Function at 0x41f540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
mov eax, 0x12a8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0042b540
sub rsp, rax
xor r8d, r8d
mov edx, 0xf
mov esi, 1
mov qword [rsp + 0x20], 0
mov rbp, rcx
lea r14, [rsp + 0x78]
mov rcx, qword [rcx]
mov r9, r14
call sym.MiniDumpReadDumpStream
test eax, eax
je 0x41f595
mov rax, qword [rsp + 0x78]
test byte [rax + 4], 1
jne 0x41fa00
lea r12, [rsp + 0x2a0]
lea rax, str._minidump_exec_
mov rdx, r12
nop word [rax + rax]
movzx ecx, word [rax]
add rax, 2
add rdx, 2
mov word [rdx - 2], cx
test cx, cx
jne 0x41f5b0
mov rcx, qword [rbp]
xor r8d, r8d
mov r9, r14
mov edx, 4
mov qword [rsp + 0x20], 0
call sym.MiniDumpReadDumpStream
test eax, eax
je 0x41f9f0
mov rax, qword [rsp + 0x78]
mov r13, qword [rbp]
mov r15d, dword [rax]
test r15d, r15d
jne 0x41fcc0
mov qword [rsp + 0x20], 0
mov r9, r14
mov edx, 7
mov rcx, r13
lea r8, [rsp + 0x80]
call sym.MiniDumpReadDumpStream
test eax, eax
jne 0x41fa88
mov r8d, 0x900dbaad
mov edx, esi
lea rcx, sym.tgt_process_minidump_close_process
call sym.dbg_add_process
mov rdx, r12
mov rcx, rax
mov rax, qword [0x004471b0]
mov qword [rcx + 0x28], rbp
mov qword [rax], rcx
mov rax, qword [0x004471a0]
mov dword [rax], esi
call sym.dbg_set_process_name
xor r8d, r8d
xor edx, edx
mov ecx, 0x900dbaad
call sym.dbg_init
mov rcx, qword [rbp]
xor r8d, r8d
mov r9, r14
mov qword [rsp + 0x20], 0
mov edx, 3
call sym.MiniDumpReadDumpStream
test eax, eax
je 0x41f6cd
mov rsi, qword [rsp + 0x78]
mov r10d, dword [rsi]
test r10d, r10d
je 0x41f6cd
xor ebx, ebx
nop dword [rax]
mov eax, ebx
xor r8d, r8d
add ebx, 1
lea rax, [rax + rax*2]
shl rax, 4
add rax, rsi
mov r9, qword [rax + 0x14]
mov edx, dword [rax + 4]
mov rax, qword [0x004471b0]
mov rcx, qword [rax]
call sym.dbg_add_thread
cmp dword [rsi], ebx
ja 0x41f6a0
mov rcx, qword [rbp]
xor r8d, r8d
mov r9, r14
mov edx, 0xfff0
mov qword [rsp + 0x20], 0
call sym.MiniDumpReadDumpStream
test eax, eax
je 0x41f828
mov rax, qword [rsp + 0x78]
mov r9d, dword [rax]
mov qword [rsp + 0x58], rax
lea r15, [rax + 4]
test r9d, r9d
je 0x41f828
lea r12, [sym.validate_file]
mov qword [rsp + 0x60], r14
xor edi, edi
mov r14, r15
lea rbx, [rsp + 0xaa0]
lea rsi, [rsp + 0x90]
mov r13d, 0x900dbaad
mov r15, r12
jmp 0x41f76d
mov eax, dword [r14 + 8]
mov r8, rsi
xor edx, edx
mov rcx, r13
add edi, 1
add r14, 0x6c
mov dword [rsp + 0x20], eax
mov r9, qword [r14 - 0x6c]
call sym.dbg_load_module
mov rax, qword [rsp + 0x58]
cmp dword [rax], edi
jbe 0x41f823
mov r9d, dword [r14 + 0x14]
add r9, qword [rbp]
mov rcx, rbx
mov r8d, dword [r9]
mov r12, r9
lea rdx, [r9 + 4]
call sym.memcpy
mov eax, dword [r12]
