [rdi+8]


+0020FBAA Far.exe!GetInputRecordImpl(struct _INPUT_RECORD * __ptr64,bool,bool)+0x43A (keyboard.obj):

                           00007ff6`0693fb74 48c745b802000000 mov     qword ptr [rbp-48h],2
                           00007ff6`0693fb7c 0f2845a0        movaps  xmm0,xmmword ptr [rbp-60h]
                           00007ff6`0693fb80 660f7f442440    movdqa  xmmword ptr [rsp+40h],xmm0
                           00007ff6`0693fb86 0f284db0        movaps  xmm1,xmmword ptr [rbp-50h]
                           00007ff6`0693fb8a 660f7f8da0000000 movdqa  xmmword ptr [rbp+0A0h],xmm1
                           00007ff6`0693fb92 4c8d4c2440      lea     r9,[rsp+40h]
                           00007ff6`0693fb97 4533c0          xor     r8d,r8d
                           00007ff6`0693fb9a 488d95a0000000  lea     rdx,[rbp+0A0h]
                           00007ff6`0693fba1 488d4d50        lea     rcx,[rbp+50h]
                           00007ff6`0693fba5 e866ad0500      call    Far+0x26a910 (00007ff6`0699a910)
                           00007ff6`0693fbaa 0f284d50        movaps  xmm1,xmmword ptr [rbp+50h]


+002106F9 Far.exe!GetInputRecord(struct _INPUT_RECORD * __ptr64,bool,bool)+0x29 (keyboard.obj):

                           00007ff6`069406d3 4883ec78        sub     rsp,78h
                           00007ff6`069406d7 488b05628b2a00  mov     rax,qword ptr [Far+0x4b9240 (00007ff6`06be9240)]
                           00007ff6`069406de 4833c4          xor     rax,rsp
                           00007ff6`069406e1 4889442450      mov     qword ptr [rsp+50h],rax
                           00007ff6`069406e6 0f57c0          xorps   xmm0,xmm0
                           00007ff6`069406e9 33c0            xor     eax,eax
                           00007ff6`069406eb 0f1101          movups  xmmword ptr [rcx],xmm0
                           00007ff6`069406ee 894110          mov     dword ptr [rcx+10h],eax
                           00007ff6`069406f1 488be9          mov     rbp,rcx
                           00007ff6`069406f4 e877f0ffff      call    Far+0x20f770 (00007ff6`0693f770)
                           00007ff6`069406f9 8bf0            mov     esi,eax


+0024208A Far.exe!Manager::ProcessMainLoop(void) __ptr64+0x2A (manager.obj):

                           00007ff6`06972060 4053            push    rbx
                           00007ff6`06972062 4881ec90000000  sub     rsp,90h
                           00007ff6`06972069 488b05d0712700  mov     rax,qword ptr [Far+0x4b9240 (00007ff6`06be9240)]
                           00007ff6`06972070 4833c4          xor     rax,rsp
                           00007ff6`06972073 4889442478      mov     qword ptr [rsp+78h],rax
                           00007ff6`06972078 488bd9          mov     rbx,rcx
                           00007ff6`0697207b 4533c0          xor     r8d,r8d
                           00007ff6`0697207e 488d4c2460      lea     rcx,[rsp+60h]
                           00007ff6`06972083 33d2            xor     edx,edx
                           00007ff6`06972085 e846e6fcff      call    Far+0x2106d0 (00007ff6`069406d0)
                           00007ff6`0697208a 807b2000        cmp     byte ptr [rbx+20h],0


+00242031 Far.exe!Manager::EnterMainLoop(void) __ptr64+0xC1 (manager.obj):

                           00007ff6`06972010 4084ed          test    bpl,bpl
                           00007ff6`06972013 742e            je      Far+0x242043 (00007ff6`06972043)
                           00007ff6`06972015 488b4308        mov     rax,qword ptr [rbx+8]
                           00007ff6`06972019 482b03          sub     rax,qword ptr [rbx]
                           00007ff6`0697201c 4883f810        cmp     rax,10h
                           00007ff6`06972020 7507            jne     Far+0x242029 (00007ff6`06972029)
                           00007ff6`06972022 48837b5000      cmp     qword ptr [rbx+50h],0
                           00007ff6`06972027 741a            je      Far+0x242043 (00007ff6`06972043)
                           00007ff6`06972029 488bcb          mov     rcx,rbx
                           00007ff6`0697202c e82f000000      call    Far+0x242060 (00007ff6`06972060)
                           00007ff6`06972031 488bcb          mov     rcx,rbx


+00239231 Far.exe!MainProcess(class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,class std::basic_string_view<wchar_t,struct std::char_traits<wchar_t> >,int,int)+0x1621 (main.obj):

                           00007ff6`06969209 ff10            call    qword ptr [rax]
                           00007ff6`0696920b f00fc1770c      lock xadd dword ptr [rdi+0Ch],esi
                           00007ff6`06969210 83fe01          cmp     esi,1
                           00007ff6`06969213 7509            jne     Far+0x23921e (00007ff6`0696921e)
                           00007ff6`06969215 488b07          mov     rax,qword ptr [rdi]
                           00007ff6`06969218 488bcf          mov     rcx,rdi
                           00007ff6`0696921b ff5008          call    qword ptr [rax+8]
                           00007ff6`0696921e 488b0de30e2c00  mov     rcx,qword ptr [Far+0x4fa108 (00007ff6`06c2a108)]
                           00007ff6`06969225 488b8940010000  mov     rcx,qword ptr [rcx+140h]
                           00007ff6`0696922c e83f8d0000      call    Far+0x241f70 (00007ff6`06971f70)
                           00007ff6`06969231 e8eaf30f00      call    Far+0x338620 (00007ff6`06a68620)


+0023DC2C Far.exe!`mainImpl(class std::span<wchar_t const * __ptr64 const,-1>)'::`2'::<lambda_5>::operator()(void)const __ptr64+0xEC (main.obj):

                           00007ff6`0696dbef 660f7f442470    movdqa  xmmword ptr [rsp+70h],xmm0
                           00007ff6`0696dbf5 0f288c2480000000 movaps  xmm1,xmmword ptr [rsp+80h]
                           00007ff6`0696dbfd 660f7f8c2480000000 movdqa xmmword ptr [rsp+80h],xmm1
                           00007ff6`0696dc06 44894c2428      mov     dword ptr [rsp+28h],r9d
                           00007ff6`0696dc0b 4489542420      mov     dword ptr [rsp+20h],r10d
                           00007ff6`0696dc10 4c8d4c2450      lea     r9,[rsp+50h]
                           00007ff6`0696dc15 4c8d442460      lea     r8,[rsp+60h]
                           00007ff6`0696dc1a 488d542470      lea     rdx,[rsp+70h]
                           00007ff6`0696dc1f 488d8c2480000000 lea     rcx,[rsp+80h]
                           00007ff6`0696dc27 e8e49fffff      call    Far+0x237c10 (00007ff6`06967c10)
                           00007ff6`0696dc2c eb05            jmp     Far+0x23dc33 (00007ff6`0696dc33)


======================================================================

Thread 24912 / 0x6150

======================================================================

LastError: 0x00000000 - The operation completed successfully.

NTSTATUS:  0x00000000 - STATUS_SUCCESS



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14

+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 00000000000001D5

RBX = 000001DFD1A09D50

RCX = 0000000000000088

RDX = 000001DFD1A099D0

RSI = 000001DFD1A05B50

RDI = 000001DFD1A09D50

R8  = 0000000EDD0FEF20

R9  = 00000000000000FF

R10 = 000000000000006C

R11 = 0000000EDD0FED20

R12 = 0000000000000000

R13 = 0000000000000000

R14 = 0000000000000000

R15 = 0000000000000000

RIP = 00007FFB7BE110A4

RSP = 0000000EDD0FF7B8

RBP = 0000000000000000

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14:

                           00007ffb`7be11084 c3              ret
                           00007ffb`7be11085 cd2e            int     2Eh
                           00007ffb`7be11087 c3              ret
                           00007ffb`7be11088 0f1f840000000000 nop     dword ptr [rax+rax]
ntdll!ZwWaitForWorkViaWorkerFactory:
                           00007ffb`7be11090 4c8bd1          mov     r10,rcx
                           00007ffb`7be11093 b8d5010000      mov     eax,1D5h
                           00007ffb`7be11098 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`7be110a0 7503            jne     ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5)
                           00007ffb`7be110a2 0f05            syscall
                           00007ffb`7be110a4 c3              ret


+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747:

                           00007ffb`7bdbd3d0 4889442468      mov     qword ptr [rsp+68h],rax
                           00007ffb`7bdbd3d5 44896c2448      mov     dword ptr [rsp+48h],r13d
                           00007ffb`7bdbd3da 488b4e38        mov     rcx,qword ptr [rsi+38h]
                           00007ffb`7bdbd3de 48898c24c8000000 mov     qword ptr [rsp+0C8h],rcx
                           00007ffb`7bdbd3e6 488d842448020000 lea     rax,[rsp+248h]
                           00007ffb`7bdbd3ee 4889442420      mov     qword ptr [rsp+20h],rax
                           00007ffb`7bdbd3f3 4c8d4c2448      lea     r9,[rsp+48h]
                           00007ffb`7bdbd3f8 448b442444      mov     r8d,dword ptr [rsp+44h]
                           00007ffb`7bdbd3fd 488b542468      mov     rdx,qword ptr [rsp+68h]
                           00007ffb`7bdbd402 e8893c0500      call    ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090)
                           00007ffb`7bdbd407 8bc8            mov     ecx,eax


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Thread 18560 / 0x4880

======================================================================

LastError: 0x00000000 - The operation completed successfully.

