dump analyze example

......................................................
Loading unloaded module list
..............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(40c.468): Access violation - code c0000005 (first/second chance not available)
eax=637964b8 ebx=00000000 ecx=78ca7d2d edx=78e1acf4 esi=63580000 edi=00000000
eip=63af2ca1 esp=00eea04c ebp=00eea080 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200206
SgHI!HICreateHostIntegrity+0x73:
63af2ca1 89700c          mov     dword ptr [eax+0Ch],esi ds:0023:637964c4=????????
0:003> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************
GetPageUrlData failed, server returned HTTP status 404
URL requested:
http://watson.microsoft.com/StageOne/Smc_exe/12_1_2015_2015/SgHI_dll/12_1_2015_2015/00032ca1.htm?Retriage=1
FAULTING_IP: 
SgHI!HICreateHostIntegrity+73
[c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 183]
63af2ca1 89700c          mov     dword ptr [eax+0Ch],esi
EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 63af2ca1 (SgHI!HICreateHostIntegrity+0x00000073)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 637964c4
Attempt to write to address 637964c4
DEFAULT_BUCKET_ID:  INVALID_POINTER_READ
PROCESS_NAME:  Smc.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"
EXCEPTION_PARAMETER1:  00000001
EXCEPTION_PARAMETER2:  637964c4
WRITE_ADDRESS:  637964c4 
FOLLOWUP_IP: 
GUProxy!afxModuleState+0
637964b8 ??              ???
MOD_LIST: <ANALYSIS/>
NTGLOBALFLAG:  0
APPLICATION_VERIFIER_FLAGS:  0
ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [UnloadedModule_Arch_BP]
from Frame:[0] on thread:[468] ; Followup set based on attribute
[Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER:  from 0048698a to 63af2ca1
FAULTING_THREAD:  ffffffff
PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ
BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_INVALID_POINTER_WRITE
STACK_TEXT:  
00000000 00000000 guproxy!afxModuleState+0x0

STACK_COMMAND:  .ecxr ; ~~[468] ; .frame 0 ; dt ntdll!LdrpLastDllInitializer
BaseDllName ; dt ntdll!LdrpFailureData ; ** Pseudo Context ** ; kb
SYMBOL_NAME:  guproxy!afxModuleState+0
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: GUProxy
IMAGE_NAME:  GUProxy.plg
DEBUG_FLR_IMAGE_TIMESTAMP:  5095227b
FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_GUProxy.plg!afxModuleState
BUCKET_ID: 
APPLICATION_FAULT_INVALID_POINTER_READ_INVALID_POINTER_WRITE_guproxy!afxModuleState+0
WATSON_STAGEONE_URL: 
http://watson.microsoft.com/StageOne/Smc_exe/12_1_2015_2015/50951df4/SgHI_dll/12_1_2015_2015/5095227c/c0000005/00032ca1.htm?Retriage=1
Followup: MachineOwner
---------
0:003> k
ChildEBP RetAddr  
00eea080 0048698a SgHI!HICreateHostIntegrity+0x73
[c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 183]
00eea320 0048957e Smc!Initialize+0x11fb
[c:\bld_area\sep_12.1\windows\sepclient\ci\smc\smcserv.cpp @ 3407]
00eefe30 0049ef38 Smc!ServiceStart+0x13e7
[c:\bld_area\sep_12.1\windows\sepclient\ci\smc\smcserv.cpp @ 6807]
00eefe40 004a1853 Smc!CServiceResponder::Wait_StartService+0x53
[c:\bld_area\sep_12.1\windows\sepclient\ci\smc\servthrd.cpp @ 104]
00eeffa0 77d9deab Smc!service_main+0x113
[c:\bld_area\sep_12.1\windows\sepclient\ci\smc\service.cpp @ 146]
00eeffb4 7c80b699 advapi32!ScSvcctrlThreadW+0x12
00eeffec 00000000 kernel32!BaseThreadStart+0x37
0:003> 