xor r8d, r8d
xor edx, edx
mov rcx, r13
shr eax, 1
mov word [rsp + rax*2 + 0xaa0], r8w
mov r9d, dword [r14 + 0xc]
mov r8, rbx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call sym.SymFindFileInPathW
test eax, eax
jne 0x41f740
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x30], 0
mov eax, dword [r14 + 8]
mov rcx, r13
add edi, 1
add r14, 0x6c
mov dword [rsp + 0x28], eax
mov rax, qword [r14 - 0x6c]
mov qword [rsp + 0x20], rax
call sym.SymLoadModuleExW
mov rax, qword [rsp + 0x58]
cmp dword [rax], edi
ja 0x41f76d
mov r14, qword [rsp + 0x60]
mov rcx, qword [rbp]
xor r8d, r8d
mov r9, r14
mov edx, 4
mov qword [rsp + 0x20], 0
call sym.MiniDumpReadDumpStream
test eax, eax
je 0x41f9ac
mov rax, qword [rsp + 0x78]
mov ecx, dword [rax]
mov qword [rsp + 0x58], rax
lea r15, [rax + 4]
test ecx, ecx
je 0x41f9ac
lea rax, [rsp + 0x88]
mov qword [rsp + 0x68], r14
xor edi, edi
lea rbx, [rsp + 0xaa0]
mov qword [rsp + 0x60], rax
lea r12, [sym.validate_file]
lea rsi, [rsp + 0x90]
mov r13d, 0x900dbaad
jmp 0x41f8cc
mov eax, dword [r15 + 8]
mov r8, rsi
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x20], eax
mov r9, qword [r15]
call sym.dbg_load_module
mov rax, qword [rsp + 0x58]
add edi, 1
add r15, 0x6c
cmp dword [rax], edi
jbe 0x41f9a7
mov r9d, dword [r15 + 0x14]
mov r14, qword [rbp]
mov rcx, rbx
add r14, r9
mov r8d, dword [r14]
lea rdx, [r14 + 4]
call sym.memcpy
mov eax, dword [r14]
xor edx, edx
mov r8, rbx
mov rcx, r13
shr eax, 1
mov word [rsp + rax*2 + 0xaa0], dx
mov r9d, dword [r15 + 0x10]
xor edx, edx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov eax, dword [r15 + 8]
mov dword [rsp + 0x20], eax
call sym.SymFindFileInPathW
test eax, eax
jne 0x41f8a0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x60]
xor r8d, r8d
mov edx, 0xfff0
mov rcx, qword [rbp]
call sym.MiniDumpReadDumpStream
test eax, eax
jne 0x41fa10
mov r11d, dword [r15 + 8]
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x28], r11d
mov rcx, r13
add edi, 1
add r15, 0x6c
mov qword [rsp + 0x30], 0
mov rax, qword [r15 - 0x6c]
mov qword [rsp + 0x20], rax
call sym.SymLoadModuleExW
mov rax, qword [rsp + 0x58]
cmp dword [rax], edi
ja 0x41f8cc
mov r14, qword [rsp + 0x68]
mov rcx, qword [rbp]
xor r8d, r8d
mov r9, r14
mov edx, 6
mov qword [rsp + 0x20], 0
call sym.MiniDumpReadDumpStream
test eax, eax
jne 0x41fac0
xor eax, eax
add rsp, 0x12a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r13, qword [rbp]
jmp 0x41f5fe
mov esi, dword [rax + 8]
jmp 0x41f595
mov rdx, qword [rsp + 0x88]
mov r11d, dword [r15 + 8]
mov ecx, dword [rdx]
lea rax, [rdx + 4]
test ecx, ecx
je 0x41f964
sub ecx, 1
mov r8, qword [r15]
mov r10d, r11d