NTSTATUS:  0x00000000 - STATUS_SUCCESS



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14

+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 00000000000001D5

RBX = 000001DFD1A0D8F0

RCX = 0000000000000088

RDX = 000001DFD1A0D570

RSI = 000001DFD1A05B50

RDI = 000001DFD1A0D8F0

R8  = 000001DFD50EB044

R9  = 00000000FFFFFFFF

R10 = 000001DFD50EB044

R11 = 0000000000000004

R12 = 0000000000000000

R13 = 0000000000000000

R14 = 0000000000000000

R15 = 0000000000000000

RIP = 00007FFB7BE110A4

RSP = 0000000EDD1FF588

RBP = 0000000000000000

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14:

                           00007ffb`7be11084 c3              ret
                           00007ffb`7be11085 cd2e            int     2Eh
                           00007ffb`7be11087 c3              ret
                           00007ffb`7be11088 0f1f840000000000 nop     dword ptr [rax+rax]
ntdll!ZwWaitForWorkViaWorkerFactory:
                           00007ffb`7be11090 4c8bd1          mov     r10,rcx
                           00007ffb`7be11093 b8d5010000      mov     eax,1D5h
                           00007ffb`7be11098 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`7be110a0 7503            jne     ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5)
                           00007ffb`7be110a2 0f05            syscall
                           00007ffb`7be110a4 c3              ret


+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747:

                           00007ffb`7bdbd3d0 4889442468      mov     qword ptr [rsp+68h],rax
                           00007ffb`7bdbd3d5 44896c2448      mov     dword ptr [rsp+48h],r13d
                           00007ffb`7bdbd3da 488b4e38        mov     rcx,qword ptr [rsi+38h]
                           00007ffb`7bdbd3de 48898c24c8000000 mov     qword ptr [rsp+0C8h],rcx
                           00007ffb`7bdbd3e6 488d842448020000 lea     rax,[rsp+248h]
                           00007ffb`7bdbd3ee 4889442420      mov     qword ptr [rsp+20h],rax
                           00007ffb`7bdbd3f3 4c8d4c2448      lea     r9,[rsp+48h]
                           00007ffb`7bdbd3f8 448b442444      mov     r8d,dword ptr [rsp+44h]
                           00007ffb`7bdbd3fd 488b542468      mov     rdx,qword ptr [rsp+68h]
                           00007ffb`7bdbd402 e8893c0500      call    ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090)
                           00007ffb`7bdbd407 8bc8            mov     ecx,eax


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Thread 5968 / 0x1750

======================================================================

LastError: 0x00000000 - The operation completed successfully.

NTSTATUS:  0x00000000 - STATUS_SUCCESS



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14

+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 00000000000001D5

RBX = 000001DFD1A0DD30

RCX = 0000000000000088

RDX = 000001DFD1A0D9B0

RSI = 000001DFD1A05B50

RDI = 000001DFD1A0DD30

R8  = 0000000000000008

R9  = 0000000000000004

R10 = 0000000000000000

R11 = 00000000FFFFFFFF

R12 = 0000000000000000

R13 = 0000000000000000

R14 = 0000000000000000

R15 = 0000000000000000

RIP = 00007FFB7BE110A4

RSP = 0000000EDD2FFAA8

RBP = 0000000000000000

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14:

                           00007ffb`7be11084 c3              ret
                           00007ffb`7be11085 cd2e            int     2Eh
                           00007ffb`7be11087 c3              ret
                           00007ffb`7be11088 0f1f840000000000 nop     dword ptr [rax+rax]
ntdll!ZwWaitForWorkViaWorkerFactory:
                           00007ffb`7be11090 4c8bd1          mov     r10,rcx
                           00007ffb`7be11093 b8d5010000      mov     eax,1D5h
                           00007ffb`7be11098 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`7be110a0 7503            jne     ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5)
                           00007ffb`7be110a2 0f05            syscall
                           00007ffb`7be110a4 c3              ret


+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747:

                           00007ffb`7bdbd3d0 4889442468      mov     qword ptr [rsp+68h],rax
                           00007ffb`7bdbd3d5 44896c2448      mov     dword ptr [rsp+48h],r13d
                           00007ffb`7bdbd3da 488b4e38        mov     rcx,qword ptr [rsi+38h]
                           00007ffb`7bdbd3de 48898c24c8000000 mov     qword ptr [rsp+0C8h],rcx
                           00007ffb`7bdbd3e6 488d842448020000 lea     rax,[rsp+248h]
                           00007ffb`7bdbd3ee 4889442420      mov     qword ptr [rsp+20h],rax
                           00007ffb`7bdbd3f3 4c8d4c2448      lea     r9,[rsp+48h]
                           00007ffb`7bdbd3f8 448b442444      mov     r8d,dword ptr [rsp+44h]
                           00007ffb`7bdbd3fd 488b542468      mov     rdx,qword ptr [rsp+68h]
                           00007ffb`7bdbd402 e8893c0500      call    ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090)
                           00007ffb`7bdbd407 8bc8            mov     ecx,eax


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Thread 18180 / 0x4704 (Window messages processor)

======================================================================

LastError: 0x00000000 - The operation completed successfully.

NTSTATUS:  0xC0000047 - An attempt was made to release a semaphore such that its maximum count would have been exceeded.



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+00001104 win32u.dll!NtUserGetMessage+0x14

+0002210E USER32.dll!GetMessageW+0x2E

+0036EAF2 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x572 (wm_listener.obj)

+0036F69B Far.exe!os::concurrency::thread::wrapper<class `os::concurrency::thread::thread<void (__cdecl wm_listener::*)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64,class std::reference_wrapper<class os::concurrency::event> >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper<class os::concurrency::event> && __ptr64) __ptr64'::`2'::<lambda_1> >(void * __ptr64)+0x1B (wm_listener.obj)

+00390B6E Far.exe!thread_start<unsigned int (__cdecl*)(void * __ptr64),1>(void * __ptr64 const)+0x5A (libucrt:thread.obj)

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 0000000000001006

RBX = 0000000EDD3FE600

RCX = 0000000EDD3FE600

RDX = 0000000000000000

RSI = 0000000EDCD8EBD0

RDI = 000001DFD1A7D350

R8  = 0000000EDD3FE3C8

R9  = 0000000EDD3FE5E0

R10 = 0000000000000000

R11 = 0000000000000246

R12 = 00007FF60673A610

R13 = 0000000000000000

R14 = 00007FF606B7F290

R15 = 00007FF60673DF50

RIP = 00007FFB793F1104

RSP = 0000000EDD3FE478

RBP = 0000000EDD3FE5E0

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+00001104 win32u.dll!NtUserGetMessage+0x14:

                           00007ffb`793f10e4 c3              ret
                           00007ffb`793f10e5 cd2e            int     2Eh
                           00007ffb`793f10e7 c3              ret
                           00007ffb`793f10e8 0f1f840000000000 nop     dword ptr [rax+rax]
win32u!NtUserGetMessage:
                           00007ffb`793f10f0 4c8bd1          mov     r10,rcx
                           00007ffb`793f10f3 b806100000      mov     eax,1006h
                           00007ffb`793f10f8 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`793f1100 7503            jne     win32u!NtUserGetMessage+0x15 (00007ffb`793f1105)
                           00007ffb`793f1102 0f05            syscall
                           00007ffb`793f1104 c3              ret


+0002210E USER32.dll!GetMessageW+0x2E:

                           00007ffb`7b1f20e2 4883ec50        sub     rsp,50h
                           00007ffb`7b1f20e6 418bc1          mov     eax,r9d
                           00007ffb`7b1f20e9 488bd9          mov     rbx,rcx
                           00007ffb`7b1f20ec 458bc8          mov     r9d,r8d
                           00007ffb`7b1f20ef 440bc8          or      r9d,eax
                           00007ffb`7b1f20f2 41f7c10000feff  test    r9d,0FFFE0000h
                           00007ffb`7b1f20f9 0f85b11d0200    jne     USER32!SetWindowsHookExAW+0xd980 (00007ffb`7b213eb0)
                           00007ffb`7b1f20ff 448bc8          mov     r9d,eax
                           00007ffb`7b1f2102 48897c2460      mov     qword ptr [rsp+60h],rdi
                           00007ffb`7b1f2107 48ff1502ea0600  call    qword ptr [USER32!gapfnScSendMessage+0x11b0 (00007ffb`7b260b10)]
                           00007ffb`7b1f210e 0f1f440000      nop     dword ptr [rax+rax]


+0036EAF2 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x572 (wm_listener.obj):

                           00007ff6`06a9eac3 4c8d35c6070e00  lea     r14,[Far+0x44f290 (00007ff6`06b7f290)]
                           00007ff6`06a9eaca 4c8d3d7ff4c9ff  lea     r15,[Far+0xdf50 (00007ff6`0673df50)]
                           00007ff6`06a9ead1 4c8d2538bbc9ff  lea     r12,[Far+0xa610 (00007ff6`0673a610)]
                           00007ff6`06a9ead8 84c0            test    al,al
                           00007ff6`06a9eada 0f8532020000    jne     Far+0x36ed12 (00007ff6`06a9ed12)
                           00007ff6`06a9eae0 4533c9          xor     r9d,r9d
                           00007ff6`06a9eae3 4533c0          xor     r8d,r8d
                           00007ff6`06a9eae6 33d2            xor     edx,edx
                           00007ff6`06a9eae8 488d4d20        lea     rcx,[rbp+20h]
                           00007ff6`06a9eaec ff15a6200700    call    qword ptr [Far+0x3e0b98 (00007ff6`06b10b98)]
                           00007ff6`06a9eaf2 85c0            test    eax,eax


+0036F69B Far.exe!os::concurrency::thread::wrapper<class `os::concurrency::thread::thread<void (__cdecl wm_listener::*)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64,class std::reference_wrapper<class os::concurrency::event> >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper<class os::concurrency::event> && __ptr64) __ptr64'::`2'::<lambda_1> >(void * __ptr64)+0x1B (wm_listener.obj):

                           00007ff6`06a9f67e 5e              pop     rsi
                           00007ff6`06a9f67f c3              ret
                           00007ff6`06a9f680 4053            push    rbx
                           00007ff6`06a9f682 4883ec20        sub     rsp,20h
                           00007ff6`06a9f686 488bd9          mov     rbx,rcx
                           00007ff6`06a9f689 48894c2430      mov     qword ptr [rsp+30h],rcx
                           00007ff6`06a9f68e 488b01          mov     rax,qword ptr [rcx]
                           00007ff6`06a9f691 488b5108        mov     rdx,qword ptr [rcx+8]
                           00007ff6`06a9f695 488b4910        mov     rcx,qword ptr [rcx+10h]
                           00007ff6`06a9f699 ffd0            call    rax
                           00007ff6`06a9f69b 90              nop


+00390B6E Far.exe!thread_start<unsigned int (__cdecl*)(void * __ptr64),1>(void * __ptr64 const)+0x5A (libucrt:thread.obj):

                           00007ff6`06ac0b45 7510            jne     Far+0x390b57 (00007ff6`06ac0b57)
                           00007ff6`06ac0b47 8d48ff          lea     ecx,[rax-1]
                           00007ff6`06ac0b4a e8d1200100      call    Far+0x3a2c20 (00007ff6`06ad2c20)
                           00007ff6`06ac0b4f 85c0            test    eax,eax
                           00007ff6`06ac0b51 0f94c0          sete    al
                           00007ff6`06ac0b54 884320          mov     byte ptr [rbx+20h],al
                           00007ff6`06ac0b57 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h
                           00007ff6`06ac0b61 488b4b08        mov     rcx,qword ptr [rbx+8]
                           00007ff6`06ac0b65 488b03          mov     rax,qword ptr [rbx]
                           00007ff6`06ac0b68 ff1512030500    call    qword ptr [Far+0x3e0e80 (00007ff6`06b10e80)]
                           00007ff6`06ac0b6e 8bc8            mov     ecx,eax


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Thread 16568 / 0x40B8 (FS watcher)

======================================================================

LastError: 0x00000057 - The parameter is incorrect.