0:003> uf SgHI!HICreateHostIntegrity
SgHI!HICreateHostIntegrity
[c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 176]:
  176 63af2c2e 55              push    ebp
  176 63af2c2f 8bec            mov     ebp,esp
  176 63af2c31 83e4f8          and     esp,0FFFFFFF8h
  176 63af2c34 6aff            push    0FFFFFFFFh
  176 63af2c36 6824f0af63      push    offset SgHI!_chkstk+0x4714 (63aff024)
  176 63af2c3b 64a100000000    mov     eax,dword ptr fs:[00000000h]
  176 63af2c41 50              push    eax
  176 63af2c42 83ec18          sub     esp,18h
  176 63af2c45 53              push    ebx
  176 63af2c46 56              push    esi
  176 63af2c47 57              push    edi
  176 63af2c48 a17c30b163      mov     eax,dword ptr [SgHI!__security_cookie
(63b1307c)]
  176 63af2c4d 33c4            xor     eax,esp
  176 63af2c4f 50              push    eax
  176 63af2c50 8d442428        lea     eax,[esp+28h]
  176 63af2c54 64a300000000    mov     dword ptr fs:[00000000h],eax
  179 63af2c5a 68a8050000      push    5A8h
  179 63af2c5f ff154004b063    call    dword ptr [SgHI!_imp_??2YAPAXIZ (63b00440)]
  179 63af2c65 59              pop     ecx
  179 63af2c66 89442410        mov     dword ptr [esp+10h],eax
  179 63af2c6a 33ff            xor     edi,edi
  179 63af2c6c 897c2430        mov     dword ptr [esp+30h],edi
  179 63af2c70 3bc7            cmp     eax,edi
  179 63af2c72 740f            je      SgHI!HICreateHostIntegrity+0x55 (63af2c83)
SgHI!HICreateHostIntegrity+0x46
[c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 179]:
  179 63af2c74 ff750c          push    dword ptr [ebp+0Ch]
  179 63af2c77 50              push    eax
  179 63af2c78 e87162fdff      call    SgHI!CHIEngine::CHIEngine (63ac8eee)
  179 63af2c7d 89442410        mov     dword ptr [esp+10h],eax
  179 63af2c81 eb04            jmp     SgHI!HICreateHostIntegrity+0x59 (63af2c87)
SgHI!HICreateHostIntegrity+0x55
[c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 179]:
  179 63af2c83 897c2410        mov     dword ptr [esp+10h],edi
SgHI!HICreateHostIntegrity+0x59
[c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 179]:
  179 63af2c87 834c2430ff      or      dword ptr [esp+30h],0FFFFFFFFh
  181 63af2c8c e8e977ffff      call    SgHI!CResourceLoader::Initialize (63aea47a)
  181 63af2c91 85c0            test    eax,eax
  181 63af2c93 7814            js      SgHI!HICreateHostIntegrity+0x7b (63af2ca9)
SgHI!HICreateHostIntegrity+0x67
[c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 183]:
  183 63af2c95 8b35d457b163    mov     esi,dword ptr [SgHI!g_ResLoader+0x4
(63b157d4)]
  183 63af2c9b ff158404b063    call    dword ptr
[SgHI!_imp_?AfxGetModuleStateYGPAVAFX_MODULE_STATEXZ (63b00484)]
  183 63af2ca1 89700c          mov     dword ptr [eax+0Ch],esi
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                                                                  crashed here.
  185 63af2ca4 e9d9000000      jmp     SgHI!HICreateHostIntegrity+0x154 (63af2d82)
SgHI!HICreateHostIntegrity+0x7b
[c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 187]:
  187 63af2ca9 8b1d0447b163    mov     ebx,dword ptr [SgHI!g_opsys_IWPPLog
(63b14704)]
  187 63af2caf 3bdf            cmp     ebx,edi
  187 63af2cb1 7454            je      SgHI!HICreateHostIntegrity+0xd9 (63af2d07)
 ...
 ...
SgHI!HICreateHostIntegrity+0x149
[c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 187]:
  187 63af2d77 ff74241c        push    dword ptr [esp+1Ch]
  187 63af2d7b ff15dc02b063    call    dword ptr [SgHI!_imp__free (63b002dc)]
  187 63af2d81 59              pop     ecx
SgHI!HICreateHostIntegrity+0x154
[c:\bld_area\sep_12.1\windows\sepclient\ci\sghi_deprecated\sghiapi.cpp @ 190]:
  190 63af2d82 8b442410        mov     eax,dword ptr [esp+10h]
  191 63af2d86 8b4c2428        mov     ecx,dword ptr [esp+28h]
  191 63af2d8a 64890d00000000  mov     dword ptr fs:[0],ecx
  191 63af2d91 59              pop     ecx
  191 63af2d92 5f              pop     edi
  191 63af2d93 5e              pop     esi
  191 63af2d94 5b              pop     ebx
  191 63af2d95 8be5            mov     esp,ebp
  191 63af2d97 5d              pop     ebp
  191 63af2d98 c3              ret