lea rcx, [rcx + rcx*2]
lea rcx, [rcx + rcx*8]
add r10, r8
lea r9, [rdx + rcx*4 + 0x70]
jmp 0x41fa55
add rax, 0x6c
cmp rax, r9
je 0x41f964
mov rdx, qword [rax]
cmp rdx, r8
ja 0x41fa48
mov ecx, dword [rax + 8]
add rdx, rcx
cmp rdx, r10
jb 0x41fa48
mov dword [rsp + 0x20], r11d
mov r9, qword [r15]
mov r8, rbx
xor edx, edx
mov rcx, r13
call sym.dbg_load_module
jmp 0x41f8b8
mov rdi, qword [rsp + 0x78]
mov edx, esi
lea rcx, str.WineDbg_starting_on_minidump_on_pid__04lx_n
call sym.dbg_printf
movzx eax, word [rdi]
cmp ax, 0xc
ja case.default.0x41fab6
lea rdx, [0x0043ec58]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov rbx, qword [rsp + 0x78]
mov rax, qword [0x004471b0]
mov edx, dword [rbx]
mov rcx, qword [rax]
call sym.dbg_get_thread
mov r12, qword [0x004471c0]
mov qword [r12], rax
test rax, rax
je 0x41f9d1
mov ecx, dword [rbx]
mov rdx, qword [0x004471d0]
mov dword [rax + 0x7c], 1
mov dword [rdx], ecx
mov edx, dword [rbx + 8]
mov dword [rax + 0x88], edx
mov edx, dword [rbx + 0xc]
mov dword [rax + 0x8c], edx
mov rdx, qword [rbx + 0x10]
mov qword [rax + 0x90], rdx
mov rdx, qword [rbx + 0x18]
mov qword [rax + 0x98], rdx
mov r8d, dword [rbx + 0x20]
mov dword [rax + 0xa0], r8d
test r8d, r8d
je 0x41fb93
lea rcx, [rbx + 0x30]
lea rdx, [rax + 0xa8]
cmp rcx, rdx
je 0x420060
lea edx, [r8 - 1]
cmp edx, 3
jbe 0x420060
mov ecx, r8d
xor edx, edx
shr ecx, 1
shl rcx, 4
movdqu xmm0, xmmword [rbx + rdx + 0x28]
movups xmmword [rax + rdx + 0xa8], xmm0
add rdx, 0x10
cmp rdx, rcx
jne 0x41fb60
mov edx, r8d
and edx, 0xfffffffe
and r8d, 1
je 0x41fb93
movsxd rdx, edx
mov rcx, qword [rbx + rdx*8 + 0x28]
mov qword [rax + rdx*8 + 0xa8], rcx
cmp dword [rbx + 0xa0], 0x4d0
mov eax, 0x4d0
cmovbe eax, dword [rbx + 0xa0]
mov esi, dword [rbx + 0xa4]
mov rdi, qword [0x00447190]
add rsi, qword [rbp]
cmp eax, 8
jae 0x41fd50
xor edx, edx
test al, 4
jne 0x41fd29
test al, 2
jne 0x41fd3a
test al, 1
jne 0x41fd1d
lea r13, [rsp + 0x90]
mov rcx, r13
call sym.memory_get_current_pc
mov rcx, qword [0x00447190]
call sym.stack_fetch_frames
mov rax, qword [r12]
xor r8d, r8d
mov rdx, qword [0x00447190]
mov rcx, qword [rax + 0x18]
mov rax, qword [0x004471b0]
mov rax, qword [rax]
mov rax, qword [rax + 0x58]
call qword [rax + 0x30]
mov ecx, 0xffffffff
call sym.stack_info
mov rax, qword [r12]
mov rdx, qword [0x00447190]
mov rcx, qword [rax + 0x18]
mov rax, qword [0x004471b0]
mov rax, qword [rax]
mov rax, qword [rax + 0x58]
call qword [rax + 0x38]
mov ecx, dword [rbx]
call sym.stack_backtrace
xor edx, edx
mov rcx, r13
call sym.source_list_from_addr
jmp 0x41f9d1
cmp ax, 0xffff
lea rbx, [0x0043eaa0]
lea r9, str.Unknown
cmovne r9, rbx
movzx r8d, byte [rdi + 6]
