Function at 0x41c330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1298
call fcn.00439188
sub esp, eax
lea edi, [ebp - 0x122c]
mov eax, dword [esp + eax]
mov dword [esp + 0x10], 0
mov dword [ebp - 0x123c], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0xf
mov eax, dword [eax]
mov dword [esp], eax
call sym._MiniDumpReadDumpStream_20
mov dword [ebp - 0x1250], 1
sub esp, 0x14
test eax, eax
je 0x41c399
mov eax, dword [ebp - 0x122c]
test byte [eax + 4], 1
jne 0x41c900
xor eax, eax
mov edx, 0x3c
lea ebx, [ebp - 0x1018]
jmp 0x41c3b7
movzx edx, word [eax + str._minidump_exec_]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x41c3b0
mov edi, dword [ebp - 0x123c]
lea eax, [ebp - 0x122c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov eax, dword [edi]
mov dword [esp], eax
call sym._MiniDumpReadDumpStream_20
sub esp, 0x14
test eax, eax
je 0x41c8f0
mov eax, dword [ebp - 0x122c]
mov esi, dword [edi]
mov edx, dword [eax]
test edx, edx
jne 0x41cbf0
lea eax, [ebp - 0x122c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1228]
mov dword [esp + 8], eax
mov dword [esp + 4], 7
mov dword [esp], esi
call sym._MiniDumpReadDumpStream_20
sub esp, 0x14
test eax, eax
jne 0x41ca18
mov edi, dword [ebp - 0x1250]
mov dword [esp + 8], 0x900dbaad
mov dword [esp], dbg.tgt_process_minidump_close_process
mov dword [esp + 4], edi
call dbg.dbg_add_process
mov dword [0x4ad5ec], edi
mov edi, dword [ebp - 0x123c]
mov dword [0x4ad5f8], eax
mov dword [eax + 0x14], edi
mov dword [esp], eax
mov dword [esp + 4], ebx
call dbg.dbg_set_process_name
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x900dbaad
call dbg.dbg_init
lea eax, [ebp - 0x122c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 3
mov eax, dword [edi]
mov dword [esp], eax
call sym._MiniDumpReadDumpStream_20
sub esp, 0x14
test eax, eax
je 0x41c51d
mov ebx, dword [ebp - 0x122c]
mov esi, dword [ebx]
test esi, esi
je 0x41c51d
lea esi, [ebx + 4]
xor edi, edi
lea esi, [esi]
nop
mov eax, dword [esi + 0x10]
mov dword [esp + 8], 0
add edi, 1
add esi, 0x30
mov dword [esp + 0xc], eax
mov eax, dword [esi - 0x30]
mov dword [esp + 4], eax
mov eax, dword [0x4ad5f8]
mov dword [esp], eax
call dbg.dbg_add_thread
cmp dword [ebx], edi
ja 0x41c4f0
lea eax, [ebp - 0x122c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x123c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0xfff0
mov eax, dword [eax]
mov dword [esp], eax
call sym._MiniDumpReadDumpStream_20
sub esp, 0x14
test eax, eax
je 0x41c588
mov eax, dword [ebp - 0x122c]
lea edx, [ebp - 0x1220]
xor ebx, ebx
lea esi, [ebp - 0x818]
mov dword [ebp - 0x1258], edx
mov ecx, dword [eax]
mov dword [ebp - 0x1240], eax
lea edi, [eax + 4]
test ecx, ecx
jne 0x41c7bf
lea esi, [esi]
nop
lea eax, [ebp - 0x122c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x123c]
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._MiniDumpReadDumpStream_20
sub esp, 0x14
test eax, eax
je 0x41c8a8
mov eax, dword [ebp - 0x122c]
lea ecx, [ebp - 0x1220]
mov dword [ebp - 0x1240], 0
