; ; FindHandler<__FrameHandler3> from 0x180125d18 to 0x1801261dd (1221 bytes) ; ; 2 xrefs: ; > __InternalCxxFrameHandler<__FrameHandler3> @ 0x180126744 ; > @ 0x1802028d0 ; ; This function is hookable on this platform! ; ; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA ; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings ; push rbp ; +0x0, 0x180125d18 push rbx ; +0x2, 0x180125d1a push rsi ; +0x3, 0x180125d1b push rdi ; +0x4, 0x180125d1c push r12 ; +0x5, 0x180125d1d push r13 ; +0x7, 0x180125d1f push r14 ; +0x9, 0x180125d21 push r15 ; +0xb, 0x180125d23 lea rbp, [rsp-28h] ; +0xd, 0x180125d25 sub rsp, 128h ; +0x12, 0x180125d2a mov rax, cs:__security_cookie ; +0x19, 0x180125d31 xor rax, rsp ; +0x20, 0x180125d38 mov [rbp+60h+var_50], rax ; +0x23, 0x180125d3b mov rdi, [rbp+60h+arg_20] ; +0x27, 0x180125d3f mov r12, rdx ; +0x2e, 0x180125d46 mov r13, [rbp+60h+arg_38] ; +0x31, 0x180125d49 mov r15, r8 ; +0x38, 0x180125d50 mov [rsp+160h+var_F8], r8 ; +0x3b, 0x180125d53 mov rbx, rcx ; +0x40, 0x180125d58 mov [rbp+60h+var_E0], rdx ; +0x43, 0x180125d5b mov r8, rdi; struct _s_FuncInfo * ; +0x47, 0x180125d5f mov rcx, r12; unsigned __int64 * ; +0x4a, 0x180125d62 mov qword ptr [rbp+60h+var_C8], r13 ; +0x4d, 0x180125d65 mov rdx, r9; struct _xDISPATCHER_CONTEXT * ; +0x51, 0x180125d69 mov byte ptr [rsp+160h+var_100], 0 ; +0x54, 0x180125d6c mov rsi, r9 ; +0x59, 0x180125d71 call ?GetHandlerSearchState@__FrameHandler3@@SAHPEA_KPEAU_xDISPATCHER_CONTEXT@@PEBU_s_FuncInfo@@@Z ; +0x5c, 0x180125d74 mov r14d, eax ; +0x61, 0x180125d79 cmp eax, 0FFFFFFFFh ; +0x64, 0x180125d7c jl loc_1801261D7 ; +0x67, 0x180125d7f cmp eax, [rdi+4] ; +0x6d, 0x180125d85 jge loc_1801261D7 ; +0x70, 0x180125d88 cmp dword ptr [rbx], 0E06D7363h ; +0x76, 0x180125d8e jnz loc_180125E63 ; +0x7c, 0x180125d94 cmp dword ptr [rbx+18h], 4 ; +0x82, 0x180125d9a jnz loc_180125E63 ; +0x86, 0x180125d9e mov eax, [rbx+20h] ; +0x8c, 0x180125da4 sub eax, 19930520h ; +0x8f, 0x180125da7 cmp eax, 2 ; +0x94, 0x180125dac ja loc_180125E63 ; +0x97, 0x180125daf cmp qword ptr [rbx+30h], 0 ; +0x9d, 0x180125db5 jnz loc_180125E63 ; +0xa2, 0x180125dba call __vcrt_getptd ; +0xa8, 0x180125dc0 cmp qword ptr [rax+20h], 0 ; +0xad, 0x180125dc5 jz loc_180126170 ; +0xb2, 0x180125dca call __vcrt_getptd ; +0xb8, 0x180125dd0 mov rbx, [rax+20h] ; +0xbd, 0x180125dd5 call __vcrt_getptd ; +0xc1, 0x180125dd9 mov rcx, [rbx+38h] ; +0xc6, 0x180125dde mov byte ptr [rsp+160h+var_100], 1 ; +0xca, 0x180125de2 mov r15, [rax+28h] ; +0xcf, 0x180125de7 mov [rsp+160h+var_F8], r15 ; +0xd3, 0x180125deb