# 11 Id: 26a4.1470 Suspend: 1 Teb: 7ff9f000 Unfrozen
# Memory ChildEBP RetAddr Args to Child
00 01cab618 3d3e159e 3eca0000 00000001 3d3e62f0 kernel32!FindResourceW (FPO: [Non-Fpo])
01 44c 01caba64 3d3bbe6f 001688a4 00000008 00000000 mshtml!LoadMUILibraryW+0xf7 (FPO: [Non-Fpo])
02 2a0 01cabd04 3d27896c 07d9785c 00256838 0025683c mshtml!CResProtocol::DoParseAndBind+0x1f5
03 18 01cabd1c 3d278919 002567a0 002567b4 00000000 mshtml!CResProtocol::ParseAndBind+0x25 (FPO: [0,0,0])
04 24 01cabd40 43ce9691 002567b4 06773888 06928840 mshtml!CResProtocol::Start+0xa4
05 34 01cabd74 43ce8fea 00000000 07d94f20 06928840 urlmon!COInetProt::StartEx+0xf1 (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon ransprothndl.cxx @ 424]
06 50 01cabdc4 43ce9577 06928840 00000000 07c58770 urlmon!CTransaction::StartEx+0x3f3 (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon rans ransact.cxx @ 4080]
07 88 01cabe4c 43ce9188 07d94f20 001a5b68 3d19e848 urlmon!CBinding::StartBinding+0x602 (FPO: [Non-Fpo]) (CONV: thiscall) [d:4840inetcoreurlmon ranscbinding.cxx @ 2084]
08 44 01cabe90 43cea111 0020cbd0 00000000 001a5b68 urlmon!CUrlMon::StartBinding+0x169 (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon ransurlmon.cxx @ 1047]
09 28 01cabeb8 3d19e7d8 0020cbd0 00000000 00000000 urlmon!CUrlMon::BindToStorage+0x90 (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon ransurlmon.cxx @ 920]
0a 2c 01cabee4 3d19e6dd 001bad30 06773888 00000000 mshtml!CStreamProxy::Bind+0xce
0b 2a0 01cac184 3d19aebf 07c70068 00000001 873f8800 mshtml!CDwnBindData::Bind+0x74b
0c 28 01cac1ac 3d19ad60 00000000 07e3b4c4 00000001 mshtml!NewDwnBindData+0x15f
0d 50 01cac1fc 3d11f4ab 01cac438 00001fdd 873f8800 mshtml!CDwnLoad::Init+0x121
0e 54 01cac250 3d19a6a9 01cac438 07e3ad60 07e31e10 mshtml!CHtmLoad::Init+0x1fd
0f 24 01cac274 3d19a5af 00000000 00000000 01cac438 mshtml!CDwnInfo::SetLoad+0x119
10 20 01cac294 3d11e233 07e31e10 00000001 00000000 mshtml!CDwnCtx::SetLoad+0x7a
11 18 01cac2ac 3d11efdb 00000001 00000000 07bd7b00 mshtml!CHtmCtx::SetLoad+0x13
12 20 01cac2cc 3d1124a1 01cac438 00800000 00009300 mshtml!CMarkup::Load+0x167
13 204 01cac4d0 3d2befb2 01cac5c8 00009300 00000000 mshtml!CMarkup::LoadFromInfo+0xb5a
14 1d8 01cac6a8 3d2bf20d 0024e578 01cac734 07c167c0 mshtml!CDoc::DoNavigate+0x150f
15 120 01cac7c8 3d2a64bb 07cc0df8 00000000 00000000 mshtml!CDoc::FollowHyperlink2+0xdb0
16 b4 01cac87c 3d4391dd 065b0860 07cc0df8 00000000 mshtml!CWindow::SuperNavigateInternal+0x3aa
17 34 01cac8b0 3ee76262 065b0860 07cc0df8 00000000 mshtml!CWindow::SuperNavigate3+0x25
