Queue skips catch and unwind funclets (they open on the parent's frame); ruling #12777

harbor/queue.py

@@ -207,6 +207,10 @@ class FunctionQueue:
             head = self.r.read(addr, 10) if int(facts[addr].get("size") or 0) == 10 else b""
             if head[:1] and 0xB8 <= head[0] <= 0xBF and head[5:6] == b"\xe9":
                 continue        # mov reg, imm32; jmp: an at-exit destructor thunk or an SEH handler stub (compiler's)
+            first = self.r.read(addr, 3)
+            if len(first) == 3 and first[0] in (0x8B, 0x8D, 0xFF, 0x83, 0xC7, 0x89) and (first[1] & 0xC7) == 0x45 \
+                    and first[2] >= 0x80:
+                continue        # opens on the parent's [ebp-x] with no frame: a catch or unwind funclet (ruling #12777)
             score, reasons = self.score(addr, facts, named, rejected, similar_readable, with_convention=False)
             ranked.append((score, addr, reasons))
         ranked.sort(reverse=True)