The code that I'm looking at uses exception handlers and it seems that the stack pointer is misscalculated in the case of the exception handler. I posted this function as an exmple in full, so that the problem can be seen.What I'm interested in is, how I can get rid of the sp-analysis failing.000                 push    ebp004                 mov     ebp, esp004                 push    0008                 push    ebx00C                 push    esi010                 mov     ebx, eax010                 xor     eax, eax010                 push    ebp014                 push    offset j_ExceptionHandler1_2018                 push    dword ptr fs:[eax]01C                 mov     fs:[eax], esp01C                 push    1               ; uIDEvent020                 mov     eax, [ebx+28h]020                 push    eax             ; hWnd024                 call    j_KillTimer01C                 mov     esi, [ebx+24h]01C                 test    esi, esi01C                 jz      short loc_4467F101C                 cmp     byte ptr [ebx+34h], 001C                 jz      short loc_4467F101C                 cmp     word ptr [ebx+2Eh], 001C                 jz      short loc_4467F101C                 push    0               ; lpTimerFunc020                 push    esi             ; uElapse024                 push    1               ; nIDEvent028                 mov     eax, [ebx+28h]028                 push    eax             ; hWnd02C                 call    j_SetTimer01C                 test    eax, eax01C                 jnz     short loc_4467F101C                 lea     edx, [ebp+Str]01C                 mov     eax, ds:off_5C6E3C01C                 call    LoadString      ; EAX = StringResource                                            ; EDX = Target                                            ;01C                 mov     ecx, [ebp+Str]01C                 mov     dl, 101C                 mov     eax, off_40CA0001C                 call    sub_409F3401C                 call    GlobalExceptionE    loc_4467F1:                             ; CODE XREF: sub_446788+27j                                            ; sub_446788+2Dj                                            ; sub_446788+34j                                            ; sub_446788+46j00C                 xor     eax, eax00C                 pop     edx008                 pop     ecx004                 pop     ecx000                 mov     fs:[eax], edx000                 push    offset loc_44680E    loc_4467FE:                             ; CODE XREF: CODE:0044680Cj004                 lea     eax, [ebp+Str]  ; RDStr004                 call    ReleaseDelphiString ; EAX = Pointer to a stringpointer                                            ;                                            ; Refcount is decreased and the pointer is set to NULL.004                 retn    sub_446788      endp ; sp-analysis failed    ; [00000005 BYTES: COLLAPSED FUNCTION j_ExceptionHandler1_2. PRESS KEYPAD + TO EXPAND]    ; ---------------------------------------------------------------------------                    jmp     short loc_4467FE    ; ---------------------------------------------------------------------------    ; START OF FUNCTION CHUNK FOR sub_446788    loc_44680E:                             ; CODE XREF: sub_446788+7Ej                                            ; DATA XREF: sub_446788+71o004                 pop     esi000                 pop     ebx-04                 pop     ecx-08                 pop     ebp-0C                 retnUpdateThe the GlobalExceptionE function is this000                 pop     edx-04                 push    esp000                 push    ebp004                 push    edi008                 push    esi00C                 push    ebx010                 push    eax014                 push    edx018                 push    esp             ; lpArguments01C                 push    7               ; nNumberOfArguments020                 push    1               ; dwExceptionFlags024                 push    0EEDFADEh       ; dwExceptionCode028                 push    edx02C                 jmp     j_RaiseException
Fixing the stackpointer in IDA when exception handlers are used
ida