NTSTATUS:  0xC000000D - An invalid parameter was passed to a service or function.



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14

+00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0

+00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE

+0026A966 Far.exe!os::detail::multi_wait(class std::span<void * __ptr64 const,-1>,bool,class std::optional<class std::chrono::duration<__int64,struct std::ratio<1,1000> > >)+0x56 (platform.obj)

+001A2F70 Far.exe!background_watcher::process(void) __ptr64+0x2B0 (filesystemwatcher.obj)

+001A5104 Far.exe!os::concurrency::thread::wrapper<class `os::concurrency::thread::thread<void (__cdecl background_searcher::*)(void) __ptr64,class background_searcher * __ptr64>(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2'::<lambda_1> >(void * __ptr64)+0x14 (findfile.obj)

+00390B6E Far.exe!thread_start<unsigned int (__cdecl*)(void * __ptr64),1>(void * __ptr64 const)+0x5A (libucrt:thread.obj)

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 000000000000005B

RBX = 0000000000000003

RCX = 0000000000000003

RDX = 000001DFD1AF2BE0

RSI = 0000000000000000

RDI = 0000000000000003

R8  = 0000000000000000

R9  = 0000000EDD4FF970

R10 = 9E0C2E5B32D12870

R11 = 0000000000000000

R12 = 00000000FFFFFFFF

R13 = 000001DFD1AF2BE0

R14 = 0000000000000000

R15 = 0000000000000000

RIP = 00007FFB7BE0E164

RSP = 0000000EDD4FEB08

RBP = 0000000EDD4FEF40

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14:

                           00007ffb`7be0e13d 0000            add     byte ptr [rax],al
                           00007ffb`7be0e13f 00e9            add     cl,ch
                           00007ffb`7be0e141 6b8efdff666666  imul    ecx,dword ptr [rsi+6666FFFDh],66h
                           00007ffb`7be0e148 0f1f840000000000 nop     dword ptr [rax+rax]
ntdll!NtWaitForMultipleObjects:
                           00007ffb`7be0e150 4c8bd1          mov     r10,rcx
                           00007ffb`7be0e153 b85b000000      mov     eax,5Bh
                           00007ffb`7be0e158 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`7be0e160 7503            jne     ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`7be0e165)
                           00007ffb`7be0e162 0f05            syscall
                           00007ffb`7be0e164 c3              ret


+00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0:

                           00007ffb`79940ce7 4c8d742450      lea     r14,[rsp+50h]
                           00007ffb`79940cec 448b7c2444      mov     r15d,dword ptr [rsp+44h]
                           00007ffb`79940cf1 4533c0          xor     r8d,r8d
                           00007ffb`79940cf4 4585ff          test    r15d,r15d
                           00007ffb`79940cf7 410f94c0        sete    r8b
                           00007ffb`79940cfb 4c89742420      mov     qword ptr [rsp+20h],r14
                           00007ffb`79940d00 440fb6ce        movzx   r9d,sil
                           00007ffb`79940d04 498bd5          mov     rdx,r13
                           00007ffb`79940d07 8bcb            mov     ecx,ebx
                           00007ffb`79940d09 48ff1570391900  call    qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb8080 (00007ffb`79ad4680)]
                           00007ffb`79940d10 0f1f440000      nop     dword ptr [rax+rax]


+00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE:

                           00007ffb`79940bfa cc              int     3
                           00007ffb`79940bfb cc              int     3
                           00007ffb`79940bfc cc              int     3
                           00007ffb`79940bfd cc              int     3
                           00007ffb`79940bfe cc              int     3
                           00007ffb`79940bff cc              int     3
KERNELBASE!WaitForMultipleObjects:
                           00007ffb`79940c00 4883ec38        sub     rsp,38h
                           00007ffb`79940c04 8364242000      and     dword ptr [rsp+20h],0
                           00007ffb`79940c09 e812000000      call    KERNELBASE!WaitForMultipleObjectsEx (00007ffb`79940c20)
                           00007ffb`79940c0e 4883c438        add     rsp,38h


+0026A966 Far.exe!os::detail::multi_wait(class std::span<void * __ptr64 const,-1>,bool,class std::optional<class std::chrono::duration<__int64,struct std::ratio<1,1000> > >)+0x56 (platform.obj):

                           00007ff6`0699a942 45387908        cmp     byte ptr [r9+8],r15b
                           00007ff6`0699a946 7405            je      Far+0x26a94d (00007ff6`0699a94d)
                           00007ff6`0699a948 4d8b09          mov     r9,qword ptr [r9]
                           00007ff6`0699a94b eb06            jmp     Far+0x26a953 (00007ff6`0699a953)
                           00007ff6`0699a94d 41b9ffffffff    mov     r9d,0FFFFFFFFh
                           00007ff6`0699a953 4c8b32          mov     r14,qword ptr [rdx]
                           00007ff6`0699a956 450fb6c0        movzx   r8d,r8b
                           00007ff6`0699a95a 498bd6          mov     rdx,r14
                           00007ff6`0699a95d 8b4f08          mov     ecx,dword ptr [rdi+8]
                           00007ff6`0699a960 ff15d2591700    call    qword ptr [Far+0x3e0338 (00007ff6`06b10338)]
                           00007ff6`0699a966 488b7f08        mov     rdi,qword ptr [rdi+8]


+001A2F70 Far.exe!background_watcher::process(void) __ptr64+0x2B0 (filesystemwatcher.obj):

                           00007ff6`068d2f44 48894dd8        mov     qword ptr [rbp-28h],rcx
                           00007ff6`068d2f48 0f2845f0        movaps  xmm0,xmmword ptr [rbp-10h]
                           00007ff6`068d2f4c 660f7f4580      movdqa  xmmword ptr [rbp-80h],xmm0
                           00007ff6`068d2f51 0f284dd0        movaps  xmm1,xmmword ptr [rbp-30h]
                           00007ff6`068d2f55 660f7f4c2450    movdqa  xmmword ptr [rsp+50h],xmm1
                           00007ff6`068d2f5b 4c8d4d80        lea     r9,[rbp-80h]
                           00007ff6`068d2f5f 4533c0          xor     r8d,r8d
                           00007ff6`068d2f62 488d542450      lea     rdx,[rsp+50h]
                           00007ff6`068d2f67 488d4da0        lea     rcx,[rbp-60h]
                           00007ff6`068d2f6b e8a0790c00      call    Far+0x26a910 (00007ff6`0699a910)
                           00007ff6`068d2f70 4c8b38          mov     r15,qword ptr [rax]


+001A5104 Far.exe!os::concurrency::thread::wrapper<class `os::concurrency::thread::thread<void (__cdecl background_searcher::*)(void) __ptr64,class background_searcher * __ptr64>(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2'::<lambda_1> >(void * __ptr64)+0x14 (findfile.obj):

                           00007ff6`068d50ec cc              int     3
                           00007ff6`068d50ed cc              int     3
                           00007ff6`068d50ee cc              int     3
                           00007ff6`068d50ef cc              int     3
                           00007ff6`068d50f0 4053            push    rbx
                           00007ff6`068d50f2 4883ec20        sub     rsp,20h
                           00007ff6`068d50f6 488bd9          mov     rbx,rcx
                           00007ff6`068d50f9 48894c2430      mov     qword ptr [rsp+30h],rcx
                           00007ff6`068d50fe 488b4908        mov     rcx,qword ptr [rcx+8]
                           00007ff6`068d5102 ff13            call    qword ptr [rbx]
                           00007ff6`068d5104 90              nop


+00390B6E Far.exe!thread_start<unsigned int (__cdecl*)(void * __ptr64),1>(void * __ptr64 const)+0x5A (libucrt:thread.obj):

                           00007ff6`06ac0b45 7510            jne     Far+0x390b57 (00007ff6`06ac0b57)
                           00007ff6`06ac0b47 8d48ff          lea     ecx,[rax-1]
                           00007ff6`06ac0b4a e8d1200100      call    Far+0x3a2c20 (00007ff6`06ad2c20)
                           00007ff6`06ac0b4f 85c0            test    eax,eax
                           00007ff6`06ac0b51 0f94c0          sete    al
                           00007ff6`06ac0b54 884320          mov     byte ptr [rbx+20h],al
                           00007ff6`06ac0b57 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h
                           00007ff6`06ac0b61 488b4b08        mov     rcx,qword ptr [rbx+8]
                           00007ff6`06ac0b65 488b03          mov     rax,qword ptr [rbx]
                           00007ff6`06ac0b68 ff1512030500    call    qword ptr [Far+0x3e0e80 (00007ff6`06b10e80)]
                           00007ff6`06ac0b6e 8bc8            mov     ecx,eax


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Thread 17136 / 0x42F0 (Taskbar processor)

======================================================================

LastError: 0x00000000 - The operation completed successfully.

NTSTATUS:  0xC0000034 - Object Name not found.



