Stack overflows: possible return addresses

English Windows XP SP 2 User32.dll:
JMP ESP 0x77db41bc

English Windows XP SP 1 User32.dll:
JMP ESP 0x77d718fc

English Windows 2003 SP0 and SP1 User32.dll:
JMP ESP 0x77d74adc

English Windows 2000 SP 4 User32.dll:
JMP ESP 0x77e3c256

French Windows XP Pro SP2:
JMP ESP 0x77d8519f

German/Italian/Dutch/Polish Windows XP SP2:
JMP ESP 0x77d873a0

Spainish Windows XP Pro SP2:
JMP ESP 0x77d9932f

French/Italian/German/Polish/Dutch Windows 2000 Pro SP4:
JMP ESP 0x77e04c29

French/Italian/Chineese Windows 2000 Server SP4:
JMP ESP 0x77df4c29

http://www.securityfocus.com/archive/1/496578