// 
// _GetEstablisherFrame from 0x1801253f8 to 0x1801254c1 (201 bytes)
// 
// 8 xrefs:
// > __FrameHandler3::FrameUnwindToEmptyState @ 0x1801253ae
// > __GetUnwindTryBlock @ 0x1801258ae
// > __SetUnwindTryBlock @ 0x1801258ed
// > CatchIt<__FrameHandler3> @ 0x180125c7c
// > FindHandler<__FrameHandler3> @ 0x1801260e4
// > __FrameHandler3::GetHandlerSearchState @ 0x180126cd1
// > <???> @ 0x1802027f8
// > <???> @ 0x180202804
// 
// This function is hookable on this platform!
// 
// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA
// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings
// 

unsigned __int64 *__fastcall _GetEstablisherFrame(
        unsigned __int64 *a1,
        struct _xDISPATCHER_CONTEXT *a2,
        const struct _s_FuncInfo *a3,
        unsigned __int64 *a4)
{
  __int64 v4; // rdi
  int v9; // ebp
  _DWORD *v10; // rbx
  PRUNTIME_FUNCTION v11; // rax
  __int64 v12; // rcx
  unsigned __int64 v13; // r8
  unsigned int v14; // r9d
  _DWORD *v15; // rdx
  unsigned __int64 ImageBase; // [rsp+50h] [rbp+8h] BYREF

  LODWORD(v4) = a3->nTryBlocks;
  v9 = __FrameHandler3::StateFromControlPc(a3, a2);
  *a4 = *a1;
  while ( (_DWORD)v4 )
  {
    v4 = (unsigned int)(v4 - 1);
    v10 = (_DWORD *)(a2->ImageBase + a3->dispTryBlockMap + 20 * v4);
    if ( v9 > v10[1] && v9 <= v10[2] )
    {
      v11 = RtlLookupFunctionEntry(a2->ControlPc, &ImageBase, nullptr);
      v12 = 0;
      v13 = ImageBase + (int)v10[4];
      v14 = v10[3];
      if ( v14 )
      {
        v15 = (_DWORD *)(v13 + 12);
        while ( *v15 != (unsigned __int64)v11->BeginAddress )
        {
          v12 = (unsigned int)(v12 + 1);
          v15 += 5;
          if ( (unsigned int)v12 >= v14 )
            goto LABEL_9;
        }
LABEL_10:
        *a4 = *(_QWORD *)(*(int *)(v13 + 20 * v12 + 16) + *a1);
        return a4;
      }
LABEL_9:
      if ( (unsigned int)v12 < v14 )
        goto LABEL_10;
    }
  }
  return a4;
}