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14

+00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0

+00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE

+0026A966 Far.exe!os::detail::multi_wait(class std::span<void * __ptr64 const,-1>,bool,class std::optional<class std::chrono::duration<__int64,struct std::ratio<1,1000> > >)+0x56 (platform.obj)

+0032DE70 Far.exe!taskbar_impl::handler(void)const __ptr64+0x360 (taskbar.obj)

+001A5104 Far.exe!os::concurrency::thread::wrapper<class `os::concurrency::thread::thread<void (__cdecl background_searcher::*)(void) __ptr64,class background_searcher * __ptr64>(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2'::<lambda_1> >(void * __ptr64)+0x14 (findfile.obj)

+00390B6E Far.exe!thread_start<unsigned int (__cdecl*)(void * __ptr64),1>(void * __ptr64 const)+0x5A (libucrt:thread.obj)

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 000000000000005B

RBX = 0000000000000003

RCX = 0000000000000003

RDX = 0000000EDD5FECC0

RSI = 0000000000000000

RDI = 0000000000000003

R8  = 00000000000042F0

R9  = 0000000EDD5FDD38

R10 = 0000000000000000

R11 = 00007FFB7A6C0A80

R12 = 00000000FFFFFFFF

R13 = 0000000EDD5FECC0

R14 = 0000000000000000

R15 = 0000000000000000

RIP = 00007FFB7BE0E164

RSP = 0000000EDD5FE278

RBP = 0000000EDD5FE6B0

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14:

                           00007ffb`7be0e13d 0000            add     byte ptr [rax],al
                           00007ffb`7be0e13f 00e9            add     cl,ch
                           00007ffb`7be0e141 6b8efdff666666  imul    ecx,dword ptr [rsi+6666FFFDh],66h
                           00007ffb`7be0e148 0f1f840000000000 nop     dword ptr [rax+rax]
ntdll!NtWaitForMultipleObjects:
                           00007ffb`7be0e150 4c8bd1          mov     r10,rcx
                           00007ffb`7be0e153 b85b000000      mov     eax,5Bh
                           00007ffb`7be0e158 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`7be0e160 7503            jne     ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`7be0e165)
                           00007ffb`7be0e162 0f05            syscall
                           00007ffb`7be0e164 c3              ret


+00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0:

                           00007ffb`79940ce7 4c8d742450      lea     r14,[rsp+50h]
                           00007ffb`79940cec 448b7c2444      mov     r15d,dword ptr [rsp+44h]
                           00007ffb`79940cf1 4533c0          xor     r8d,r8d
                           00007ffb`79940cf4 4585ff          test    r15d,r15d
                           00007ffb`79940cf7 410f94c0        sete    r8b
                           00007ffb`79940cfb 4c89742420      mov     qword ptr [rsp+20h],r14
                           00007ffb`79940d00 440fb6ce        movzx   r9d,sil
                           00007ffb`79940d04 498bd5          mov     rdx,r13
                           00007ffb`79940d07 8bcb            mov     ecx,ebx
                           00007ffb`79940d09 48ff1570391900  call    qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb8080 (00007ffb`79ad4680)]
                           00007ffb`79940d10 0f1f440000      nop     dword ptr [rax+rax]


+00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE:

                           00007ffb`79940bfa cc              int     3
                           00007ffb`79940bfb cc              int     3
                           00007ffb`79940bfc cc              int     3
                           00007ffb`79940bfd cc              int     3
                           00007ffb`79940bfe cc              int     3
                           00007ffb`79940bff cc              int     3
KERNELBASE!WaitForMultipleObjects:
                           00007ffb`79940c00 4883ec38        sub     rsp,38h
                           00007ffb`79940c04 8364242000      and     dword ptr [rsp+20h],0
                           00007ffb`79940c09 e812000000      call    KERNELBASE!WaitForMultipleObjectsEx (00007ffb`79940c20)
                           00007ffb`79940c0e 4883c438        add     rsp,38h


+0026A966 Far.exe!os::detail::multi_wait(class std::span<void * __ptr64 const,-1>,bool,class std::optional<class std::chrono::duration<__int64,struct std::ratio<1,1000> > >)+0x56 (platform.obj):

                           00007ff6`0699a942 45387908        cmp     byte ptr [r9+8],r15b
                           00007ff6`0699a946 7405            je      Far+0x26a94d (00007ff6`0699a94d)
                           00007ff6`0699a948 4d8b09          mov     r9,qword ptr [r9]
                           00007ff6`0699a94b eb06            jmp     Far+0x26a953 (00007ff6`0699a953)
                           00007ff6`0699a94d 41b9ffffffff    mov     r9d,0FFFFFFFFh
                           00007ff6`0699a953 4c8b32          mov     r14,qword ptr [rdx]
                           00007ff6`0699a956 450fb6c0        movzx   r8d,r8b
                           00007ff6`0699a95a 498bd6          mov     rdx,r14
                           00007ff6`0699a95d 8b4f08          mov     ecx,dword ptr [rdi+8]
                           00007ff6`0699a960 ff15d2591700    call    qword ptr [Far+0x3e0338 (00007ff6`06b10338)]
                           00007ff6`0699a966 488b7f08        mov     rdi,qword ptr [rdi+8]


+0032DE70 Far.exe!taskbar_impl::handler(void)const __ptr64+0x360 (taskbar.obj):

                           00007ff6`06a5de44 48894540        mov     qword ptr [rbp+40h],rax
                           00007ff6`06a5de48 c6450800        mov     byte ptr [rbp+8],0
                           00007ff6`06a5de4c 0f284500        movaps  xmm0,xmmword ptr [rbp]
                           00007ff6`06a5de50 660f7f442470    movdqa  xmmword ptr [rsp+70h],xmm0
                           00007ff6`06a5de56 660f7f7550      movdqa  xmmword ptr [rbp+50h],xmm6
                           00007ff6`06a5de5b 4c8d4c2470      lea     r9,[rsp+70h]
                           00007ff6`06a5de60 4533c0          xor     r8d,r8d
                           00007ff6`06a5de63 488d5550        lea     rdx,[rbp+50h]
                           00007ff6`06a5de67 488d4dc8        lea     rcx,[rbp-38h]
                           00007ff6`06a5de6b e8a0caf3ff      call    Far+0x26a910 (00007ff6`0699a910)
                           00007ff6`06a5de70 488b08          mov     rcx,qword ptr [rax]


+001A5104 Far.exe!os::concurrency::thread::wrapper<class `os::concurrency::thread::thread<void (__cdecl background_searcher::*)(void) __ptr64,class background_searcher * __ptr64>(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2'::<lambda_1> >(void * __ptr64)+0x14 (findfile.obj):

                           00007ff6`068d50ec cc              int     3
                           00007ff6`068d50ed cc              int     3
                           00007ff6`068d50ee cc              int     3
                           00007ff6`068d50ef cc              int     3
                           00007ff6`068d50f0 4053            push    rbx
                           00007ff6`068d50f2 4883ec20        sub     rsp,20h
                           00007ff6`068d50f6 488bd9          mov     rbx,rcx
                           00007ff6`068d50f9 48894c2430      mov     qword ptr [rsp+30h],rcx
                           00007ff6`068d50fe 488b4908        mov     rcx,qword ptr [rcx+8]
                           00007ff6`068d5102 ff13            call    qword ptr [rbx]
                           00007ff6`068d5104 90              nop


+00390B6E Far.exe!thread_start<unsigned int (__cdecl*)(void * __ptr64),1>(void * __ptr64 const)+0x5A (libucrt:thread.obj):

                           00007ff6`06ac0b45 7510            jne     Far+0x390b57 (00007ff6`06ac0b57)
                           00007ff6`06ac0b47 8d48ff          lea     ecx,[rax-1]
                           00007ff6`06ac0b4a e8d1200100      call    Far+0x3a2c20 (00007ff6`06ad2c20)
                           00007ff6`06ac0b4f 85c0            test    eax,eax
                           00007ff6`06ac0b51 0f94c0          sete    al
                           00007ff6`06ac0b54 884320          mov     byte ptr [rbx+20h],al
                           00007ff6`06ac0b57 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h
                           00007ff6`06ac0b61 488b4b08        mov     rcx,qword ptr [rbx+8]
                           00007ff6`06ac0b65 488b03          mov     rax,qword ptr [rbx]
                           00007ff6`06ac0b68 ff1512030500    call    qword ptr [Far+0x3e0e80 (00007ff6`06b10e80)]
                           00007ff6`06ac0b6e 8bc8            mov     ecx,eax


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Thread 5984 / 0x1760

======================================================================

LastError: 0x00000000 - The operation completed successfully.

NTSTATUS:  0xC000000D - An invalid parameter was passed to a service or function.



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14

+00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0

+000D08A6 combase.dll!CoRevokeInitializeSpy+0xE16

+000D0720 combase.dll!CoRevokeInitializeSpy+0xC90

+000D0530 combase.dll!CoRevokeInitializeSpy+0xAA0

+000D04B9 combase.dll!CoRevokeInitializeSpy+0xA29

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 000000000000005B

RBX = 0000000000000001

RCX = 0000000000000001

RDX = 0000000EDD6FFA00

RSI = 0000000000000000

RDI = 0000000000000001

R8  = 000001DFD1AF5190

R9  = 00007FFB7B690490

R10 = 0000000000000000

R11 = 0000000000000000

R12 = 00000000FFFFFFFF

R13 = 0000000EDD6FFA00

R14 = 0000000000000000

R15 = 0000000000000000

RIP = 00007FFB7BE0E164

RSP = 0000000EDD6FF6B8

RBP = 00000000000003A0

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14:

                           00007ffb`7be0e13d 0000            add     byte ptr [rax],al
                           00007ffb`7be0e13f 00e9            add     cl,ch
                           00007ffb`7be0e141 6b8efdff666666  imul    ecx,dword ptr [rsi+6666FFFDh],66h
                           00007ffb`7be0e148 0f1f840000000000 nop     dword ptr [rax+rax]
ntdll!NtWaitForMultipleObjects:
                           00007ffb`7be0e150 4c8bd1          mov     r10,rcx
                           00007ffb`7be0e153 b85b000000      mov     eax,5Bh
                           00007ffb`7be0e158 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`7be0e160 7503            jne     ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`7be0e165)
                           00007ffb`7be0e162 0f05            syscall
                           00007ffb`7be0e164 c3              ret


+00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0:

                           00007ffb`79940ce7 4c8d742450      lea     r14,[rsp+50h]
                           00007ffb`79940cec 448b7c2444      mov     r15d,dword ptr [rsp+44h]
                           00007ffb`79940cf1 4533c0          xor     r8d,r8d
                           00007ffb`79940cf4 4585ff          test    r15d,r15d
                           00007ffb`79940cf7 410f94c0        sete    r8b
                           00007ffb`79940cfb 4c89742420      mov     qword ptr [rsp+20h],r14
                           00007ffb`79940d00 440fb6ce        movzx   r9d,sil
                           00007ffb`79940d04 498bd5          mov     rdx,r13
                           00007ffb`79940d07 8bcb            mov     ecx,ebx
                           00007ffb`79940d09 48ff1570391900  call    qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb8080 (00007ffb`79ad4680)]
                           00007ffb`79940d10 0f1f440000      nop     dword ptr [rax+rax]