18 1098 01cad948 3ee77410 065b0874 07e32054 00000001 IEFRAME!CDocObjectHost::_DisplayHttpErrorPage+0x284 (FPO: [Non-Fpo])
19 e0 01cada28 3ede5267 00000005 00000000 3d1971d0 IEFRAME!CDocObjectHost::_HandleFailedNavigation+0x4ae (FPO: [Non-Fpo])
1a 20 01cada48 3ed575d5 00000001 00000000 01cadb08 IEFRAME!CDocObjectHost::_HandleDocHostCmdPriv+0x8c (FPO: [Non-Fpo])
1b 2c 01cada74 3d1ce75f 00000001 3d1971c0 00000001 IEFRAME!CDocObjectHost::Exec+0xad (FPO: [Non-Fpo])
1c 28 01cada9c 3d42a60e 3d1971c0 00000001 00000000 mshtml!CTExec+0x3e
1d 7c 01cadb18 3d36deee 07bd76a0 800c0008 065b0874 mshtml!CMarkup::DoAutoSearch+0x4a7
1e 30 01cadb48 3d36dc45 800c0008 00000000 07d984d8 mshtml!CDwnBindData::HandleFailedNavigation+0x179
1f 50 01cadb98 3d2cb242 07c6fec0 800c0008 00000000 mshtml!CDwnBindData::OnStopBinding+0x4c1
20 14 01cadbac 43ce769f 07e3ad28 800c0008 00000000 mshtml!CBindingXSSFilter::OnStopBinding+0x20 (FPO: [Non-Fpo])
21 20 01cadbcc 43ce7612 07d984d8 800c0008 00000000 urlmon!CBSCHolder::OnStopBinding+0x4b (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmonmonmpxbsc.cxx @ 963]
22 1c 01cadbe8 43d247f6 07c588d0 800c0008 00000000 urlmon!CBinding::CallOnStopBinding+0x45 (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon ranscbinding.cxx @ 4352]
23 24 01cadc0c 43ce789a 07c588d0 f4000000 00000000 urlmon!CBinding::OnTransNotification+0x24d (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon ranscbinding.cxx @ 2596]
24 30 01cadc3c 43ce7936 07c588d8 800c0008 00002f78 urlmon!CBinding::ReportResult+0x63 (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon ranscbinding.cxx @ 4924]
25 18 01cadc54 43ce64ef 06928d4c 800c0008 00002f78 urlmon!COInetProt::ReportResult+0x1a (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon ransprothndl.cxx @ 1671]
26 28 01cadc7c 43ce6205 06928b68 f0000000 00000000 urlmon!CTransaction::DispatchReport+0x1ed (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon rans ransact.cxx @ 2699]
27 2c 01cadca8 43ce6424 06928b68 07d9a080 00000000 urlmon!CTransaction::DispatchPacket+0x31 (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon rans ransact.cxx @ 3016]
28 20 01cadcc8 43d05247 06928b68 00000000 01cadd48 urlmon!CTransaction::OnINetCallback+0x92 (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon rans ransact.cxx @ 3079]
29 18 01cadce0 77d18734 040d0ccc 00000465 00000000 urlmon!TransactionWndProc+0x28 (FPO: [Non-Fpo]) (CONV: stdcall) [d:4840inetcoreurlmon rans ransact.cxx @ 3237]
2a 2c 01cadd0c 77d18816 43d0521f 040d0ccc 00000465 USER32!InternalCallWinProc+0x28
2b 68 01cadd74 77d189cd 00000000 43d0521f 040d0ccc USER32!UserCallWinProcCheckWow+0x150 (FPO: [Non-Fpo])