0:003> dd SgHI!g_ResLoader
63b157d0  63b0910c 63580000 63ac0000 49486753
63b157e0  2e736552 006c6c64 00000000 0000000b
63b157f0  0000000f 00000000 026d4860 00000000
63b15800  00000000 00000000 0000005e 0000005f
63b15810  00000000 026d4760 00000000 00000000
63b15820  00000000 00000056 0000005f 00000000
63b15830  00000100 00000000 00000000 00000000
63b15840  00000000 00000000 0000000f 00000000
0:003> dt CSPAResourceLoader 63b157d0
Smc!CSPAResourceLoader
   +0x000 __VFN_table : 0x63b0910c 
   +0x004 m_hResModule     : 0x63580000 HINSTANCE__
   +0x008 m_hModule        : 0x63ac0000 HINSTANCE__
   +0x00c m_szSatelliteDll :
std::basic_string<char,std::char_traits<char>,std::allocator<char> >
   +0x028 m_szFullResDllPath :
std::basic_string<char,std::char_traits<char>,std::allocator<char> >
   +0x044 m_szFullBinaryDllPath :
std::basic_string<char,std::char_traits<char>,std::allocator<char> >
   +0x060 m_bVersionMissMatch : 0
   +0x061 m_bVersionCheckEnabled : 1
   +0x064 m_szVersionMismatchMsg :
std::basic_string<char,std::char_traits<char>,std::allocator<char> >
   +0x080 m_szErrorTitle   :
std::basic_string<char,std::char_traits<char>,std::allocator<char> >
// m_szSatelliteDll
0:003> !stl -n
(std::basic_string<char,std::char_traits<char>,std::allocator<char> >) 63b157d0+0xc
[da 0x63b157dc]
63b157dc  "SgHIRes.dll"
// m_szFullResDllPath
0:003> !stl -n
(std::basic_string<char,std::char_traits<char>,std::allocator<char> >) 63b157d0+0x28
[da 0x26d4860]
026d4860  "C:\Program Files\Symantec\Symant"
026d4880  "ec Endpoint Protection\12.1.2015"
026d48a0  ".2015.105\Res\1041\SgHIRes.dll"
// m_szFullBinaryDllPath
0:003> !stl -n
(std::basic_string<char,std::char_traits<char>,std::allocator<char> >) 63b157d0+0x44
[da 0x26d4760]
026d4760  "C:\Program Files\Symantec\Symant"
026d4780  "ec Endpoint Protection\12.1.2015"
026d47a0  ".2015.105\Bin\SgHI.dll"
0:003> 
// These string members in this CResourceLoader object were empty.
//   m_szVersionMismatchMsg
//   m_szErrorTitle
SGHI_API IHIEngine* HICreateHostIntegrity(dword *err_code, HANDLE hSmcStopEvent)
{
 ...
 if(SUCCEEDED(g_ResLoader.Initialize()))
 {
  AfxSetResourceHandle(g_ResLoader.GetResourceInstance());
 }
 ...
 ...


