Function at 0x411540
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x500
xor eax, eax
push ebx
mov dword [esp + 0x16], eax
push ebp
mov dword [esp + 0x1e], eax
push esi
lea ecx, [esp + 0x1c]
push edi
xor esi, esi
mov dword [esp + 0x2a], eax
push ecx
mov word [esp + 0x24], si
mov word [esp + 0x32], ax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2a]
mov ecx, dword [esp + 0x28]
and edx, 0xffff
and eax, 0xffff
mov ebp, dword [esp + 0x514]
push edx
mov edx, dword [esp + 0x24]
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x2e]
push ecx
mov ecx, dword [esp + 0x2e]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
push str.Unhandled_exception:__02d__02d__04d__02d:_02d:_02d_r_n
push ebp
call fcn.00411cc0
mov edx, dword [esp + 0x538]
add esp, 0x20
mov ebx, dword [edx]
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
cmp eax, 0xc000008d
ja 0x4116b3
je 0x4116a9
cmp eax, 0xc0000006
ja 0x411656
je 0x41164c
cmp eax, 0x80000003
ja 0x411626
je 0x41161c
cmp eax, 0x80000001
je 0x411612
cmp eax, 0x80000002
jne case.0x4116c6.1073741672
mov eax, str.DATATYPE_MISALIGNMENT
jmp 0x41173c
mov eax, str.GUARD_PAGE
jmp 0x41173c
mov eax, str.BREAKPOINT
jmp 0x41173c
cmp eax, 0x80000004
je 0x411642
cmp eax, 0xc0000005
jne case.0x4116c6.1073741672
mov eax, str.ACCESS_VIOLATION
jmp 0x41173c
mov eax, str.SINGLE_STEP
jmp 0x41173c
mov eax, str.IN_PAGE_ERROR
jmp 0x41173c
lea edi, [eax + 0x3ffffff8]
cmp edi, 0x84
ja case.0x4116c6.1073741672
xor ecx, ecx
mov cl, byte [edi + 0x411ae8]
jmp dword [ecx*4 + 0x411ad0]
mov eax, str.ARRAY_BOUNDS_EXCEEDED
jmp 0x41173c
mov eax, str.ILLEGAL_INSTRUCTION
jmp 0x41173c
mov eax, str.NONCONTINUABLE_EXCEPTION
jmp 0x41173c
mov eax, str.INVALID_DISPOSITION
jmp 0x41173c
mov eax, str.INVALID_HANDLE
jmp 0x41173c
mov eax, str.FLT_DENORMAL_OPERAND
jmp 0x41173c
lea edi, [eax + 0x3fffff72]
cmp edi, 0x6f
ja case.0x4116c6.1073741672
xor edx, edx
mov dl, byte [edi + 0x411b9c]
jmp dword [edx*4 + 0x411b70]
mov eax, str.FLT_DIVIDE_BY_ZERO
jmp 0x41173c
mov eax, str.FLT_INEXACT_RESULT
jmp 0x41173c
mov eax, str.FLT_INVALID_OPERATION
jmp 0x41173c
mov eax, str.FLT_OVERFLOW
jmp 0x41173c
mov eax, str.FLT_STACK_CHECK
jmp 0x41173c
mov eax, str.FLT_UNDERFLOW
jmp 0x41173c
mov eax, str.INT_DIVIDE_BY_ZERO
jmp 0x41173c
mov eax, str.INT_OVERFLOW
jmp 0x41173c
mov eax, str.PRIV_INSTRUCTION
jmp 0x41173c
mov eax, str.STACK_OVERFLOW
jmp 0x41173c
push esi
push 0x200
push 0x46fc44
push esi
push eax
push 0x43d460
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0xa00
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, 0x46fc44
push eax
mov eax, dword [ebx]
push eax
push str.Exception_code:__08X__s_r_n
push ebp
call fcn.00411cc0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x101]
mov byte [esp + 0x100], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x44]
mov dword [esp + 0x40], 0
add esp, 0x10
mov dword [esp + 0x18], esi
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], esi
mov esi, dword [ebx + 0xc]
lea ecx, [esp + 0x30]
push 0x1c
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41181a
mov edi, dword [esp + 0x34]
lea edx, [esp + 0xf0]
push 0x104
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x41181a
mov eax, dword [edi + 0x3c]
xor ecx, ecx
add eax, edi
sub esi, edi
mov dword [esp + 0x1c], 0
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x41181a
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov edi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, edi
ja 0x4117eb
mov edx, edi
cmp esi, ebx
jb 0x4117f5
add edx, ebx
cmp esi, edx
jbe 0x411807
mov edx, dword [esp + 0x1c]
add eax, 0x28
inc edx
cmp edx, ecx
mov dword [esp + 0x1c], edx