lea rdx, [0x0043eb29]
lea rax, [0x0043eb28]
lea rcx, str.___ls_was_running_on__d__s_CPU_s
cmp r8b, 2
cmovae rax, rdx
mov rdx, r12
mov qword [rsp + 0x20], rax
call sym.dbg_printf
mov eax, dword [rdi + 8]
sub eax, 3
cmp eax, 7
ja case.0x41fcbe.7
lea rdx, [0x0043ec8c]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov eax, dword [rax + 0x18]
mov rcx, r12
xor edi, edi
add rax, r13
mov r8d, dword [rax]
lea rdx, [rax + 4]
mov ebx, r8d
call sym.memcpy
shr ebx, 1
mov eax, ebx
mov word [rsp + rax*2 + 0x2a0], di
lea rax, [r12 + rax*2 - 2]
cmp rax, r12
jb 0x41f5fe
nop dword [rax]
movzx edx, word [rax]
cmp dx, 0x2f
je 0x41ff58
cmp dx, 0x5c
je 0x41ff58
sub rax, 2
cmp rax, r12
jae 0x41fcf8
jmp 0x41f5fe
movzx eax, byte [rsi + rdx]
mov byte [rdi + rdx], al
jmp 0x41fbdd
mov edx, dword [rsi]
mov dword [rdi], edx
mov edx, 4
test al, 2
je 0x41fbd5
movzx ecx, word [rsi + rdx]
mov word [rdi + rdx], cx
add rdx, 2
test al, 1
je 0x41fbdd
jmp 0x41fd1d
mov ecx, eax
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
jmp 0x41fbc3
lea rdx, [0x0043eaa0]
nop dword [rax]
mov r8d, dword [rdi + 0x10]
lea rcx, str._on_Windows__s___u__n
call sym.dbg_printf
mov rax, qword [rsp + 0x80]
cmp dword [rax + 4], 0x3b
ja 0x41f627
mov eax, dword [rax + 8]
mov edx, dword [rdi + 0x18]
add rax, 0x3c
cmp rdx, rax
jb 0x41f627
mov rax, qword [rsp + 0x78]
cmp byte [rax + 0x38], 0x57
jne 0x41f627
cmp byte [rax + 0x39], 0x49
jne 0x41f627
cmp byte [rax + 0x3a], 0x4e
jne 0x41f627
cmp byte [rax + 0x3b], 0x45
jne 0x41f627
cmp dword [rax + 0x3c], 2
jbe 0x41f627
mov r9d, dword [rax + 0x48]
mov r8d, dword [rax + 0x44]
lea rcx, [rax + 0x3c]
mov edx, dword [rax + 0x40]
add r9, rcx
add r8, rcx
add rdx, rcx
lea rcx, str._____on__s__on_top_of__s___s___n
call sym.dbg_printf
jmp 0x41f627
lea r9, [0x0043eaa0]
jmp 0x41fc72
cmp dword [rdi + 0xc], 0x33
lea rdx, str.NT_3.51
lea rax, str.3_____
cmovne rdx, rax
jmp 0x41fd68
mov r11d, dword [rdi + 0xc]
lea rdx, str.10_____
test r11d, r11d
jne 0x41fd68
cmp byte [rdi + 7], 1
lea rax, str.Win10
cmove rdx, rax
jmp 0x41fd68
mov eax, dword [rdi + 0xc]
cmp eax, 2
je 0x4200a8
ja 0x41ff17
test eax, eax
je 0x42003f
movzx eax, byte [rdi + 7]
lea rdx, str.Win7
cmp al, 1
je 0x41fd68
cmp al, 3
lea rdx, str.6_____
lea rax, str.Server_2008
cmove rdx, rax
jmp 0x41fd68
mov eax, dword [rdi + 0xc]
lea rdx, [0x0043eb70]
cmp eax, 1
je 0x41fd68
cmp eax, 2
je 0x420083
test eax, eax
lea rdx, str.5_____
lea rax, str.2000
cmove rdx, rax
jmp 0x41fd68
mov eax, dword [rdi + 0xc]
lea rdx, [0x0043eb63]
cmp eax, 0xa
je 0x41fd68
lea rdx, [0x0043eb66]
cmp eax, 0x5a
je 0x41fd68
lea rdx, str.4_____
test eax, eax
jne 0x41fd68
cmp dword [rdi + 0x14], 2