2c 60 01caddd4 77d18a10 01cade08 00000000 01cafeec USER32!DispatchMessageWorker+0x306 (FPO: [Non-Fpo])
2d 10 01cadde4 3edcc2d5 01cade08 00000000 003f6b40 USER32!DispatchMessageW+0xf (FPO: [Non-Fpo])
2e 2108 01cafeec 3ed7330f 00171de8 7c935b58 00177a98 IEFRAME!CTabWindow::_TabWindowThreadProc+0x54c (FPO: [Non-Fpo])
2f b8 01caffa4 3ec18111 003f6b40 0013fa28 01caffec IEFRAME!LCIETab_ThreadProc+0x2c1 (FPO: [Non-Fpo])
30 10 01caffb4 7c80b729 00177a98 7c935b58 0013fa28 iertutil!CIsoScope::RegisterThread+0xab (FPO: [Non-Fpo])
31 38 01caffec 00000000 3ec18103 00177a98 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])
static HRESULT WINAPI ResProtocol_Start(IInternetProtocol *iface, LPCWSTR szUrl,
IInternetProtocolSink* pOIProtSink, IInternetBindInfo* pOIBindInfo,
DWORD grfPI, HANDLE_PTR dwReserved)
res://ieframe.dll/forbidframing.htm
.text:3ED4A3CD ; ---------------------------------------------------------------------------
.text:3ED4A3D0 aDocument: ; DATA XREF: sub_3ED4E1EB+27o
.text:3ED4A3D0 ; .text:3EE2187Co
.text:3ED4A3D0 unicode 0, <document>,0
.text:3ED4A3E2 align 4
.text:3ED4A3E4 aForbidframing_: ; DATA XREF: .data:3F00D90Co
.text:3ED4A3E4 ; .data:3F00D910o
.text:3ED4A3E4 unicode 0, <forbidframing.htm>,0
.text:3ED4A408 aUnknownprotoco: ; DATA XREF: .data:3F00D8F8o
.text:3ED4A408 ; .data:3F00D8FCo
.text:3ED4A408 unicode 0, <unknownprotocol.htm>,0
.text:3ED4A430 aSslnavcancel_h: ; DATA XREF: .data:3F00D8E4o
.text:3ED4A430 ; .data:3F00D8E8o
.text:3ED4A430 unicode 0, <sslnavcancel.htm>,0
.text:3ED4A452 align 4
.text:3ED4A454 aInvalidcert_ht: ; DATA XREF: .data:3F00D8D0o
.text:3ED4A454 ; .data:3F00D8D4o
.text:3ED4A454 unicode 0, <invalidcert.htm>,0
.text:3ED4A474 aPhishsite_htm: ; DATA XREF: .data:3F00D8BCo
.text:3ED4A474 ; .data:3F00D8C0o
.text:3ED4A474 unicode 0, <PhishSite.htm>,0
.text:3ED4A490 aOffcancl_weboc: ; DATA XREF: .data:3F00D8ACo
.text:3ED4A490 unicode 0, <offcancl_webOC.htm>,0
.text:3ED4A4B6 align 4
.text:3ED4A4B8 aOffcancl_htm: ; DATA XREF: sub_3ED24EA4+C87B4o
.text:3ED4A4B8 ; sub_3ED59C99+9464Eo ...
.text:3ED4A4B8 unicode 0, <offcancl.htm>,0
.text:3ED4A4D2 align 4
.text:3ED4A4D4 aHttp_501_weboc: ; DATA XREF: .data:3F00D884o
.text:3ED4A4D4 ; .data:3F00D898o
.text:3ED4A4D4 unicode 0, <http_501_webOC.htm>,0
.text:3ED4A4FA align 4
.text:3ED4A4FC aHttp_501_htm: ; DATA XREF: .data:3F00D880o
.text:3ED4A4FC ; .data:3F00D894o
.text:3ED4A4FC unicode 0, <http_501.htm>,0
.text:3ED4A516 align 4
.text:3ED4A518 aHttp_500_weboc: ; DATA XREF: .data:3F00D870o
.text:3ED4A518 unicode 0, <http_500_webOC.htm>,0
.text:3ED4A53E align 10h