call _SetThrowImageBase ; +0xd8, 0x180125df0 cmp dword ptr [rbx], 0E06D7363h ; +0xdd, 0x180125df5 jnz short loc_180125E1B ; +0xe3, 0x180125dfb cmp dword ptr [rbx+18h], 4 ; +0xe5, 0x180125dfd jnz short loc_180125E1B ; +0xe9, 0x180125e01 mov eax, [rbx+20h] ; +0xeb, 0x180125e03 sub eax, 19930520h ; +0xee, 0x180125e06 cmp eax, 2 ; +0xf3, 0x180125e0b ja short loc_180125E1B ; +0xf6, 0x180125e0e cmp qword ptr [rbx+30h], 0 ; +0xf8, 0x180125e10 jz loc_1801261D7 ; +0xfd, 0x180125e15 call __vcrt_getptd ; +0x103, 0x180125e1b cmp qword ptr [rax+38h], 0 ; +0x108, 0x180125e20 jz short loc_180125E63 ; +0x10d, 0x180125e25 call __vcrt_getptd ; +0x10f, 0x180125e27 mov r15, [rax+38h] ; +0x114, 0x180125e2c call __vcrt_getptd ; +0x118, 0x180125e30 mov rdx, r15; struct _s_ESTypeList * ; +0x11d, 0x180125e35 mov rcx, rbx; struct EHExceptionRecord * ; +0x120, 0x180125e38 and qword ptr [rax+38h], 0 ; +0x123, 0x180125e3b call ?IsInExceptionSpec@@YAEPEAUEHExceptionRecord@@PEBU_s_ESTypeList@@@Z ; +0x128, 0x180125e40 test al, al ; +0x12d, 0x180125e45 jnz short loc_180125E5E ; +0x12f, 0x180125e47 mov rcx, r15; struct _s_ESTypeList * ; +0x131, 0x180125e49 call ?Is_bad_exception_allowed@@YAEPEBU_s_ESTypeList@@@Z ; +0x134, 0x180125e4c test al, al ; +0x139, 0x180125e51 jz loc_1801261B4 ; +0x13b, 0x180125e53 jmp loc_180126190 ; +0x141, 0x180125e59 mov r15, [rsp+160h+var_F8] ; +0x146, 0x180125e5e mov rax, [rsi+8] ; +0x14b, 0x180125e63 mov [rbp+60h+var_A0], rax ; +0x14f, 0x180125e67 mov [rbp+60h+var_A8], rdi ; +0x153, 0x180125e6b cmp dword ptr [rbx], 0E06D7363h ; +0x157, 0x180125e6f jnz loc_180126127 ; +0x15d, 0x180125e75 cmp dword ptr [rbx+18h], 4 ; +0x163, 0x180125e7b jnz loc_180126127 ; +0x167, 0x180125e7f mov eax, [rbx+20h] ; +0x16d, 0x180125e85 sub eax, 19930520h ; +0x170, 0x180125e88 cmp eax, 2 ; +0x175, 0x180125e8d ja loc_180126127 ; +0x178, 0x180125e90 xor r13d, r13d ; +0x17e, 0x180125e96 cmp [rdi+0Ch], r13d ; +0x181, 0x180125e99 jbe loc_180126058 ; +0x185, 0x180125e9d mov eax, [rbp+60h+arg_30] ; +0x18b, 0x180125ea3 lea rdx, [rbp+60h+var_A8] ; +0x191, 0x180125ea9 mov dword ptr [rsp+160h+var_138], eax ; +0x195, 0x180125ead lea rcx, [rbp+60h+var_88] ; +0x199, 0x180125eb1 mov r9, rsi ; +0x19d, 0x180125eb5 mov [rsp+160h+var_140], rdi ; +0x1a0, 0x180125eb8 mov r8d, r14d ; +0x1a5, 0x180125ebd call ?GetRangeOfTrysToCheck@__FrameHandler3@@SA?AU?