lea esi, [ebp - 0x818]
mov dword [ebp - 0x1258], ecx
mov ecx, dword [eax]
mov dword [ebp - 0x1260], eax
lea edi, [eax + 4]
test ecx, ecx
je 0x41c8a8
mov dword [ebp - 0x125c], esi
jmp 0x41c64b
mov eax, dword [edi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [edi]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0x900dbaad
call dbg.dbg_load_module
mov edx, dword [ebp - 0x1260]
add dword [ebp - 0x1240], 1
add edi, 0x6c
mov eax, dword [ebp - 0x1240]
cmp dword [edx], eax
jbe 0x41c8a8
mov eax, dword [ebp - 0x123c]
mov ebx, dword [edi + 0x14]
mov esi, dword [ebp - 0x125c]
add ebx, dword [eax]
mov edx, dword [ebx]
lea eax, [ebx + 4]
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call sym._memcpy
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1258]
xor edx, edx
mov dword [esp + 0x24], 0
shr eax, 1
mov dword [esp + 0x20], dbg.validate_file
mov word [ebp + eax*2 - 0x818], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov eax, dword [edi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0x900dbaad
call sym._SymFindFileInPathW_40
sub esp, 0x28
test eax, eax
jne 0x41c608
lea eax, [ebp - 0x1224]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x123c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0xfff0
mov eax, dword [eax]
mov dword [esp], eax
call sym._MiniDumpReadDumpStream_20
sub esp, 0x14
test eax, eax
jne 0x41c910
mov eax, dword [edi + 8]
mov dword [ebp - 0x1264], eax
mov eax, dword [ebp - 0x1264]
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
mov eax, dword [edi]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x125c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x900dbaad
call sym._SymLoadModuleExW_36
sub esp, 0x24
jmp 0x41c62d
mov eax, dword [edi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [edi]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1258]
mov dword [esp], 0x900dbaad
mov dword [esp + 8], eax
call dbg.dbg_load_module
mov eax, dword [ebp - 0x1240]
add ebx, 1
add edi, 0x6c
cmp dword [eax], ebx
jbe 0x41c588
mov eax, dword [ebp - 0x123c]
mov edx, dword [edi + 0x14]
add edx, dword [eax]
mov ecx, dword [edx]
lea eax, [edx + 4]
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [ebp - 0x1250], edx
call sym._memcpy
mov edx, dword [ebp - 0x1250]
mov eax, dword [edx]
xor edx, edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], dbg.validate_file
shr eax, 1
mov dword [esp + 0x18], 2
mov word [ebp + eax*2 - 0x818], dx
mov eax, dword [ebp - 0x1258]
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0
mov eax, dword [edi + 0xc]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0x900dbaad
call sym._SymFindFileInPathW_40
sub esp, 0x28
test eax, eax
jne 0x41c780
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
mov eax, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edi]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0x900dbaad
call sym._SymLoadModuleExW_36
sub esp, 0x24
jmp 0x41c7ab
lea eax, [ebp - 0x122c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x123c]
