Hi Wei, I tested a "push esp; ret" from msvcrt.dll as you indicated via email. However this did not work for me probably because i'm using a vm. I don't have a physical box to test with. I did test shell32 as Peter mentioned suggested, and it worked good. What do you suggest?

'Ret' => 0x77C11064, # push esp; ret from msvcrt.dll
'Ret' => 0x7CB41020, # jmp esp; ret from shell32.dll