$pair@Viterator@TryBlockMap@__FrameHandler3@@V123@@std@@AEAVTryBlockMap@1@HPEAU_xDISPATCHER_CONTEXT@@PEBU_s_FuncInfo@@H@Z ; +0x1a8, 0x180125ec0 movups xmm0, [rbp+60h+var_88] ; +0x1ad, 0x180125ec5 movdqu [rbp+60h+var_98], xmm0 ; +0x1b1, 0x180125ec9 psrldq xmm0, 8 ; +0x1b6, 0x180125ece movd eax, xmm0 ; +0x1bb, 0x180125ed3 cmp eax, [rbp+60h+var_70] ; +0x1bf, 0x180125ed7 jnb loc_180126058 ; +0x1c2, 0x180125eda mov r9, qword ptr [rbp+60h+var_88] ; +0x1c8, 0x180125ee0 mov r12d, dword ptr [rbp+60h+var_98+8] ; +0x1cc, 0x180125ee4 mov [rsp+160h+var_E8], r9 ; +0x1d0, 0x180125ee8 mov rax, qword ptr [rbp+60h+var_98] ; +0x1d5, 0x180125eed mov rax, [rax] ; +0x1d9, 0x180125ef1 movsxd rdx, dword ptr [rax+10h] ; +0x1dc, 0x180125ef4 mov eax, r12d ; +0x1e0, 0x180125ef8 lea rcx, [rax+rax*4] ; +0x1e3, 0x180125efb mov rax, [r9+8] ; +0x1e7, 0x180125eff lea r8, [rdx+rcx*4] ; +0x1eb, 0x180125f03 movups xmm0, xmmword ptr [r8+rax] ; +0x1ef, 0x180125f07 movsxd rcx, dword ptr [r8+rax+10h] ; +0x1f4, 0x180125f0c mov [rbp+60h+var_B0], ecx ; +0x1f9, 0x180125f11 movd eax, xmm0 ; +0x1fc, 0x180125f14 movups xmmword ptr [rbp+60h+var_C0], xmm0 ; +0x200, 0x180125f18 cmp eax, r14d ; +0x204, 0x180125f1c jg loc_180126047 ; +0x207, 0x180125f1f mov rax, [rbp+60h+var_C0] ; +0x20d, 0x180125f25 shr rax, 20h ; +0x211, 0x180125f29 cmp r14d, eax ; +0x215, 0x180125f2d jg loc_180126047 ; +0x218, 0x180125f30 mov r15, [rbp+60h+var_C0+8] ; +0x21e, 0x180125f36 mov rdx, rcx ; +0x222, 0x180125f3a add rdx, [rsi+8] ; +0x225, 0x180125f3d shr r15, 20h ; +0x229, 0x180125f41 mov [rbp+60h+var_D0], rdx ; +0x22d, 0x180125f45 test r15d, r15d ; +0x231, 0x180125f49 jz $NextTryBlock$110 ; +0x234, 0x180125f4c mov eax, r13d ; +0x23a, 0x180125f52 lea rcx, [rax+rax*4] ; +0x23d, 0x180125f55 movups xmm0, xmmword ptr [rdx+rcx*4] ; +0x241, 0x180125f59 movups [rbp+60h+pExceptionObject], xmm0 ; +0x245, 0x180125f5d mov eax, [rdx+rcx*4+10h] ; +0x249, 0x180125f61 mov [rbp+60h+var_58], eax ; +0x24d, 0x180125f65 call _GetThrowImageBase ; +0x250, 0x180125f68 mov rcx, [rbx+30h] ; +0x255, 0x180125f6d add rax, 4 ; +0x259, 0x180125f71 movsxd rdx, dword ptr [rcx+0Ch] ; +0x25d, 0x180125f75 add rax, rdx ; +0x261, 0x180125f79 mov [rsp+160h+var_F0], rax ; +0x264, 0x180125f7c call _GetThrowImageBase ; +0x269, 0x180125f81 mov rcx, [rbx+30h] ; +0x26e, 0x180125f86 movsxd rdx, dword ptr [rcx+0Ch] ; +0x272, 0x180125f8a mov ecx, [rax+rdx] ; +0x276, 0x180125f8e mov [rsp+160h+var_FC], ecx ; +0x279, 0x180125f91 test ecx, ecx ; +0x27d, 0x180125f95 jle short loc_180125FD5 ; +0x27f, 0x180125f97 call _GetThrowImageBase ; +0x281, 0x180125f99 mov rcx, [rsp+160h+var_F0] ; +0x286, 0x180125f9e mov r8, [rbx+30h] ; +0x28b, 0x180125fa3 movsxd rcx, dword ptr [rcx] ; +0x28f, 0x180125fa7 add rax, rcx ; +0x292, 0x180125faa lea rcx, [rbp+60h+pExceptionObject] ; +0x295, 0x180125fad mov rdx, rax ; +0x299, 0x180125fb1 mov [rbp+60h+var_D8], rax ; +0x29c, 0x180125fb4 call ??