.text:3ED4A540 aHttp_500_htm: ; DATA XREF: .data:3F00D86Co
.text:3ED4A540 unicode 0, <http_500.htm>,0
.text:3ED4A55A align 4
.text:3ED4A55C aHttp_410_weboc: ; DATA XREF: .data:3F00D85Co
.text:3ED4A55C unicode 0, <http_410_webOC.htm>,0
.text:3ED4A582 align 4
.text:3ED4A584 aHttp_410_htm: ; DATA XREF: .data:3F00D858o
.text:3ED4A584 unicode 0, <http_410.htm>,0
.text:3ED4A59E align 10h
.text:3ED4A5A0 aServbusy_weboc: ; DATA XREF: .data:3F00D834o
.text:3ED4A5A0 ; .data:3F00D848o
.text:3ED4A5A0 unicode 0, <servbusy_webOC.htm>,0
.text:3ED4A5C6 align 4
.text:3ED4A5C8 aServbusy_htm: ; DATA XREF: .data:3F00D830o
.text:3ED4A5C8 ; .data:3F00D844o
.text:3ED4A5C8 unicode 0, <servbusy.htm>,0
.text:3ED4A5E2 align 4
.text:3ED4A5E4 aHttp_406_weboc: ; DATA XREF: .data:3F00D820o
.text:3ED4A5E4 unicode 0, <http_406_webOC.htm>,0
.text:3ED4A60A align 4
.text:3ED4A60C aHttp_406_htm: ; DATA XREF: .data:3F00D81Co
.text:3ED4A60C unicode 0, <http_406.htm>,0
.text:3ED4A626 align 4
.text:3ED4A628 aHttp_gen_weboc: ; DATA XREF: .data:3F00D80Co
.text:3ED4A628 unicode 0, <http_gen_webOC.htm>,0
.text:3ED4A64E align 10h
.text:3ED4A650 aHttp_gen_htm: ; DATA XREF: .data:3F00D808o
.text:3ED4A650 unicode 0, <http_gen.htm>,0
.text:3ED4A66A align 4
.text:3ED4A66C aHttp_403_weboc: ; DATA XREF: .data:3F00D7F8o
.text:3ED4A66C unicode 0, <http_403_webOC.htm>,0
.text:3ED4A692 align 4
.text:3ED4A694 aHttp_403_htm: ; DATA XREF: .data:3F00D7F4o
.text:3ED4A694 unicode 0, <http_403.htm>,0
.text:3ED4A6AE align 10h
.text:3ED4A6B0 aHttp_400_weboc: ; DATA XREF: .data:3F00D7E4o
.text:3ED4A6B0 unicode 0, <http_400_webOC.htm>,0
.text:3ED4A6D6 align 4
.text:3ED4A6D8 aHttp_400_htm: ; DATA XREF: .data:3F00D7E0o
.text:3ED4A6D8 unicode 0, <http_400.htm>,0
.text:3ED4A6F2 align 4
.text:3ED4A6F4 aNavcancl_htm: ; DATA XREF: sub_3ECC526C:loc_3EDED5D6o
.text:3ED4A6F4 ; sub_3ED24EA4:loc_3EDED65Fo ...
.text:3ED4A6F4 unicode 0, <navcancl.htm>,0
.text:3ED4A70E align 10h
.text:3ED4A710 aDnserrordiagof: ; DATA XREF: .data:3F00D7A8o
.text:3ED4A710 unicode 0, <dnserrordiagoff_webOC.htm>,0
.text:3ED4A744 aDnserrordiag_0: ; DATA XREF: .data:3F00D7A4o
.text:3ED4A744 unicode 0, <dnserrordiagoff.htm>,0
.text:3ED4A76C aDnserror_htm: ; DATA XREF: .data:3F00D790o
.text:3ED4A76C ; .data:3F00D794o
.text:3ED4A76C unicode 0, <dnserror.htm>,0
.text:3ED4A786 align 4
.text:3ED4A788 aHttp_404_weboc: ; DATA XREF: .data:off_3F00D780o
.text:3ED4A788 unicode 0, <http_404_webOC.htm>,0
.text:3ED4A7AE align 10h
.text:3ED4A7B0 aHttp_404_htm: ; DATA XREF: .data:off_3F00D77Co
.text:3ED4A7B0 unicode 0, <http_404.htm>,0
.text:3ED4A7CA align 4