+000D08A6 combase.dll!CoRevokeInitializeSpy+0xE16:

                           00007ffb`7b69087c 85ff            test    edi,edi
                           00007ffb`7b69087e 7559            jne     combase!CoRevokeInitializeSpy+0xe49 (00007ffb`7b6908d9)
                           00007ffb`7b690880 8b9424b8020000  mov     edx,dword ptr [rsp+2B8h]
                           00007ffb`7b690887 8d4f01          lea     ecx,[rdi+1]
                           00007ffb`7b69088a 89542420        mov     dword ptr [rsp+20h],edx
                           00007ffb`7b69088e 4183c9ff        or      r9d,0FFFFFFFFh
                           00007ffb`7b690892 488d542450      lea     rdx,[rsp+50h]
                           00007ffb`7b690897 48896cfc50      mov     qword ptr [rsp+rdi*8+50h],rbp
                           00007ffb`7b69089c 4533c0          xor     r8d,r8d
                           00007ffb`7b69089f 48ff15cac41a00  call    qword ptr [combase!Ordinal79+0x61160 (00007ffb`7b83cd70)]
                           00007ffb`7b6908a6 0f1f440000      nop     dword ptr [rax+rax]


+000D0720 combase.dll!CoRevokeInitializeSpy+0xC90:

                           00007ffb`7b6906f0 448b0df1242300  mov     r9d,dword ptr [combase!Ordinal183+0x51b90 (00007ffb`7b8c2be8)]
                           00007ffb`7b6906f7 488d442450      lea     rax,[rsp+50h]
                           00007ffb`7b6906fc 8364245000      and     dword ptr [rsp+50h],0
                           00007ffb`7b690701 4533c0          xor     r8d,r8d
                           00007ffb`7b690704 4889442430      mov     qword ptr [rsp+30h],rax
                           00007ffb`7b690709 33d2            xor     edx,edx
                           00007ffb`7b69070b 8364242800      and     dword ptr [rsp+28h],0
                           00007ffb`7b690710 488bcb          mov     rcx,rbx
                           00007ffb`7b690713 c7442420a00f0000 mov     dword ptr [rsp+20h],0FA0h
                           00007ffb`7b69071b e8e0000000      call    combase!CoRevokeInitializeSpy+0xd70 (00007ffb`7b690800)
                           00007ffb`7b690720 85c0            test    eax,eax


+000D0530 combase.dll!CoRevokeInitializeSpy+0xAA0:

                           00007ffb`7b6904fc 44397108        cmp     dword ptr [rcx+8],r14d
                           00007ffb`7b690500 0f8538010000    jne     combase!CoRevokeInitializeSpy+0xbae (00007ffb`7b69063e)
                           00007ffb`7b690506 65488b042530000000 mov   rax,qword ptr gs:[30h]
                           00007ffb`7b69050f 488b8058170000  mov     rax,qword ptr [rax+1758h]
                           00007ffb`7b690516 4885c0          test    rax,rax
                           00007ffb`7b690519 7407            je      combase!CoRevokeInitializeSpy+0xa92 (00007ffb`7b690522)
                           00007ffb`7b69051b 4489b038010000  mov     dword ptr [rax+138h],r14d
                           00007ffb`7b690522 488b4b18        mov     rcx,qword ptr [rbx+18h]
                           00007ffb`7b690526 488b4310        mov     rax,qword ptr [rbx+10h]
                           00007ffb`7b69052a ff1568d01a00    call    qword ptr [combase!Ordinal79+0x61988 (00007ffb`7b83d598)]
                           00007ffb`7b690530 48ff15a9c51a00  call    qword ptr [combase!Ordinal79+0x60ed0 (00007ffb`7b83cae0)]


+000D04B9 combase.dll!CoRevokeInitializeSpy+0xA29:

                           00007ffb`7b690490 48895c2408      mov     qword ptr [rsp+8],rbx
                           00007ffb`7b690495 57              push    rdi
                           00007ffb`7b690496 4883ec20        sub     rsp,20h
                           00007ffb`7b69049a 488bf9          mov     rdi,rcx
                           00007ffb`7b69049d 48ff152cc61a00  call    qword ptr [combase!Ordinal79+0x60ec0 (00007ffb`7b83cad0)]
                           00007ffb`7b6904a4 0f1f440000      nop     dword ptr [rax+rax]
                           00007ffb`7b6904a9 894728          mov     dword ptr [rdi+28h],eax
                           00007ffb`7b6904ac e847040000      call    combase!CoRevokeInitializeSpy+0xe68 (00007ffb`7b6908f8)
                           00007ffb`7b6904b1 488bcf          mov     rcx,rdi
                           00007ffb`7b6904b4 e82b000000      call    combase!CoRevokeInitializeSpy+0xa54 (00007ffb`7b6904e4)
                           00007ffb`7b6904b9 488b5f30        mov     rbx,qword ptr [rdi+30h]


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Thread 25192 / 0x6268

======================================================================

LastError: 0x00000000 - The operation completed successfully.

NTSTATUS:  0xC000000D - An invalid parameter was passed to a service or function.



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14

+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 00000000000001D5

RBX = 000001DFD4446710

RCX = 0000000000000014

RDX = 000001DFD4446390

RSI = 000001DFD1A02340

RDI = 000001DFD4446710

R8  = 0000000000000000

R9  = 1100000000000000

R10 = CFF7FFFF7FFF7DFC

R11 = 5555555555555555

R12 = 0000000000000000

R13 = 0000000000000000

R14 = 0000000000000000

R15 = 0000000000000000

RIP = 00007FFB7BE110A4

RSP = 0000000EDD7FF988

RBP = 0000000000000000

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14:

                           00007ffb`7be11084 c3              ret
                           00007ffb`7be11085 cd2e            int     2Eh
                           00007ffb`7be11087 c3              ret
                           00007ffb`7be11088 0f1f840000000000 nop     dword ptr [rax+rax]
ntdll!ZwWaitForWorkViaWorkerFactory:
                           00007ffb`7be11090 4c8bd1          mov     r10,rcx
                           00007ffb`7be11093 b8d5010000      mov     eax,1D5h
                           00007ffb`7be11098 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`7be110a0 7503            jne     ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5)
                           00007ffb`7be110a2 0f05            syscall
                           00007ffb`7be110a4 c3              ret


+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747:

                           00007ffb`7bdbd3d0 4889442468      mov     qword ptr [rsp+68h],rax
                           00007ffb`7bdbd3d5 44896c2448      mov     dword ptr [rsp+48h],r13d
                           00007ffb`7bdbd3da 488b4e38        mov     rcx,qword ptr [rsi+38h]
                           00007ffb`7bdbd3de 48898c24c8000000 mov     qword ptr [rsp+0C8h],rcx
                           00007ffb`7bdbd3e6 488d842448020000 lea     rax,[rsp+248h]
                           00007ffb`7bdbd3ee 4889442420      mov     qword ptr [rsp+20h],rax
                           00007ffb`7bdbd3f3 4c8d4c2448      lea     r9,[rsp+48h]
                           00007ffb`7bdbd3f8 448b442444      mov     r8d,dword ptr [rsp+44h]
                           00007ffb`7bdbd3fd 488b542468      mov     rdx,qword ptr [rsp+68h]
                           00007ffb`7bdbd402 e8893c0500      call    ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090)
                           00007ffb`7bdbd407 8bc8            mov     ecx,eax


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Thread 25012 / 0x61B4

======================================================================

LastError: 0x00000057 - The parameter is incorrect.

NTSTATUS:  0xC000000D - An invalid parameter was passed to a service or function.



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14

+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 00000000000001D5

RBX = 0000000000000000

RCX = 0000000000000014

RDX = 000001DFD44485B0

RSI = 000001DFD1A02340

RDI = 0000000000000000

R8  = 0000000000000000

R9  = 0000000000000000

R10 = 0000000000000000

R11 = 0000000000000000

R12 = 0000000000000000

R13 = 0000000000000000

R14 = 0000000000000000

R15 = 0000000000000000

RIP = 00007FFB7BE110A4

RSP = 0000000EDD8FF6C8

RBP = 0000000000000000

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14:

                           00007ffb`7be11084 c3              ret
                           00007ffb`7be11085 cd2e            int     2Eh
                           00007ffb`7be11087 c3              ret
                           00007ffb`7be11088 0f1f840000000000 nop     dword ptr [rax+rax]
ntdll!ZwWaitForWorkViaWorkerFactory:
                           00007ffb`7be11090 4c8bd1          mov     r10,rcx
                           00007ffb`7be11093 b8d5010000      mov     eax,1D5h
                           00007ffb`7be11098 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`7be110a0 7503            jne     ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5)
                           00007ffb`7be110a2 0f05            syscall
                           00007ffb`7be110a4 c3              ret


+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747:

                           00007ffb`7bdbd3d0 4889442468      mov     qword ptr [rsp+68h],rax
                           00007ffb`7bdbd3d5 44896c2448      mov     dword ptr [rsp+48h],r13d
                           00007ffb`7bdbd3da 488b4e38        mov     rcx,qword ptr [rsi+38h]
                           00007ffb`7bdbd3de 48898c24c8000000 mov     qword ptr [rsp+0C8h],rcx
                           00007ffb`7bdbd3e6 488d842448020000 lea     rax,[rsp+248h]
                           00007ffb`7bdbd3ee 4889442420      mov     qword ptr [rsp+20h],rax
                           00007ffb`7bdbd3f3 4c8d4c2448      lea     r9,[rsp+48h]
                           00007ffb`7bdbd3f8 448b442444      mov     r8d,dword ptr [rsp+44h]
                           00007ffb`7bdbd3fd 488b542468      mov     rdx,qword ptr [rsp+68h]
                           00007ffb`7bdbd402 e8893c0500      call    ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090)
                           00007ffb`7bdbd407 8bc8            mov     ecx,eax


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Thread 4276 / 0x10B4

======================================================================

LastError: 0x000003F0 - An attempt was made to reference a token that does not exist.