class CResourceLoader
{
public:
 ...
 const HINSTANCE GetResourceInstance(void) const 
 {
  return m_hResModule;
 }

:::::::::: atlmfc\include\afxwin1.inl ::::::::::
_AFXWIN_INLINE void AFXAPI AfxSetResourceHandle(HINSTANCE hInstResource)
 { ASSERT(hInstResource != NULL); afxCurrentResourceHandle = hInstResource; }

atlmfc\include\afxwin.h
#define afxCurrentResourceHandle    AfxGetModuleState()->m_hCurrentResourceHandle

:::::::::: atlmfc\include\afxstat_.h ::::::::::
AFX_MODULE_STATE* AFXAPI AfxGetModuleState();

:::::::::: atlmfc\include\afxstat_.h ::::::::::
class AFX_MODULE_STATE : public CNoTrackObject
{
public:
#ifdef _AFXDLL
 AFX_MODULE_STATE(BOOL bDLL, WNDPROC pfnAfxWndProc, DWORD dwVersion,
  BOOL bSystem = FALSE);
#else
 explicit AFX_MODULE_STATE(BOOL bDLL);
#endif
 ~AFX_MODULE_STATE();
 CWinApp* m_pCurrentWinApp;
 HINSTANCE m_hCurrentInstanceHandle;
 HINSTANCE m_hCurrentResourceHandle;
 LPCTSTR m_lpszCurrentAppName;
 ...

0:003> dt AFX_MODULE_STATE
Smc!AFX_MODULE_STATE
   +0x000 __VFN_table : Ptr32 
   +0x004 m_pCurrentWinApp : Ptr32 CWinApp
   +0x008 m_hCurrentInstanceHandle : Ptr32 HINSTANCE__
   +0x00c m_hCurrentResourceHandle : Ptr32 HINSTANCE__
   +0x010 m_lpszCurrentAppName : Ptr32 Char
   +0x014 m_bDLL           : UChar
   +0x015 m_bSystem        : UChar
   +0x016 m_bReserved      : [2] UChar
   +0x018 m_fRegisteredClasses : Uint4B
   +0x01c m_pClassInit     : Ptr32 CRuntimeClass
   +0x020 m_classList      : CTypedSimpleList<CRuntimeClass *>
   +0x028 m_pFactoryInit   : Ptr32 COleObjectFactory
   +0x02c m_factoryList    : CTypedSimpleList<COleObjectFactory *>
   +0x034 m_nObjectCount   : Int4B
   +0x038 m_bUserCtrl      : Int4B
   +0x03c m_strUnregisterList :
ATL::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char> > >
   +0x040 m_pfnAfxWndProc  : Ptr32     long 
   +0x044 m_dwVersion      : Uint4B
   +0x048 m_pfnFilterToolTipMessage : Ptr32     void 
   +0x04c m_libraryList    : CTypedSimpleList<CDynLinkLibrary *>
   +0x054 m_appLangDLL     : Ptr32 HINSTANCE__
   +0x058 m_pOccManager    : Ptr32 COccManager
   +0x05c m_lockList       : CTypedSimpleList<COleControlLock *>
   +0x064 m_pDaoState      : Ptr32 _AFX_DAO_STATE
   +0x068 m_typeLibCache   : CTypeLibCache
   +0x08c m_pTypeLibCacheMap : Ptr32 CTypeLibCacheMap
   +0x090 m_thread         : CThreadLocal<AFX_MODULE_THREAD_STATE>
   +0x094 m_pDllIsolationWrappers : Ptr32 Ptr32 CDllIsolationWrapperBase
   +0x098 m_bSetAmbientActCtx : Int4B
   +0x09c m_hActCtx        : Ptr32 Void
   +0x0a0 m_bInitNetworkAddressControl : Int4B
   +0x0a4 m_bInitNetworkAddressControlCalled : Int4B

