{"type": "func", "start": 6443657864, "end": 6443657999, "name": "ExFilterRethrow", "pseudocode": "// \n// ExFilterRethrow from 0x180126a88 to 0x180126b0f (135 bytes)\n// \n// 2 xrefs:\n// > unknown_libname_19 @ 0x180142c61\n// > <???> @ 0x18020293c\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\n__int64 __fastcall ExFilterRethrow(struct _EXCEPTION_POINTERS *a1, struct EHExceptionRecord *a2, int *a3)\n{\n  PEXCEPTION_RECORD ExceptionRecord; // r9\n  __int64 v5; // rcx\n\n  ExceptionRecord = a1->ExceptionRecord;\n  *a3 = 0;\n  if ( ExceptionRecord->ExceptionCode != -529697949 )\n    return 0;\n  if ( ExceptionRecord->NumberParameters != 4 )\n    return 0;\n  if ( (unsigned int)(LODWORD(ExceptionRecord->ExceptionInformation[0]) - 429065504) <= 2\n    && (void *)ExceptionRecord->ExceptionInformation[1] == a2->params.pExceptionObject )\n  {\n    *a3 = 1;\n    if ( ExceptionRecord->ExceptionCode != -529697949 )\n      return 0;\n  }\n  if ( ExceptionRecord->NumberParameters != 4 )\n    return 0;\n  v5 = (unsigned int)(LODWORD(ExceptionRecord->ExceptionInformation[0]) - 429065504);\n  if ( (unsigned int)v5 > 2 || ExceptionRecord->ExceptionInformation[2] )\n    return 0;\n  *(_DWORD *)(_vcrt_getptd(v5) + 64) = 1;\n  *a3 = 1;\n  return 1;\n}", "assembly": "; \n; ExFilterRethrow from 0x180126a88 to 0x180126b0f (135 bytes)\n; \n; 2 xrefs:\n; > unknown_libname_19 @ 0x180142c61\n; > <???> @ 0x18020293c\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\npush    rbx                                                            ; +0x0, 0x180126a88\nsub     rsp, 20h                                                       ; +0x2, 0x180126a8a\nmov     r9, [rcx]                                                      ; +0x6, 0x180126a8e\nmov     rbx, r8                                                        ; +0x9, 0x180126a91\nand     dword ptr [r8], 0                                              ; +0xc, 0x180126a94\nmov     ecx, 0E06D7363h                                                ; +0x10, 0x180126a98\nmov     r8d, 19930520h                                                 ; +0x15, 0x180126a9d\nmov     eax, [r9]                                                      ; +0x1b, 0x180126aa3\ncmp     eax, ecx                                                       ; +0x1e, 0x180126aa6\njnz     short loc_180126B07                                            ; +0x20, 0x180126aa8\ncmp     dword ptr [r9+18h], 4                                          ; +0x22, 0x180126aaa\njnz     short loc_180126B07                                            ; +0x27, 0x180126aaf\nmov     eax, [r9+20h]                                                  ; +0x29, 0x180126ab1\nsub     eax, r8d                                                       ; +0x2d, 0x180126ab5\ncmp     eax, 2                                                         ; +0x30, 0x180126ab8\nja      short loc_180126AD4                                            ; +0x33, 0x180126abb\nmov     rax, [rdx+28h]                                                 ; +0x35, 0x180126abd\ncmp     [r9+28h], rax                                                  ; +0x39, 0x180126ac1\njnz     short loc_180126AD4                                            ; +0x3d, 0x180126ac5\nmov     dword ptr [rbx], 1                                             ; +0x3f, 0x180126ac7\nmov     eax, [r9]                                                      ; +0x45, 0x180126acd\ncmp     eax, ecx                                                       ; +0x48, 0x180126ad0\njnz     short loc_180126B07                                            ; +0x4a, 0x180126ad2\ncmp     dword ptr [r9+18h], 4                                          ; +0x4c, 0x180126ad4\njnz     short loc_180126B07                                            ; +0x51, 0x180126ad9\nmov     ecx, [r9+20h]                                                  ; +0x53, 0x180126adb\nsub     ecx, r8d                                                       ; +0x57, 0x180126adf\ncmp     ecx, 2                                                         ; +0x5a, 0x180126ae2\nja      short loc_180126B07                                            ; +0x5d, 0x180126ae5\ncmp     qword ptr [r9+30h], 0                                          ; +0x5f, 0x180126ae7\njnz     short loc_180126B07                                            ; +0x64, 0x180126aec\ncall    __vcrt_getptd                                                  ; +0x66, 0x180126aee\nmov     dword ptr [rax+40h], 1                                         ; +0x6b, 0x180126af3\nmov     eax, 1                                                         ; +0x72, 0x180126afa\nmov     dword ptr [rbx], 1                                             ; +0x77, 0x180126aff\njmp     short loc_180126B09                                            ; +0x7d, 0x180126b05\nxor     eax, eax                                                       ; +0x7f, 0x180126b07\nadd     rsp, 20h                                                       ; +0x81, 0x180126b09\npop     rbx                                                            ; +0x85, 0x180126b0d\nretn                                                                   ; +0x86, 0x180126b0e", "xrefs": ["unknown_libname_19 @ 0x180142c61", "<???> @ 0x18020293c"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}