mov dword [esp + 8], 0
mov dword [esp + 4], 6
mov eax, dword [eax]
mov dword [esp], eax
call sym._MiniDumpReadDumpStream_20
sub esp, 0x14
test eax, eax
jne 0x41ca50
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x123c]
mov esi, dword [eax]
jmp 0x41c412
mov eax, dword [eax + 8]
mov dword [ebp - 0x1250], eax
jmp 0x41c399
mov edx, dword [ebp - 0x1224]
mov ecx, dword [edi + 8]
mov esi, dword [edx]
mov dword [ebp - 0x1264], ecx
lea eax, [edx + 4]
test esi, esi
je 0x41c720
mov edx, dword [edi]
xor ebx, ebx
mov dword [ebp - 0x1244], 0
mov dword [ebp - 0x1268], edi
mov dword [ebp - 0x1248], edx
xor edx, edx
add ecx, dword [ebp - 0x1248]
adc ebx, dword [ebp - 0x1244]
mov dword [ebp - 0x1250], ecx
mov dword [ebp - 0x124c], ebx
mov dword [ebp - 0x1254], esi
lea esi, [esi]
lea esi, [esi]
mov ecx, dword [ebp - 0x1248]
mov esi, dword [eax]
xor edi, edi
mov ebx, dword [ebp - 0x1244]
cmp ecx, esi
mov ecx, ebx
sbb ecx, edi
jb 0x41c9a1
mov ecx, dword [eax + 8]
xor ebx, ebx
add ecx, esi
adc ebx, edi
cmp ecx, dword [ebp - 0x1250]
mov ecx, ebx
sbb ecx, dword [ebp - 0x124c]
jae 0x41c9d0
add edx, 1
add eax, 0x6c
cmp edx, dword [ebp - 0x1254]
jne 0x41c970
mov dword [ebp - 0x126c], edi
mov edi, dword [ebp - 0x1268]
mov dword [ebp - 0x1270], esi
jmp 0x41c720
mov eax, dword [ebp - 0x1264]
mov dword [ebp - 0x126c], edi
mov edi, dword [ebp - 0x1268]
mov dword [ebp - 0x1270], esi
mov dword [esp + 0x10], eax
mov eax, dword [edi]
mov dword [esp + 4], 0
mov dword [esp], 0x900dbaad
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x125c]
mov dword [esp + 8], eax
call dbg.dbg_load_module
jmp 0x41c62d
mov eax, dword [ebp - 0x1250]
mov dword [esp], str.WineDbg_starting_on_minidump_on_pid__04lx_n
mov edi, dword [ebp - 0x122c]
mov dword [esp + 4], eax
call dbg.dbg_printf
movzx eax, word [edi]
cmp ax, 0xc
ja case.default.0x41ca41
jmp dword [eax*4 + 0x440ca8]
mov ebx, dword [ebp - 0x122c]
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [0x4ad5f8]
mov dword [esp], eax
call dbg.dbg_get_thread
mov dword [0x4ad5f4], eax
test eax, eax
je 0x41c8e5
mov edx, dword [ebx]
mov dword [eax + 0x64], 1
mov dword [0x4ad5f0], edx
mov edx, dword [ebx + 8]
mov dword [eax + 0x6c], edx
mov edx, dword [ebx + 0xc]
mov dword [eax + 0x70], edx
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x74], edx
mov edx, dword [ebx + 0x18]
mov dword [eax + 0x78], edx
mov edx, dword [ebx + 0x20]
mov dword [eax + 0x7c], edx
test edx, edx
je 0x41cabf
lea ecx, [ebx + 0x28]
sub eax, 0xffffff80
lea esi, [ecx + edx*8]
mov edx, dword [ecx]
add ecx, 8
add eax, 4
mov dword [eax - 4], edx
cmp esi, ecx
jne 0x41cab0
mov edx, dword [ebx + 0xa0]
mov ecx, 0x2cc
mov eax, 0x4ad320
mov edi, dword [ebp - 0x123c]
mov esi, dword [ebx + 0xa4]
cmp edx, ecx
cmova edx, ecx
add esi, dword [edi]
cmp edx, 4
jae 0x41cc53
test edx, edx
je 0x41cb00
movzx eax, byte [esi]
mov byte [0x4ad320], al
test dl, 2
jne 0x41d061
lea esi, [ebp - 0x1220]
mov dword [esp], esi
call sym._memory_get_current_pc
mov dword [esp], 0x4ad320