This is the reason why the code is accessing the returned value from
AfxGetModuleState().
The inline function AfxSetResourceHandle() calls AfxGetModuleState(), and then
stores the given HINSTANCE handle value (esi=63580000) to the
m_hCurrentResourceHandle field of AFX_MODULE_STATE class object which address
has been returned by AfxGetModuleState().
According to the eax register, the AfxGetModuleState() returned 637964b8. But,
this address is invalid.
0:003> r
Last set context:
eax=637964b8 ebx=00000000 ecx=78ca7d2d edx=78e1acf4 esi=63580000 edi=00000000
eip=63af2ca1 esp=00eea04c ebp=00eea080 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200206
SgHI!HICreateHostIntegrity+0x73:
63af2ca1 89700c          mov     dword ptr [eax+0Ch],esi ds:0023:637964c4=????????
0:003> lm
start    end        module name
00400000 005b6000   Smc        (private pdb symbols) 
c:\symbols\Smc.pdb\5A03CAD3F9C04EA3946049B7C0A27CAE1\Smc.pdb
 ...
63580000 63584000   SgHIRes    (pdb symbols)         
c:\symbols\SgHIRes.pdb\82E676575B9845E88DD11159DCF5EC611\SgHIRes.pdb
 ...
63ac0000 63b36000   SgHI       (private pdb symbols) 
c:\symbols\SgHI.pdb\10A6640B6A8E46D2A2C036D714F7EC311\SgHI.pdb
 ...
 ...
Unloaded modules:
 ...
63760000 6379d000   GUProxy.plg
 ...
 ...
0:003> !address 637964b8 
                                     
Failed to map Heaps (error 80004005)
Address 637964b8 could not be mapped in any available regions
0:003> dt 637964b8 AFX_MODULE_STATE
Smc!AFX_MODULE_STATE
   +0x000 __VFN_table : ???? 
   +0x004 m_pCurrentWinApp : ???? 
   +0x008 m_hCurrentInstanceHandle : ???? 
   +0x00c m_hCurrentResourceHandle : ???? 
   +0x010 m_lpszCurrentAppName : ???? 
   +0x014 m_bDLL           : ??
   +0x015 m_bSystem        : ??
   +0x016 m_bReserved      : [2]  "--- memory read error at address 0x637964ce ---"
   +0x018 m_fRegisteredClasses : ??
   +0x01c m_pClassInit     : ???? 
   +0x020 m_classList      : CTypedSimpleList<CRuntimeClass *>
   +0x028 m_pFactoryInit   : ???? 
   +0x02c m_factoryList    : CTypedSimpleList<COleObjectFactory *>
   +0x034 m_nObjectCount   : ??
   +0x038 m_bUserCtrl      : ??
   +0x03c m_strUnregisterList :
ATL::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char> > >
   +0x040 m_pfnAfxWndProc  : ???? 
   +0x044 m_dwVersion      : ??
   +0x048 m_pfnFilterToolTipMessage : ???? 
   +0x04c m_libraryList    : CTypedSimpleList<CDynLinkLibrary *>
   +0x054 m_appLangDLL     : ???? 
   +0x058 m_pOccManager    : ???? 
   +0x05c m_lockList       : CTypedSimpleList<COleControlLock *>
   +0x064 m_pDaoState      : ???? 
   +0x068 m_typeLibCache   : CTypeLibCache
   +0x08c m_pTypeLibCacheMap : ???? 
   +0x090 m_thread         : CThreadLocal<AFX_MODULE_THREAD_STATE>
   +0x094 m_pDllIsolationWrappers : ???? 
   +0x098 m_bSetAmbientActCtx : ??
   +0x09c m_hActCtx        : ???? 
   +0x0a0 m_bInitNetworkAddressControl : ??
   +0x0a4 m_bInitNetworkAddressControlCalled : ??
Memory read error 6379655c

Let's see what the AfxGetModuleState() function does.
It calls mfc100!CThreadLocalObject::GetData function, and then add +4 offset to
the returned value to get the address it returns.
According to the function name, the data is obtained from TLS.