$TypeMatchHelper@V__FrameHandler3@@@@YAHPEBU_s_HandlerType@@PEBU_s_CatchableType@@PEBU_s_ThrowInfo@@@Z ; +0x2a0, 0x180125fb8 test eax, eax ; +0x2a5, 0x180125fbd jnz short loc_180125FE6 ; +0x2a7, 0x180125fbf mov eax, [rsp+160h+var_FC] ; +0x2a9, 0x180125fc1 add [rsp+160h+var_F0], 4 ; +0x2ad, 0x180125fc5 dec eax ; +0x2b3, 0x180125fcb mov [rsp+160h+var_FC], eax ; +0x2b5, 0x180125fcd test eax, eax ; +0x2b9, 0x180125fd1 jg short loc_180125F99 ; +0x2bb, 0x180125fd3 inc r13d ; +0x2bd, 0x180125fd5 cmp r13d, r15d ; +0x2c0, 0x180125fd8 jz short loc_18012603F ; +0x2c3, 0x180125fdb mov rdx, [rbp+60h+var_D0] ; +0x2c5, 0x180125fdd jmp loc_180125F52 ; +0x2c9, 0x180125fe1 mov al, [rbp+60h+arg_28] ; +0x2ce, 0x180125fe6 mov r9, rsi ; +0x2d4, 0x180125fec mov r8, [rsp+160h+var_F8] ; +0x2d7, 0x180125fef mov rcx, rbx; struct EHExceptionRecord * ; +0x2dc, 0x180125ff4 mov rdx, [rbp+60h+var_E0]; unsigned __int64 * ; +0x2df, 0x180125ff7 mov [rsp+160h+var_108], al; char ; +0x2e3, 0x180125ffb mov al, byte ptr [rsp+160h+var_100] ; +0x2e7, 0x180125fff mov [rsp+160h+var_110], al; int ; +0x2eb, 0x180126003 mov rax, qword ptr [rbp+60h+var_C8] ; +0x2ef, 0x180126007 mov [rsp+160h+var_118], rax; int ; +0x2f3, 0x18012600b mov eax, [rbp+60h+arg_30] ; +0x2f8, 0x180126010 mov dword ptr [rsp+160h+var_120], eax; int ; +0x2fe, 0x180126016 lea rax, [rbp+60h+var_C0] ; +0x302, 0x18012601a mov [rsp+160h+var_128], rax; __int64 ; +0x306, 0x18012601e mov rax, [rbp+60h+var_D8] ; +0x30b, 0x180126023 mov [rsp+160h+var_130], rax; __int64 ; +0x30f, 0x180126027 lea rax, [rbp+60h+pExceptionObject] ; +0x314, 0x18012602c mov [rsp+160h+var_138], rax; struct _s_HandlerType * ; +0x318, 0x180126030 mov [rsp+160h+var_140], rdi; struct _s_FuncInfo * ; +0x31d, 0x180126035 call ??$CatchIt@V__FrameHandler3@@@@YAXPEAUEHExceptionRecord@@PEA_KPEAU_CONTEXT@@PEAU_xDISPATCHER_CONTEXT@@PEBU_s_FuncInfo@@PEBU_s_HandlerType@@PEBU_s_CatchableType@@PEBU_s_TryBlockMapEntry@@H1EE@Z ; +0x322, 0x18012603a mov r9, [rsp+160h+var_E8] ; +0x327, 0x18012603f xor r13d, r13d ; +0x32c, 0x180126044 inc r12d ; +0x32f, 0x180126047 cmp r12d, [rbp+60h+var_70] ; +0x332, 0x18012604a jb loc_180125EED ; +0x336, 0x18012604e mov r12, [rbp+60h+var_E0] ; +0x33c, 0x180126054 mov eax, [rdi] ; +0x340, 0x180126058 and eax, 1FFFFFFFh ; +0x342, 0x18012605a cmp eax, 19930521h ; +0x347, 0x18012605f jb loc_180126164 ; +0x34c, 0x180126064 cmp [rdi+20h], r13d ; +0x352, 0x18012606a jz short loc_18012607E ; +0x356, 0x18012606e call _GetImageBase ; +0x358, 0x180126070 movsxd rcx, dword ptr [rdi+20h] ; +0x35d, 0x180126075 add rax, rcx ; +0x361, 0x180126079 jnz short loc_18012609F ; +0x364, 0x18012607c mov eax, [rdi+24h] ; +0x366, 0x18012607e shr eax, 2 ; +0x369, 0x180126081 test al, 1 ; +0x36c, 0x180126084 jz loc_180126164 ; +0x36e, 0x180126086 mov rdx, rdi; struct _s_FuncInfo * ; +0x374, 0x18012608c mov rcx, rsi; struct _xDISPATCHER_CONTEXT * ; +0x377, 0x18012608f call ?ExecutionInCatch@__FrameHandler3@@SA_NPEAU_xDISPATCHER_CONTEXT@@PEBU_s_FuncInfo@@@Z ; +0x37a, 0x180126092 test al, al ; +0x37f, 0x180126097 jnz loc_180126164 ; +0x381, 0x180126099 mov eax, [rdi+24h] ; +0x387, 0x18012609f shr eax, 2 ; +0x38a, 0x1801260a2 test al, 1 ; +0x38d, 0x1801260a5 jnz loc_1801261BA ; +0x38f, 0x1801260a7 cmp [rdi+20h], r13d ; +0x395, 0x1801260ad jz short loc_1801260C4 ; +0x399, 0x1801260b1 call _GetImageBase ; +0x39b, 0x1801260b3 mov rdx, rax ; +0x3a0, 0x1801260b8 movsxd rax, dword ptr [rdi+20h] ; +0x3a3, 0x1801260bb add rdx, rax ; +0x3a7, 0x1801260bf jmp short loc_1801260C7 ; +0x3aa, 0x1801260c2 mov rdx, r13; struct _s_ESTypeList * ; +0x3ac, 0x1801260c4 mov rcx, rbx; struct EHExceptionRecord * ; +0x3af, 0x1801260c7 call ?IsInExceptionSpec@@YAEPEAUEHExceptionRecord@@PEBU_s_ESTypeList@@@Z ; +0x3b2, 0x1801260ca test al, al ; +0x3b7, 0x1801260cf jnz loc_180126164 ; +0x3b9, 0x1801260d1 lea r9, [rbp+60h+var_D8]; unsigned __int64 * ; +0x3bf, 0x1801260d7 mov r8, rdi; struct _s_FuncInfo * ; +0x3c3, 0x1801260db mov rdx, rsi; struct _xDISPATCHER_CONTEXT * ; +0x3c6, 0x1801260de mov rcx, r12; unsigned __int64 * ; +0x3c9, 0x1801260e1 call ?_GetEstablisherFrame@@YAPEA_KPEA_KPEAU_xDISPATCHER_CONTEXT@@PEBU_s_FuncInfo@@0@Z ; +0x3cc, 0x1801260e4 mov cl, [rbp+60h+arg_28] ; +0x3d1, 0x1801260e9 mov r9, rax; unsigned __int64 * ; +0x3d7, 0x1801260ef mov r8, [rsp+160h+var_F8]; struct _CONTEXT * ; +0x3da, 0x1801260f2 mov rdx, rbx; struct EHExceptionRecord * ; +0x3df, 0x1801260f7 mov [rsp+160h+var_110], cl; char ; +0x3e2, 0x1801260fa or ecx, 0FFFFFFFFh ; +0x3e6, 0x1801260fe mov [rsp+160h+var_118], rsi; struct _xDISPATCHER_CONTEXT * ; +0x3e9, 0x180126101 mov [rsp+160h+var_120], r13; struct _s_HandlerType * ; +0x3ee, 0x180126106 mov dword ptr [rsp+160h+var_128], ecx; int ; +0x3f3, 0x18012610b mov dword ptr [rsp+160h+var_130], ecx; int ; +0x3f7, 0x18012610f mov rcx, r12; unsigned __int64 * ; +0x3fb, 0x180126113 mov [rsp+160h+var_138], rdi; struct _s_FuncInfo * ; +0x3fe, 0x180126116 mov [rsp+160h+var_140], r13; void * ; +0x403, 0x18012611b call ?UnwindNestedFrames@__FrameHandler3@@SAXPEA_KPEAUEHExceptionRecord@@PEAU_CONTEXT@@0PEAXPEBU_s_FuncInfo@@HHPEBU_s_HandlerType@@PEAU_xDISPATCHER_CONTEXT@@E@Z ; +0x408, 0x180126120 jmp short loc_180126164 ; +0x40d, 0x180126125 cmp dword ptr [rdi+0Ch], 0 ; +0x40f, 0x180126127 jbe short loc_180126164 ; +0x413, 0x18012612b cmp [rbp+60h+arg_28], 0 ; +0x415, 0x18012612d jnz loc_1801261D7 ; +0x41c, 0x180126134 mov eax, [rbp+60h+arg_30] ; +0x422, 0x18012613a mov r9, rsi ; +0x428, 0x180126140 mov [rsp+160h+var_128], r13; int ; +0x42b, 0x180126143 mov r8, r15 ; +0x430, 0x180126148 mov dword ptr [rsp+160h+var_130], eax; int ; +0x433, 0x18012614b mov rdx, r12 ; +0x437, 0x18012614f mov dword ptr [rsp+160h+var_138], r14d; int ; +0x43a, 0x180126152 mov rcx, rbx; struct EHExceptionRecord * ; +0x43f, 0x180126157 mov [rsp+160h+var_140], rdi; struct _s_FuncInfo * ; +0x442, 0x18012615a call ??$FindHandlerForForeignException@V__FrameHandler3@@@@YAXPEAUEHExceptionRecord@@PEA_KPEAU_CONTEXT@@PEAU_xDISPATCHER_CONTEXT@@PEBU_s_FuncInfo@@HH1@Z ; +0x447, 0x18012615f call __vcrt_getptd ; +0x44c, 0x180126164 cmp qword ptr [rax+38h], 0 ; +0x451, 0x180126169 jnz short loc_1801261D7 ; +0x456, 0x18012616e mov rcx, [rbp+60h+var_50] ; +0x458, 0x180126170 xor rcx, rsp; StackCookie ; +0x45c, 0x180126174 call __security_check_cookie ; +0x45f, 0x180126177 add rsp, 128h ; +0x464, 0x18012617c pop r15 ; +0x46b, 0x180126183 pop r14 ; +0x46d, 0x180126185 pop r13 ; +0x46f, 0x180126187 pop r12 ; +0x471, 0x180126189 pop rdi ; +0x473, 0x18012618b pop rsi ; +0x474, 0x18012618c pop rbx ; +0x475, 0x18012618d pop rbp ; +0x476, 0x18012618e retn ; +0x477, 0x18012618f mov dl, 1 ; +0x478, 0x180126190 mov rcx, rbx ; +0x47a, 0x180126192 call __DestructExceptionObject ; +0x47d, 0x180126195 lea rcx, [rbp+60h+pExceptionObject] ; +0x482, 0x18012619a call sub_1801267AC ; +0x486, 0x18012619e lea rdx, __TI2?AVbad_exception@std@@; pThrowInfo ; +0x48b, 0x1801261a3 lea rcx, [rbp+60h+pExceptionObject]; pExceptionObject ; +0x492, 0x1801261aa call _CxxThrowException ; +0x496, 0x1801261ae align 4 ; +0x49b, 0x1801261b3 call terminate ; +0x49c, 0x1801261b4 align 2 ; +0x4a1, 0x1801261b9 call __vcrt_getptd ; +0x4a2, 0x1801261ba mov [rax+20h], rbx ; +0x4a7, 0x1801261bf call __vcrt_getptd ; +0x4ab, 0x1801261c3 mov rcx, [rsp+160h+var_F8] ; +0x4b0, 0x1801261c8 mov [rax+28h], rcx ; +0x4b5, 0x1801261cd call terminate ; +0x4b9, 0x1801261d1 db 0CCh ; +0x4be, 0x1801261d6 call abort ; +0x4bf, 0x1801261d7 db 0CCh ; +0x4c4, 0x1801261dc