call dbg.stack_fetch_frames
mov eax, dword [0x4ad5f8]
mov edx, dword [0x4ad5f4]
mov eax, dword [eax + 0x2c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4ad320
mov edx, dword [edx + 0xc]
mov dword [esp], edx
call dword [eax + 0x1c]
mov dword [esp], 0xffffffff
call dbg.stack_info
mov eax, dword [0x4ad5f8]
mov edx, dword [0x4ad5f4]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 0x4ad320
mov edx, dword [edx + 0xc]
mov dword [esp], edx
call dword [eax + 0x20]
mov eax, dword [ebx]
mov dword [esp], eax
call dbg.stack_backtrace
mov dword [esp], esi
mov dword [esp + 4], 0
call dbg.source_list_from_addr
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ax, 0xffff
mov edx, str.Unknown
mov eax, 0x440b1d
cmove eax, edx
movzx edx, byte [edi + 6]
mov esi, 0x440b5a
mov ecx, 0x440b5b
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
cmp dl, 2
mov dword [esp + 8], edx
cmovb ecx, esi
mov dword [esp], str.___ls_was_running_on__d__s_CPU_s
mov dword [esp + 0x10], ecx
call dbg.dbg_printf
mov eax, dword [edi + 8]
sub eax, 3
cmp eax, 7
ja case.0x41cbe0.7
jmp dword [eax*4 + 0x440cdc]
mov edi, dword [eax + 0x18]
add edi, esi
mov edx, dword [edi]
mov eax, edi
mov dword [esp], ebx
add eax, 4
mov dword [esp + 8], edx
mov edi, edx
mov dword [esp + 4], eax
shr edi, 1
call sym._memcpy
xor eax, eax
mov word [ebp + edi*2 - 0x1018], ax
lea eax, [ebx + edi*2 - 2]
cmp eax, ebx
jb 0x41c412
lea esi, [esi]
lea esi, [esi]
movzx edx, word [eax]
cmp dx, 0x2f
je 0x41ce40
cmp dx, 0x5c
je 0x41ce40
sub eax, 2
cmp eax, ebx
jae 0x41cc30
jmp 0x41c412
mov ecx, dword [esi + edx - 4]
mov edi, eax
mov dword [edx + 0x4ad31c], ecx
lea ecx, [edx - 1]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
jmp 0x41cb00
mov eax, 0x440b1d
lea esi, [esi]
mov edx, dword [edi + 0x10]
mov dword [esp + 4], eax
mov dword [esp], str._on_Windows__s___u__n
mov dword [esp + 8], edx
call dbg.dbg_printf
mov eax, dword [ebp - 0x1228]
cmp dword [eax + 4], 0x3b
ja 0x41c449
mov eax, dword [eax + 8]
add eax, 0x3c
cmp dword [edi + 0x18], eax
jb 0x41c449
mov eax, dword [ebp - 0x122c]
cmp byte [eax + 0x38], 0x57
jne 0x41c449
cmp byte [eax + 0x39], 0x49
jne 0x41c449
cmp byte [eax + 0x3a], 0x4e
jne 0x41c449
cmp byte [eax + 0x3b], 0x45
jne 0x41c449
cmp dword [eax + 0x3c], 2
jbe 0x41c449
mov edx, dword [eax + 0x48]
lea ecx, [eax + 0x3c]
add edx, ecx
mov dword [esp + 0xc], edx
mov edx, dword [eax + 0x44]
add edx, ecx
mov dword [esp + 8], edx
add ecx, dword [eax + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], str._____on__s__on_top_of__s___s___n
call dbg.dbg_printf
jmp 0x41c449
mov eax, 0x440b1d
jmp 0x41cba1
cmp dword [edi + 0xc], 0x33
mov eax, str.NT_3.51
mov edx, str.3_____
cmovne eax, edx
jmp 0x41cc78
mov edx, dword [edi + 0xc]
mov eax, 0x440b67
cmp edx, 1
je 0x41cc78
cmp edx, 2
je 0x41cfb0
test edx, edx
mov eax, str.5_____
mov edx, str.2000
cmove eax, edx
jmp 0x41cc78
mov edx, dword [edi + 0xc]
mov eax, 0x440b64
cmp edx, 0xa
je 0x41cc78
mov eax, 0x440b8b
cmp edx, 0x5a
je 0x41cc78
mov eax, str.4_____
test edx, edx