0:003> uf SgHI!AfxGetModuleState
SgHI!AfxGetModuleState:
63af3b7a ff258404b063    jmp     dword ptr
[SgHI!_imp_?AfxGetModuleStateYGPAVAFX_MODULE_STATEXZ (63b00484)]
mfc100!AfxGetModuleState:
78c959d6 68165bc978      push    offset
mfc100!CThreadLocal<_AFX_THREAD_STATE>::CreateObject (78c95b16)
78c959db b9bcfde178      mov     ecx,offset mfc100!_afxThreadState (78e1fdbc)
78c959e0 e8cb220100      call    mfc100!CThreadLocalObject::GetData (78ca7cb0)
78c959e5 85c0            test    eax,eax
78c959e7 7505            jne     mfc100!AfxGetModuleState+0x18 (78c959ee)
mfc100!AfxGetModuleState+0x13:
78c959e9 e913f70b00      jmp     mfc100!AfxThrowInvalidArgException (78d55101)
mfc100!AfxGetModuleState+0x18:
78c959ee 8b4004          mov     eax,dword ptr [eax+4]
78c959f1 85c0            test    eax,eax
78c959f3 7513            jne     mfc100!AfxGetModuleState+0x32 (78c95a08)
mfc100!AfxGetModuleState+0x1f:
78c959f5 68335bc978      push    offset
mfc100!CProcessLocal<_AFX_BASE_MODULE_STATE>::CreateObject (78c95b33)
78c959fa b9b8fde178      mov     ecx,offset mfc100!_afxBaseModuleState (78e1fdb8)
78c959ff e872230100      call    mfc100!CProcessLocalObject::GetData (78ca7d76)
78c95a04 85c0            test    eax,eax
78c95a06 74e1            je      mfc100!AfxGetModuleState+0x13 (78c959e9)
mfc100!AfxGetModuleState+0x32:
78c95a08 c3              ret
mfc100!AfxThrowInvalidArgException:
78d55101 8bff            mov     edi,edi
78d55103 55              push    ebp
78d55104 8bec            mov     ebp,esp
78d55106 51              push    ecx
78d55107 68a0e4dd78      push    offset mfc100!_TI5PAVCInvalidArgException
(78dde4a0)
78d5510c 8d45fc          lea     eax,[ebp-4]
78d5510f 50              push    eax
78d55110 c745fcd01fe178  mov     dword ptr [ebp-4],offset
mfc100!_simpleInvalidArgException (78e11fd0)
78d55117 e8ba9d0600      call    mfc100!_CxxThrowException (78dbeed6)
78d5511c cc              int     3
78d5511d cc              int     3
78d5511e cc              int     3
78d5511f cc              int     3
78d55120 cc              int     3
78d55121 cc              int     3
78d55122 8bff            mov     edi,edi
78d55124 55              push    ebp
78d55125 8bec            mov     ebp,esp
78d55127 f6450801        test    byte ptr [ebp+8],1
78d5512b 56              push    esi
78d5512c 8bf1            mov     esi,ecx
78d5512e c706043cb978    mov     dword ptr [esi],offset
mfc100!CSimpleException::`vftable' (78b93c04)
78d55134 7408            je      mfc100!CMemoryException::`scalar deleting
destructor'+0x1c (78d5513e)
mfc100!CMemoryException::`scalar deleting destructor'+0x14:
78d55136 56              push    esi
78d55137 ff153815b678    call    dword ptr [mfc100!_imp__free (78b61538)]
78d5513d 59              pop     ecx
mfc100!CMemoryException::`scalar deleting destructor'+0x1c:
78d5513e 8bc6            mov     eax,esi
78d55140 5e              pop     esi
78d55141 5d              pop     ebp
78d55142 c20400          ret     4
0:003> dps 63b00484 l1
63b00484  78c959d6 mfc100!AfxGetModuleState
0:003>