lea rdx, str.NT_4.0
lea rax, [0x0043eb81]
cmovne rdx, rax
jmp 0x41fd68
lea rdx, str.6_____
cmp eax, 3
jne 0x41fd68
movzx eax, byte [rdi + 7]
lea rdx, str.Win8.1
cmp al, 1
je 0x41fd68
cmp al, 3
lea rdx, str.6_____
lea rax, str.Server_2012_R2
cmove rdx, rax
jmp 0x41fd68
cmp word [rax + 2], 0
lea rdx, [rax + 2]
je 0x4201af
mov rax, rdx
nop word [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x41ff70
sub rax, rdx
mov r8, rax
sar r8, 1
add r8d, 1
movsxd r8, r8d
add r8, r8
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_memmove]
jmp 0x41f5fe
mov ebx, 0x206c
mov byte [rsp + 0xaa6], 0
mov dword [rsp + 0xaa0], 0x65746e49
mov word [rsp + 0xaa4], bx
movzx eax, word [rdi + 2]
sub eax, 3
cmp ax, 0xc
ja case.0x41ffdd.4
lea rdx, [0x0043ecac]
movzx eax, ax
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
lea r9, str.Alpha
jmp 0x41fc72
lea r9, str.PowerPC
jmp 0x41fc72
lea r9, str.X86_64
jmp 0x41fc72
lea r9, str.Neutral
jmp 0x41fc72
lea r9, str.ARM64
jmp 0x41fc72
lea r9, [0x0043eb09]
jmp 0x41fc72
lea r9, str.MSIL
jmp 0x41fc72
lea r9, str.Mips
jmp 0x41fc72
movzx eax, byte [rdi + 7]
lea rdx, str.Vista
cmp al, 1
jne 0x41fe7c
jmp 0x41fd68
xor edx, edx
nop word [rax + rax]
mov rcx, qword [rbx + rdx*8 + 0x28]
mov qword [rax + rdx*8 + 0xa8], rcx
add rdx, 1
cmp rdx, r8
jne 0x420068
jmp 0x41fb93
movzx eax, byte [rdi + 7]
cmp al, 1
je 0x41fd68
cmp al, 3
lea rdx, str.Server_2003
lea rax, str.5_____
cmovne rdx, rax
jmp 0x41fd68
movzx eax, byte [rdi + 7]
lea rdx, str.Win8
cmp al, 1
je 0x41fd68
cmp al, 3
lea rdx, str.6_____
lea rax, str.Server_2012
cmove rdx, rax
jmp 0x41fd68
lea rdx, [0x0043eaa0]
lea rcx, [rsp + 0xaa6]
lea rbx, [rsp + 0xaa0]
call sym.strcpy
movzx eax, word [rdi + 2]
sub eax, 3
cmp ax, 1
ja 0x42017c
movzx r15d, word [rdi + 4]
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_strlen]
mov r13d, r15d
lea rcx, [rbx + rax]
shr r13w, 8
cmp r13w, 0xff
je 0x4201ba
lea r8d, [r13 + 0x41]
movzx r9d, r15b
lea rdx, str.___c_d_
and r8d, 0x1ff
call sym.sprintf_1
mov r9, rbx
jmp 0x41fc72
lea rdx, str.Pentium_4_or_AMD_Athlon64
jmp 0x4200db
lea rdx, str.Pentium_Pro_II_or_AMD_Athlon
jmp 0x4200db
lea rdx, str.Pentium
jmp 0x4200db
lea rdx, str.80386
jmp 0x4200db
lea rdx, str.80486
jmp 0x4200db
movzx r13d, word [rdi + 4]
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_strlen]
lea rdx, str.___d._d_
mov ecx, r13d
movzx r9d, r13b
movzx ecx, ch
mov r8d, ecx
lea rcx, [rbx + rax]
call sym.sprintf_1
mov r9, rbx
jmp 0x41fc72
mov r8d, 2
jmp 0x41ff8d
mov eax, r15d
mov r9d, r15d
lea rdx, str.___c_d_
shr ax, 4
and r9d, 0xf
and eax, 0xf
lea r8d, [rax + 0x37]
call sym.sprintf_1
mov r9, rbx
jmp 0x41fc72