jne 0x41cc78
cmp dword [edi + 0x14], 2
mov edx, str.NT_4.0
mov eax, 0x440b81
cmove eax, edx
jmp 0x41cc78
mov edx, dword [edi + 0xc]
mov eax, str.10_____
test edx, edx
jne 0x41cc78
cmp byte [edi + 7], 1
mov edx, str.Win10
cmove eax, edx
jmp 0x41cc78
mov eax, dword [edi + 0xc]
cmp eax, 2
je 0x41cfd2
ja 0x41ce06
test eax, eax
je 0x41cf8f
movzx edx, byte [edi + 7]
mov eax, str.Win7
cmp dl, 1
je 0x41cc78
cmp dl, 3
mov eax, str.Server_2008
mov edx, str.6_____
cmovne eax, edx
jmp 0x41cc78
cmp eax, 3
jne 0x41cfa6
movzx edx, byte [edi + 7]
mov eax, str.Win8.1
cmp dl, 1
je 0x41cc78
cmp dl, 3
mov eax, str.Server_2012_R2
mov edx, str.6_____
cmovne eax, edx
jmp 0x41cc78
cmp word [eax + 2], 0
lea edi, [eax + 2]
je 0x41d03d
mov edx, edi
mov ecx, edx
add edx, 2
cmp word [edx], 0
jne 0x41ce50
sub ecx, eax
add ecx, 2
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_memmove]
jmp 0x41c412
mov ecx, 0x206c
mov byte [ebp - 0x812], 0
mov dword [ebp - 0x818], 0x65746e49
mov word [ebp - 0x814], cx
movzx eax, word [edi + 2]
lea edx, [eax - 3]
mov eax, 0x440b1d
cmp dx, 0xc
ja 0x41ceaf
movzx edx, dx
mov eax, dword [edx*4 + 0x440d80]
mov dword [esp + 4], eax
lea eax, [ebp - 0x812]
lea esi, [ebp - 0x818]
mov dword [esp], eax
call sym._strcpy
movzx eax, word [edi + 2]
movzx ecx, word [edi + 4]
sub eax, 3
cmp ax, 1
ja 0x41cff9
mov eax, ecx
mov dword [ebp - 0x1254], ecx
shr ax, 8
mov dword [esp], esi
mov word [ebp - 0x1240], ax
call dword [sym.imp.ucrtbase.dll_strlen]
mov ecx, dword [ebp - 0x1254]
cmp word [ebp - 0x1240], 0xff
lea edx, [esi + eax]
je 0x41d047
movzx eax, cl
mov dword [esp + 0xc], eax
movzx eax, word [ebp - 0x1240]
add eax, 0x41
movzx eax, ax
mov dword [esp + 8], eax
mov dword [esp + 4], str.___c_d_
mov dword [esp], edx
call sym._sprintf_2
mov eax, esi
jmp 0x41cba1
mov eax, str.Alpha
jmp 0x41cba1
mov eax, str.PowerPC
jmp 0x41cba1
mov eax, str.X86_64
jmp 0x41cba1
mov eax, str.Neutral
jmp 0x41cba1
mov eax, str.ARM64
jmp 0x41cba1
mov eax, 0x440b3e
jmp 0x41cba1
mov eax, str.MSIL
jmp 0x41cba1
mov eax, str.Mips
jmp 0x41cba1
movzx edx, byte [edi + 7]
mov eax, str.Vista
cmp dl, 1
jne 0x41cdf1
jmp 0x41cc78
mov eax, str.6_____
jmp 0x41cc78
movzx edx, byte [edi + 7]
cmp dl, 1
je 0x41cc78
cmp dl, 3
mov eax, str.5_____
mov edx, str.Server_2003
cmove eax, edx
jmp 0x41cc78
movzx edx, byte [edi + 7]
mov eax, str.Win8
cmp dl, 1
je 0x41cc78
cmp dl, 3
mov eax, str.Server_2012
mov edx, str.6_____
cmovne eax, edx
jmp 0x41cc78
mov dword [ebp - 0x1240], ecx
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ecx, dword [ebp - 0x1240]
mov dword [esp + 4], str.___d._d_
mov edx, eax
movzx eax, cl
add edx, esi
mov dword [esp + 0xc], eax
mov eax, ecx
shr ax, 8
mov dword [esp], edx
movzx eax, ax
mov dword [esp + 8], eax
call sym._sprintf_2
mov eax, esi
jmp 0x41cba1
mov ecx, 2
jmp 0x41ce60
mov eax, ecx
and eax, 0xf
mov dword [esp + 0xc], eax
mov eax, ecx
shr ax, 4
and eax, 0xf
add eax, 0x37
jmp 0x41cf24
movzx eax, word [esi + edx - 2]
mov word [edx + 0x4ad31e], ax
jmp 0x41cb00