jb 0x4117dd
jmp 0x411816
mov edx, dword [esp + 0x1c]
inc edx
sub esi, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea eax, [esp + 0xf0]
push eax
mov eax, dword [ebx + 0xc]
push ecx
push edx
push eax
push str.Fault_address:___08X__02X:_08X__s_r_n
push ebp
call fcn.00411cc0
mov ecx, dword [esp + 0x530]
add esp, 0x18
mov esi, dword [ecx + 4]
push str._nRegisters:_r_n
push ebp
call fcn.00411cc0
mov edx, dword [esi + 0x9c]
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0xa8]
add esp, 8
push edx
mov edx, dword [esi + 0xac]
push eax
mov eax, dword [esi + 0xa4]
push ecx
mov ecx, dword [esi + 0xb0]
push edx
push eax
push ecx
push str.EAX:_08X_r_nEBX:_08X_r_nECX:_08X_r_nEDX:_08X_r_nESI:_08X_r_nEDI:_08X_r_n
push ebp
call fcn.00411cc0
mov edx, dword [esi + 0xb8]
mov eax, dword [esi + 0xbc]
add esp, 0x20
push edx
push eax
push str.CS:EIP:_04X:_08X_r_n
push ebp
call fcn.00411cc0
mov ecx, dword [esi + 0xb4]
mov edx, dword [esi + 0xc4]
mov eax, dword [esi + 0xc8]
add esp, 0x10
push ecx
push edx
push eax
push str.SS:ESP:_04X:_08X__EBP:_08X_r_n
push ebp
call fcn.00411cc0
mov ecx, dword [esi + 0x8c]
mov edx, dword [esi + 0x90]
mov eax, dword [esi + 0x94]
add esp, 0x14
push ecx
mov ecx, dword [esi + 0x98]
push edx
push eax
push ecx
push str.DS:_04X__ES:_04X__FS:_04X__GS:_04X_r_n
push ebp
call fcn.00411cc0
mov edx, dword [esi + 0xc0]
add esp, 0x18
push edx
push str.Flags:_08X_r_n
push ebp
call fcn.00411cc0
add esp, 0xc
push str.Call_stack:_r_n
push ebp
call fcn.00411cc0
add esp, 8
push str.Address_tFrame_r_n
push ebp
call fcn.00411cc0
add esp, 8
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xb8]
mov ecx, dword [esi + 0xc4]
mov edx, dword [esi + 0xb4]
mov dword [esp + 0x4c], eax
mov eax, 3
mov dword [esp + 0x70], ecx
mov ecx, dword [sym.imp.IMAGEHLP.dll_SymFunctionTableAccess]
mov dword [esp + 0x54], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x6c], eax
mov eax, dword [sym.imp.IMAGEHLP.dll_SymGetModuleBase]
push 0
push eax
mov dword [esp + 0x6c], edx
push ecx
push 0
lea edx, [esp + 0x5c]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push eax
push 0x14c
call dword [sym.imp.IMAGEHLP.dll_StackWalk]
test eax, eax
je 0x411ab5
mov eax, dword [esp + 0x64]
test eax, eax
je 0x411ab5
push eax
mov eax, dword [esp + 0x50]
push eax
push str._08X_t_08X
push ebp
call fcn.00411cc0
mov eax, dword [esp + 0x5c]
add esp, 0x10
lea ecx, [esp + 0x2f8]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
mov dword [esp + 0x304], 0x218
mov dword [esp + 0x314], 0x200
mov dword [esp + 0x24], 0
call ebx
push eax
call dword [sym.imp.IMAGEHLP.dll_SymGetSymFromAddr]
test eax, eax
je 0x411a17
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x30c]
push ecx
push edx
push str._hs_X_r_n
call fcn.00411cc0
add esp, 0xc
jmp 0x411a80
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1f5]
mov byte [esp + 0x1f4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
lea edx, [esp + 0x1f4]
push eax
mov eax, dword [esp + 0x50]
push ecx
push 0x104
push edx
push eax
call fcn.00411c10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
add esp, 0x14
lea ecx, [esp + 0x1f4]
push ecx
push edx
push eax
push str._04X:_08X__s_r_n
push ebp
call fcn.00411cc0
add esp, 0x14
mov ecx, dword [sym.imp.IMAGEHLP.dll_SymGetModuleBase]
mov edx, dword [sym.imp.IMAGEHLP.dll_SymFunctionTableAccess]
push 0
push ecx
push edx
push 0
lea eax, [esp + 0x5c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call ebx
push eax
push 0x14c
call dword [sym.imp.IMAGEHLP.dll_StackWalk]
test eax, eax
jne 0x41199e
push 0x43d404
push ebp
call fcn.00411cc0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x500
ret