NTSTATUS:  0xC000007C - An attempt was made to reference a token that doesn't exist. This is typically done by referencing the token associated with a thread when the thread is not impersonating a client.



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+00001104 win32u.dll!NtUserGetMessage+0x14

+0002210E USER32.dll!GetMessageW+0x2E

+000AFC38 combase.dll!Ordinal69+0xC28

+000AFB70 combase.dll!Ordinal69+0xB60

+000D0530 combase.dll!CoRevokeInitializeSpy+0xAA0

+000D04B9 combase.dll!CoRevokeInitializeSpy+0xA29

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 0000000000001006

RBX = 0000000EDD9FFBB0

RCX = 0000000EDD9FFBB0

RDX = 0000000000000000

RSI = 00000000018B0BC8

RDI = 0000000000000000

R8  = 0000000000000000

R9  = 0000000000000000

R10 = 0000000000000000

R11 = 0000000EDD9FE2D0

R12 = 0000000000000000

R13 = 0000000000000000

R14 = 0000000000001000

R15 = 0000000000000000

RIP = 00007FFB793F1104

RSP = 0000000EDD9FFB08

RBP = 00000000000003AC

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+00001104 win32u.dll!NtUserGetMessage+0x14:

                           00007ffb`793f10e4 c3              ret
                           00007ffb`793f10e5 cd2e            int     2Eh
                           00007ffb`793f10e7 c3              ret
                           00007ffb`793f10e8 0f1f840000000000 nop     dword ptr [rax+rax]
win32u!NtUserGetMessage:
                           00007ffb`793f10f0 4c8bd1          mov     r10,rcx
                           00007ffb`793f10f3 b806100000      mov     eax,1006h
                           00007ffb`793f10f8 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`793f1100 7503            jne     win32u!NtUserGetMessage+0x15 (00007ffb`793f1105)
                           00007ffb`793f1102 0f05            syscall
                           00007ffb`793f1104 c3              ret


+0002210E USER32.dll!GetMessageW+0x2E:

                           00007ffb`7b1f20e2 4883ec50        sub     rsp,50h
                           00007ffb`7b1f20e6 418bc1          mov     eax,r9d
                           00007ffb`7b1f20e9 488bd9          mov     rbx,rcx
                           00007ffb`7b1f20ec 458bc8          mov     r9d,r8d
                           00007ffb`7b1f20ef 440bc8          or      r9d,eax
                           00007ffb`7b1f20f2 41f7c10000feff  test    r9d,0FFFE0000h
                           00007ffb`7b1f20f9 0f85b11d0200    jne     USER32!SetWindowsHookExAW+0xd980 (00007ffb`7b213eb0)
                           00007ffb`7b1f20ff 448bc8          mov     r9d,eax
                           00007ffb`7b1f2102 48897c2460      mov     qword ptr [rsp+60h],rdi
                           00007ffb`7b1f2107 48ff1502ea0600  call    qword ptr [USER32!gapfnScSendMessage+0x11b0 (00007ffb`7b260b10)]
                           00007ffb`7b1f210e 0f1f440000      nop     dword ptr [rax+rax]


+000AFC38 combase.dll!Ordinal69+0xC28:

                           00007ffb`7b66fc07 488bb1c0000000  mov     rsi,qword ptr [rcx+0C0h]
                           00007ffb`7b66fc0e 488bce          mov     rcx,rsi
                           00007ffb`7b66fc11 48ff1588092800  call    qword ptr [combase!Ordinal183+0x7f548 (00007ffb`7b8f05a0)]
                           00007ffb`7b66fc18 0f1f440000      nop     dword ptr [rax+rax]
                           00007ffb`7b66fc1d 4889056c312500  mov     qword ptr [combase!Ordinal183+0x51d38 (00007ffb`7b8c2d90)],rax
                           00007ffb`7b66fc24 4533c9          xor     r9d,r9d
                           00007ffb`7b66fc27 488d4c2440      lea     rcx,[rsp+40h]
                           00007ffb`7b66fc2c 4533c0          xor     r8d,r8d
                           00007ffb`7b66fc2f 33d2            xor     edx,edx
                           00007ffb`7b66fc31 48ff1550092800  call    qword ptr [combase!Ordinal183+0x7f530 (00007ffb`7b8f0588)]
                           00007ffb`7b66fc38 0f1f440000      nop     dword ptr [rax+rax]


+000AFB70 combase.dll!Ordinal69+0xB60:

                           00007ffb`7b66fb4c 488bcd          mov     rcx,rbp
                           00007ffb`7b66fb4f 894658          mov     dword ptr [rsi+58h],eax
                           00007ffb`7b66fb52 48ff152fd21c00  call    qword ptr [combase!Ordinal79+0x61178 (00007ffb`7b83cd88)]
                           00007ffb`7b66fb59 0f1f440000      nop     dword ptr [rax+rax]
                           00007ffb`7b66fb5e 8b4630          mov     eax,dword ptr [rsi+30h]
                           00007ffb`7b66fb61 83e01f          and     eax,1Fh
                           00007ffb`7b66fb64 ffc8            dec     eax
                           00007ffb`7b66fb66 83f801          cmp     eax,1
                           00007ffb`7b66fb69 7705            ja      combase!Ordinal69+0xb60 (00007ffb`7b66fb70)
                           00007ffb`7b66fb6b e864000000      call    combase!Ordinal69+0xbc4 (00007ffb`7b66fbd4)
                           00007ffb`7b66fb70 488b442440      mov     rax,qword ptr [rsp+40h]


+000D0530 combase.dll!CoRevokeInitializeSpy+0xAA0:

                           00007ffb`7b6904fc 44397108        cmp     dword ptr [rcx+8],r14d
                           00007ffb`7b690500 0f8538010000    jne     combase!CoRevokeInitializeSpy+0xbae (00007ffb`7b69063e)
                           00007ffb`7b690506 65488b042530000000 mov   rax,qword ptr gs:[30h]
                           00007ffb`7b69050f 488b8058170000  mov     rax,qword ptr [rax+1758h]
                           00007ffb`7b690516 4885c0          test    rax,rax
                           00007ffb`7b690519 7407            je      combase!CoRevokeInitializeSpy+0xa92 (00007ffb`7b690522)
                           00007ffb`7b69051b 4489b038010000  mov     dword ptr [rax+138h],r14d
                           00007ffb`7b690522 488b4b18        mov     rcx,qword ptr [rbx+18h]
                           00007ffb`7b690526 488b4310        mov     rax,qword ptr [rbx+10h]
                           00007ffb`7b69052a ff1568d01a00    call    qword ptr [combase!Ordinal79+0x61988 (00007ffb`7b83d598)]
                           00007ffb`7b690530 48ff15a9c51a00  call    qword ptr [combase!Ordinal79+0x60ed0 (00007ffb`7b83cae0)]


+000D04B9 combase.dll!CoRevokeInitializeSpy+0xA29:

                           00007ffb`7b690490 48895c2408      mov     qword ptr [rsp+8],rbx
                           00007ffb`7b690495 57              push    rdi
                           00007ffb`7b690496 4883ec20        sub     rsp,20h
                           00007ffb`7b69049a 488bf9          mov     rdi,rcx
                           00007ffb`7b69049d 48ff152cc61a00  call    qword ptr [combase!Ordinal79+0x60ec0 (00007ffb`7b83cad0)]
                           00007ffb`7b6904a4 0f1f440000      nop     dword ptr [rax+rax]
                           00007ffb`7b6904a9 894728          mov     dword ptr [rdi+28h],eax
                           00007ffb`7b6904ac e847040000      call    combase!CoRevokeInitializeSpy+0xe68 (00007ffb`7b6908f8)
                           00007ffb`7b6904b1 488bcf          mov     rcx,rdi
                           00007ffb`7b6904b4 e82b000000      call    combase!CoRevokeInitializeSpy+0xa54 (00007ffb`7b6904e4)
                           00007ffb`7b6904b9 488b5f30        mov     rbx,qword ptr [rdi+30h]


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Thread 8040 / 0x1F68

======================================================================

LastError: 0x00000057 - The parameter is incorrect.

NTSTATUS:  0xC000000D - An invalid parameter was passed to a service or function.



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14

+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747

+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14

+0004CC91 ntdll.dll!RtlUserThreadStart+0x21



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 00000000000001D5

RBX = 0000000000000000

RCX = 000000000000051C

RDX = 000001DFD4596970

RSI = 000001DFD44BEB80

RDI = 0000000000000000

R8  = 0000000000000000

R9  = 0000000000000000

R10 = 0000000000000000

R11 = 0000000000000000

R12 = 0000000000000000

R13 = 0000000000000000

R14 = 0000000000000000

R15 = 0000000000000000

RIP = 00007FFB7BE110A4

RSP = 0000000EDDBFF9D8

RBP = 0000000000000000

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14:

                           00007ffb`7be11084 c3              ret
                           00007ffb`7be11085 cd2e            int     2Eh
                           00007ffb`7be11087 c3              ret
                           00007ffb`7be11088 0f1f840000000000 nop     dword ptr [rax+rax]
ntdll!ZwWaitForWorkViaWorkerFactory:
                           00007ffb`7be11090 4c8bd1          mov     r10,rcx
                           00007ffb`7be11093 b8d5010000      mov     eax,1D5h
                           00007ffb`7be11098 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`7be110a0 7503            jne     ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5)
                           00007ffb`7be110a2 0f05            syscall
                           00007ffb`7be110a4 c3              ret


+0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747:

                           00007ffb`7bdbd3d0 4889442468      mov     qword ptr [rsp+68h],rax
                           00007ffb`7bdbd3d5 44896c2448      mov     dword ptr [rsp+48h],r13d
                           00007ffb`7bdbd3da 488b4e38        mov     rcx,qword ptr [rsi+38h]
                           00007ffb`7bdbd3de 48898c24c8000000 mov     qword ptr [rsp+0C8h],rcx
                           00007ffb`7bdbd3e6 488d842448020000 lea     rax,[rsp+248h]
                           00007ffb`7bdbd3ee 4889442420      mov     qword ptr [rsp+20h],rax
                           00007ffb`7bdbd3f3 4c8d4c2448      lea     r9,[rsp+48h]
                           00007ffb`7bdbd3f8 448b442444      mov     r8d,dword ptr [rsp+44h]
                           00007ffb`7bdbd3fd 488b542468      mov     rdx,qword ptr [rsp+68h]
                           00007ffb`7bdbd402 e8893c0500      call    ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090)
                           00007ffb`7bdbd407 8bc8            mov     ecx,eax


+00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14:

                           00007ffb`7b50735d cc              int     3
                           00007ffb`7b50735e cc              int     3
                           00007ffb`7b50735f cc              int     3
KERNEL32!BaseThreadInitThunk:
                           00007ffb`7b507360 4883ec28        sub     rsp,28h
                           00007ffb`7b507364 85c9            test    ecx,ecx
                           00007ffb`7b507366 751b            jne     KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383)
                           00007ffb`7b507368 498bc8          mov     rcx,r8
                           00007ffb`7b50736b 488bc2          mov     rax,rdx
                           00007ffb`7b50736e ff15d4f20600    call    qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)]
                           00007ffb`7b507374 8bc8            mov     ecx,eax


+0004CC91 ntdll.dll!RtlUserThreadStart+0x21:

                           00007ffb`7bdbcc72 ec              in      al,dx
                           00007ffb`7bdbcc73 784c            js      ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1)
                           00007ffb`7bdbcc75 8bc9            mov     ecx,ecx
                           00007ffb`7bdbcc77 488b0572f31100  mov     rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)]
                           00007ffb`7bdbcc7e 4885c0          test    rax,rax
                           00007ffb`7bdbcc81 7410            je      ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93)
                           00007ffb`7bdbcc83 4c8bc2          mov     r8,rdx
                           00007ffb`7bdbcc86 488bd1          mov     rdx,rcx
                           00007ffb`7bdbcc89 33c9            xor     ecx,ecx
                           00007ffb`7bdbcc8b ff156f831300    call    qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)]
                           00007ffb`7bdbcc91 eb20            jmp     ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3)




======================================================================

Thread 24492 / 0x5FAC

======================================================================

LastError: 0x00000057 - The parameter is incorrect.

NTSTATUS:  0xC000000D - An invalid parameter was passed to a service or function.



----------------------------------------------------------------------

Stack

----------------------------------------------------------------------

+0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14

+00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0

+0004B7B7 CRYPT32.dll!<unknown> (get the pdb)



----------------------------------------------------------------------

Registers

----------------------------------------------------------------------

RAX = 000000000000005B

RBX = 0000000000000001

RCX = 0000000000000001

RDX = 000001DFD511FAB0

RSI = 0000000000000000

RDI = 0000000000000001

R8  = 0000000000000000

R9  = 0000000000000000

R10 = 0000000000000000

R11 = 0000000000000000

R12 = 0000000000003A98

R13 = 000001DFD511FAB0

R14 = 0000000EDDCFF620

R15 = 0000000000000000

RIP = 00007FFB7BE0E164

RSP = 0000000EDDCFF5C8

RBP = 0000000000000000

EFL = 00000246



----------------------------------------------------------------------

Disassembly

----------------------------------------------------------------------

+0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14:

                           00007ffb`7be0e13d 0000            add     byte ptr [rax],al
                           00007ffb`7be0e13f 00e9            add     cl,ch
                           00007ffb`7be0e141 6b8efdff666666  imul    ecx,dword ptr [rsi+6666FFFDh],66h
                           00007ffb`7be0e148 0f1f840000000000 nop     dword ptr [rax+rax]
ntdll!NtWaitForMultipleObjects:
                           00007ffb`7be0e150 4c8bd1          mov     r10,rcx
                           00007ffb`7be0e153 b85b000000      mov     eax,5Bh
                           00007ffb`7be0e158 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
                           00007ffb`7be0e160 7503            jne     ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`7be0e165)
                           00007ffb`7be0e162 0f05            syscall
                           00007ffb`7be0e164 c3              ret


+00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0:

                           00007ffb`79940ce7 4c8d742450      lea     r14,[rsp+50h]
                           00007ffb`79940cec 448b7c2444      mov     r15d,dword ptr [rsp+44h]
                           00007ffb`79940cf1 4533c0          xor     r8d,r8d
                           00007ffb`79940cf4 4585ff          test    r15d,r15d
                           00007ffb`79940cf7 410f94c0        sete    r8b
                           00007ffb`79940cfb 4c89742420      mov     qword ptr [rsp+20h],r14
                           00007ffb`79940d00 440fb6ce        movzx   r9d,sil
                           00007ffb`79940d04 498bd5          mov     rdx,r13
                           00007ffb`79940d07 8bcb            mov     ecx,ebx
                           00007ffb`79940d09 48ff1570391900  call    qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb8080 (00007ffb`79ad4680)]
                           00007ffb`79940d10 0f1f440000      nop     dword ptr [rax+rax]


+0004B7B7 CRYPT32.dll!<unknown> (get the pdb):

                           00007ffb`79c3b793 488bd9          mov     rbx,rcx
                           00007ffb`79c3b796 48f7d8          neg     rax
                           00007ffb`79c3b799 1bff            sbb     edi,edi
                           00007ffb`79c3b79b f7df            neg     edi
                           00007ffb`79c3b79d 448b4b30        mov     r9d,dword ptr [rbx+30h]
                           00007ffb`79c3b7a1 488d5310        lea     rdx,[rbx+10h]
                           00007ffb`79c3b7a5 8364242000      and     dword ptr [rsp+20h],0
                           00007ffb`79c3b7aa 8d4f01          lea     ecx,[rdi+1]
                           00007ffb`79c3b7ad 4533c0          xor     r8d,r8d
                           00007ffb`79c3b7b0 48ff15f1ee0c00  call    qword ptr [00007ffb`79d0a6a8]
                           00007ffb`79c3b7b7 0f1f440000      nop     dword ptr [rax+rax]




======================================================================

Modules

======================================================================

0x00007FF606730000 - 0x00007FF606CD9000 | C:\Program Files\Far Manager\Far.exe | File and archive manager | 3.0.6644.0 x64

0x00007FFB7BD70000 - 0x00007FFB7BF68000 | C:\WINDOWS\SYSTEM32\ntdll.dll | NT Layer DLL | 10.0.19041.4842 (WinBuild.160101.0800)

0x00007FFB7B4F0000 - 0x00007FFB7B5B2000 | C:\WINDOWS\System32\KERNEL32.DLL | Windows NT BASE API Client DLL | 10.0.19041.6807 (WinBuild.160101.0800)

0x00007FFB798F0000 - 0x00007FFB79BE7000 | C:\WINDOWS\System32\KERNELBASE.dll | Windows NT BASE API Client DLL | 10.0.19041.6807 (WinBuild.160101.0800)

0x00007FFB7B430000 - 0x00007FFB7B4E1000 | C:\WINDOWS\System32\ADVAPI32.dll | Advanced Windows 32 Base API | 10.0.19041.320 (WinBuild.160101.0800)

0x00007FFB7BC60000 - 0x00007FFB7BCFE000 | C:\WINDOWS\System32\msvcrt.dll | Windows NT CRT DLL | 7.0.19041.6809 (WinBuild.160101.0800)

0x00007FFB7AF20000 - 0x00007FFB7AFBF000 | C:\WINDOWS\System32\sechost.dll | Host for SCM/SDDL/LSA Lookup APIs | 10.0.19041.320 (WinBuild.160101.0800)

0x00007FFB7A6B0000 - 0x00007FFB7A7D6000 | C:\WINDOWS\System32\RPCRT4.dll | Remote Procedure Call Runtime | 10.0.19041.6807 (WinBuild.160101.0800)

0x00007FFB79D50000 - 0x00007FFB79D77000 | C:\WINDOWS\System32\bcrypt.dll | Windows Cryptographic Primitives Library | 10.0.19041.320 (WinBuild.160101.0800)

0x00007FFB7B1D0000 - 0x00007FFB7B36D000 | C:\WINDOWS\System32\USER32.dll | V1;V>B5:0 DLL :;VT=B0 1030B>:>@8ABC20FL:>3> API Windows | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB793F0000 - 0x00007FFB79412000 | C:\WINDOWS\System32\win32u.dll | Win32u | 10.0.19041.7058 (WinBuild.160101.0800)

0x00007FFB7BD00000 - 0x00007FFB7BD2B000 | C:\WINDOWS\System32\GDI32.dll | GDI Client DLL | 10.0.19041.7058 (WinBuild.160101.0800)

0x00007FFB79420000 - 0x00007FFB7953A000 | C:\WINDOWS\System32\gdi32full.dll | GDI Client DLL | 10.0.19041.7058 (WinBuild.160101.0800)

0x00007FFB79850000 - 0x00007FFB798ED000 | C:\WINDOWS\System32\msvcp_win.dll | Microsoft� C Runtime Library | 10.0.19041.6809 (WinBuild.160101.0800)

0x00007FFB79540000 - 0x00007FFB79640000 | C:\WINDOWS\System32\ucrtbase.dll | Microsoft� C Runtime Library | 10.0.19041.6809 (WinBuild.160101.0800)

0x00007FFB79ED0000 - 0x00007FFB7A641000 | C:\WINDOWS\System32\SHELL32.dll | 030;L=0 1V1;V>B5:0 Dll >1>;>=:8 Windows | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB7ADF0000 - 0x00007FFB7AF1B000 | C:\WINDOWS\System32\ole32.dll | Microsoft OLE for Windows | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB7B5C0000 - 0x00007FFB7B913000 | C:\WINDOWS\System32\combase.dll | Microsoft COM for Windows | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB7ADE0000 - 0x00007FFB7ADE8000 | C:\WINDOWS\System32\PSAPI.DLL | Process Status Helper | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB7A7E0000 - 0x00007FFB7AC50000 | C:\WINDOWS\System32\SETUPAPI.dll | API ?@>3@0<8 V=AB0;OFVW Windows | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB796C0000 - 0x00007FFB7970E000 | C:\WINDOWS\System32\cfgmgr32.dll | Configuration Manager DLL | 10.0.19041.3996 (WinBuild.160101.0800)

0x00007FFB7AD00000 - 0x00007FFB7ADDA000 | C:\WINDOWS\System32\COMDLG32.dll | Common Dialogs DLL | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB7BA10000 - 0x00007FFB7BABD000 | C:\WINDOWS\System32\shcore.dll | SHCORE | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB7B170000 - 0x00007FFB7B1CB000 | C:\WINDOWS\System32\SHLWAPI.dll | V1;V>B5:0 A?@>I5=>W CB8;VB8 >1>;>=:8 | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB7B400000 - 0x00007FFB7B42F000 | C:\WINDOWS\System32\IMM32.dll | Multi-User Windows IMM32 API Client DLL | 10.0.19041.6157 (WinBuild.160101.0800)

0x00007FFB5DF40000 - 0x00007FFB5DFE4000 | C:\WINDOWS\SYSTEM32\WINSPOOL.DRV | @0925@ A?C;5@0 Windows | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB61050000 - 0x00007FFB61069000 | C:\WINDOWS\SYSTEM32\NETAPI32.dll | Net Win32 API DLL | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB61030000 - 0x00007FFB6104D000 | C:\WINDOWS\SYSTEM32\MPR.dll | V1;V>B5:0 DLL <0@H@CB870B>@0 ?>AB0G0;L=8:0<8 | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB5FDB0000 - 0x00007FFB5FDBC000 | C:\WINDOWS\SYSTEM32\Secur32.dll | Security Support Provider Interface | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB792A0000 - 0x00007FFB792CE000 | C:\WINDOWS\SYSTEM32\USERENV.dll | Userenv | 10.0.19041.320 (WinBuild.160101.0800)

0x00007FFB760B0000 - 0x00007FFB760BA000 | C:\WINDOWS\SYSTEM32\VERSION.dll | Version Checking and File Installation Libraries | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB58530000 - 0x00007FFB587CB000 | C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6926_none_60b5a53971f8f7e6\COMCTL32.dll | V1;V>B5:0 5;5<5=BV2 :5@C20==O 4;O @>1>B8 :>@8ABC20G0 | 6.10 (WinBuild.160101.0800)

0x00007FFAE11F0000 - 0x00007FFAE1317000 | C:\Program Files\Far Manager\sqlite3.dll | SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine. | 3.51.2

0x00007FFB78820000 - 0x00007FFB7882C000 | C:\WINDOWS\SYSTEM32\NETUTILS.DLL | Net Win32 API Helpers DLL | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB64D90000 - 0x00007FFB64DA9000 | C:\WINDOWS\SYSTEM32\SAMCLI.DLL | Security Accounts Manager Client DLL | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB69E00000 - 0x00007FFB69E28000 | C:\WINDOWS\SYSTEM32\SRVCLI.DLL | Server Service Client DLL | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB792D0000 - 0x00007FFB79302000 | C:\WINDOWS\SYSTEM32\SSPICLI.DLL | Security Support Provider Interface | 10.0.19041.6807 (WinBuild.160101.0800)

0x00007FFB77290000 - 0x00007FFB772A2000 | C:\WINDOWS\SYSTEM32\kernel.appcore.dll | AppModel API Host | 10.0.19041.3758 (WinBuild.160101.0800)

0x00007FFB76D00000 - 0x00007FFB76D9E000 | C:\WINDOWS\system32\uxtheme.dll | V1;V>B5:0 UxTheme Microsoft | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB7BB40000 - 0x00007FFB7BC55000 | C:\WINDOWS\System32\MSCTF.dll | V1;V>B5:0 DLL A5@25@0 MSCTF | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB79D80000 - 0x00007FFB79E4D000 | C:\WINDOWS\System32\OLEAUT32.dll | OLEAUT32.DLL | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB77490000 - 0x00007FFB77C36000 | C:\WINDOWS\SYSTEM32\windows.storage.dll | =B5@D59A API AE>28I0 Microsoft WinRT | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB78E20000 - 0x00007FFB78E4B000 | C:\WINDOWS\SYSTEM32\Wldp.dll | Windows Lockdown Policy | 10.0.19041.320 (WinBuild.160101.0800)

0x00007FFB79320000 - 0x00007FFB79344000 | C:\WINDOWS\SYSTEM32\profapi.dll | User Profile Basic API | 10.0.19041.6033 (WinBuild.160101.0800)

0x00007FFB797C0000 - 0x00007FFB79842000 | C:\WINDOWS\System32\bcryptPrimitives.dll | Windows Cryptographic Primitives Library | 10.0.19041.6809 (WinBuild.160101.0800)

0x00007FFB7AC50000 - 0x00007FFB7ACF9000 | C:\WINDOWS\System32\clbcatq.dll | COM+ Configuration Catalog | 2001.12.10941.16384 (WinBuild.160101.0800)

0x00007FFB47060000 - 0x00007FFB472B8000 | C:\WINDOWS\system32\explorerframe.dll | ExplorerFrame | 10.0.19041.4842 (WinBuild.160101.0800)

0x00007FFB74E30000 - 0x00007FFB753F0000 | C:\WINDOWS\system32\d2d1.dll | Microsoft D2D Library | 10.0.19041.320 (WinBuild.160101.0800)

0x00007FFB718C0000 - 0x00007FFB72094000 | C:\Windows\System32\OneCoreUAPCommonProxyStub.dll | OneCoreUAP Common Proxy Stub | 10.0.19041.5915 (WinBuild.160101.0800)

0x00007FFB59FC0000 - 0x00007FFB59FE3000 | C:\Program Files\Far Manager\Plugins\LuaMacro\LuaMacro.dll | Lua Macros for Far Manager | 3.0.915.0

0x0000000066D80000 - 0x0000000066E00000 | C:\Program Files\Far Manager\lua51.dll | 0x00000715 - The specified resource type cannot be found in the image file.

0x00007FFB47BA0000 - 0x00007FFB47C4F000 | C:\Program Files\Far Manager\luafar3.dll | LuaFar library | 3.0.915.0

0x00007FFB78D90000 - 0x00007FFB78D9C000 | C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL | Base cryptographic API DLL | 10.0.19041.6809 (WinBuild.160101.0800)

0x00007FFB729F0000 - 0x00007FFB72BF1000 | C:\WINDOWS\SYSTEM32\dbghelp.DLL | Windows Image Helper | 10.0.19041.5848 (WinBuild.160101.0800)

0x00007FFB72900000 - 0x00007FFB72934000 | C:\WINDOWS\SYSTEM32\dbgcore.DLL | Windows Core Debugging Helpers | 10.0.19041.5794 (WinBuild.160101.0800)

0x00007FFB556A0000 - 0x00007FFB55D27000 | C:\WINDOWS\SYSTEM32\dbgeng.DLL | Windows Symbolic Debugger Engine | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB74420000 - 0x00007FFB74456000 | C:\WINDOWS\SYSTEM32\XmlLite.dll | Microsoft XmlLite Library | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB700B0000 - 0x00007FFB70164000 | C:\WINDOWS\SYSTEM32\dbgmodel.dll | Windows Debugger Data Model | 10.0.19041.3636 (WinBuild.160101.0800)

0x00007FFB79640000 - 0x00007FFB796B3000 | C:\WINDOWS\System32\wintrust.dll | Microsoft Trust Verification APIs | 10.0.19041.6456 (WinBuild.160101.0800)

0x00007FFB79BF0000 - 0x00007FFB79D4D000 | C:\WINDOWS\System32\CRYPT32.dll | Crypto API32 | 10.0.19041.4522 (WinBuild.160101.0800)

0x00007FFB78FB0000 - 0x00007FFB78FC2000 | C:\WINDOWS\SYSTEM32\MSASN1.dll | ASN.1 Runtime APIs | 10.0.19041.6809 (WinBuild.160101.0800)

0x00007FFB78D70000 - 0x00007FFB78D88000 | C:\WINDOWS\SYSTEM32\CRYPTSP.dll | Cryptographic Service Provider API | 10.0.19041.6809 (WinBuild.160101.0800)

0x00007FFB78400000 - 0x00007FFB78438000 | C:\WINDOWS\system32\rsaenh.dll | Microsoft Enhanced Cryptographic Provider | 10.0.19041.320 (WinBuild.160101.0800)

0x00007FFB79EB0000 - 0x00007FFB79ECD000 | C:\WINDOWS\System32\imagehlp.dll | Windows NT Image Helper | 10.0.19041.3636 (WinBuild.160101.0800)



======================================================================

Environment

======================================================================

FARHOME=C:\Program Files\Far Manager

FARLANG=Russian

FARLOCALPROFILE=C:\Users\AnViKo\AppData\Local\Far Manager\Profile

FARPROFILE=C:\Users\AnViKo\AppData\Roaming\Far Manager\Profile

bug_report.txt (255,690 bytes)   
far.mdmp (488,735 bytes)

DrKnS

2026-03-12 17:42

administrator   bugnote:0017669

It crashed in "NetBox IdleThread" due to a bad instruction pointer.
NetBox hasn't been updated for over a year now, so it's unlikely something recent.

Try running without NetBox, or without plugins at all (far /p).
If it works, run chkdsk, maybe your NetBox.dll is damaged or something.

AK666

2026-03-12 20:43

reporter   bugnote:0017670

new one.
the same ?

======================================================================
Thread 2316 / 0x90C (Main Thread)
======================================================================
LastError: 0x00000000 - The operation completed successfully.
NTSTATUS: 0x80000006 - {No More Files} No more files were found which match the file specification.

DrKnS

2026-03-12 20:52

administrator   bugnote:0017671

Have you tried without netbox?

AK666

2026-03-12 21:19

reporter   bugnote:0017672

My trouble:
I had two versions of the plugin installed simultaneously:

Plugins\FarNetBox 10.12.2017
Plugins\NetBox 20.12.2024

I have removed the old 2017 version.
So far, the "terminated" errors and crashes have stopped.

If it crashes again with the 2024 version, I will provide further details.

Thnx, and sorry.

DrKnS

2026-03-12 21:22

administrator   bugnote:0017673

Closing this one, pls raise a new issue if needed.

Issue History

Date Modified Username Field Change
2026-03-12 15:23 AK666 New Issue
2026-03-12 15:23 AK666 File Added: README.txt
2026-03-12 15:23 AK666 File Added: bug_report.txt
2026-03-12 15:23 AK666 File Added: far.mdmp
2026-03-12 17:42 DrKnS Note Added: 0017669
2026-03-12 20:43 AK666 Note Added: 0017670
2026-03-12 20:52 DrKnS Note Added: 0017671
2026-03-12 21:19 AK666 Note Added: 0017672
2026-03-12 21:20 DrKnS Status new => closed
2026-03-12 21:20 DrKnS Resolution open => no change required
2026-03-12 21:20 DrKnS Build => 0
2026-03-12 21:22 DrKnS Note Added: 0017673