{"type": "func", "start": 6443652088, "end": 6443652289, "name": "_GetEstablisherFrame", "pseudocode": "// \n// _GetEstablisherFrame from 0x1801253f8 to 0x1801254c1 (201 bytes)\n// \n// 8 xrefs:\n// > __FrameHandler3::FrameUnwindToEmptyState @ 0x1801253ae\n// > __GetUnwindTryBlock @ 0x1801258ae\n// > __SetUnwindTryBlock @ 0x1801258ed\n// > CatchIt<__FrameHandler3> @ 0x180125c7c\n// > FindHandler<__FrameHandler3> @ 0x1801260e4\n// > __FrameHandler3::GetHandlerSearchState @ 0x180126cd1\n// > @ 0x1802027f8\n// > @ 0x180202804\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nunsigned __int64 *__fastcall _GetEstablisherFrame(\n unsigned __int64 *a1,\n struct _xDISPATCHER_CONTEXT *a2,\n const struct _s_FuncInfo *a3,\n unsigned __int64 *a4)\n{\n __int64 v4; // rdi\n int v9; // ebp\n _DWORD *v10; // rbx\n PRUNTIME_FUNCTION v11; // rax\n __int64 v12; // rcx\n unsigned __int64 v13; // r8\n unsigned int v14; // r9d\n _DWORD *v15; // rdx\n unsigned __int64 ImageBase; // [rsp+50h] [rbp+8h] BYREF\n\n LODWORD(v4) = a3->nTryBlocks;\n v9 = __FrameHandler3::StateFromControlPc(a3, a2);\n *a4 = *a1;\n while ( (_DWORD)v4 )\n {\n v4 = (unsigned int)(v4 - 1);\n v10 = (_DWORD *)(a2->ImageBase + a3->dispTryBlockMap + 20 * v4);\n if ( v9 > v10[1] && v9 <= v10[2] )\n {\n v11 = RtlLookupFunctionEntry(a2->ControlPc, &ImageBase, nullptr);\n v12 = 0;\n v13 = ImageBase + (int)v10[4];\n v14 = v10[3];\n if ( v14 )\n {\n v15 = (_DWORD *)(v13 + 12);\n while ( *v15 != (unsigned __int64)v11->BeginAddress )\n {\n v12 = (unsigned int)(v12 + 1);\n v15 += 5;\n if ( (unsigned int)v12 >= v14 )\n goto LABEL_9;\n }\nLABEL_10:\n *a4 = *(_QWORD *)(*(int *)(v13 + 20 * v12 + 16) + *a1);\n return a4;\n }\nLABEL_9:\n if ( (unsigned int)v12 < v14 )\n goto LABEL_10;\n }\n }\n return a4;\n}", "assembly": "; \n; _GetEstablisherFrame from 0x1801253f8 to 0x1801254c1 (201 bytes)\n; \n; 8 xrefs:\n; > __FrameHandler3::FrameUnwindToEmptyState @ 0x1801253ae\n; > __GetUnwindTryBlock @ 0x1801258ae\n; > __SetUnwindTryBlock @ 0x1801258ed\n; > CatchIt<__FrameHandler3> @ 0x180125c7c\n; > FindHandler<__FrameHandler3> @ 0x1801260e4\n; > __FrameHandler3::GetHandlerSearchState @ 0x180126cd1\n; > @ 0x1802027f8\n; > @ 0x180202804\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov [rsp+arg_8], rbx ; +0x0, 0x1801253f8\nmov [rsp+arg_10], rbp ; +0x5, 0x1801253fd\npush rsi ; +0xa, 0x180125402\npush rdi ; +0xb, 0x180125403\npush r12 ; +0xc, 0x180125404\npush r14 ; +0xe, 0x180125406\npush r15 ; +0x10, 0x180125408\nsub rsp, 20h ; +0x12, 0x18012540a\nmov edi, [r8+0Ch] ; +0x16, 0x18012540e\nmov r12, rcx ; +0x1a, 0x180125412\nmov rcx, r8; struct _s_FuncInfo * ; +0x1d, 0x180125415\nmov rsi, r9 ; +0x20, 0x180125418\nmov r14, r8 ; +0x23, 0x18012541b\nmov r15, rdx ; +0x26, 0x18012541e\ncall ?StateFromControlPc@__FrameHandler3@@SAHPEBU_s_FuncInfo@@PEAU_xDISPATCHER_CONTEXT@@@Z ; +0x29, 0x180125421\nmov r10, [r12] ; +0x2e, 0x180125426\nmov ebp, eax ; +0x32, 0x18012542a\nmov [rsi], r10 ; +0x34, 0x18012542c\ntest edi, edi ; +0x37, 0x18012542f\njz short loc_1801254A7 ; +0x39, 0x180125431\nmovsxd rax, dword ptr [r14+10h] ; +0x3b, 0x180125433\ndec edi ; +0x3f, 0x180125437\nlea rdx, [rdi+rdi*4] ; +0x41, 0x180125439\nlea rbx, [rax+rdx*4] ; +0x45, 0x18012543d\nadd rbx, [r15+8] ; +0x49, 0x180125441\ncmp ebp, [rbx+4] ; +0x4d, 0x180125445\njle short loc_18012542F ; +0x50, 0x180125448\ncmp ebp, [rbx+8] ; +0x52, 0x18012544a\njg short loc_18012542F ; +0x55, 0x18012544d\nmov rcx, [r15]; ControlPc ; +0x57, 0x18012544f\nlea rdx, [rsp+48h+ImageBase]; ImageBase ; +0x5a, 0x180125452\nxor r8d, r8d; HistoryTable ; +0x5f, 0x180125457\ncall cs:RtlLookupFunctionEntry ; +0x62, 0x18012545a\nmovsxd r8, dword ptr [rbx+10h] ; +0x68, 0x180125460\nxor ecx, ecx ; +0x6c, 0x180125464\nadd r8, [rsp+48h+ImageBase] ; +0x6e, 0x180125466\nmov r9d, [rbx+0Ch] ; +0x73, 0x18012546b\nmov r10d, [rax] ; +0x77, 0x18012546f\ntest r9d, r9d ; +0x7a, 0x180125472\njz short loc_18012548E ; +0x7d, 0x180125475\nlea rdx, [r8+0Ch] ; +0x7f, 0x180125477\nmovsxd rax, dword ptr [rdx] ; +0x83, 0x18012547b\ncmp rax, r10 ; +0x86, 0x18012547e\njz short loc_180125493 ; +0x89, 0x180125481\ninc ecx ; +0x8b, 0x180125483\nadd rdx, 14h ; +0x8d, 0x180125485\ncmp ecx, r9d ; +0x91, 0x180125489\njb short loc_18012547B ; +0x94, 0x18012548c\ncmp ecx, r9d ; +0x96, 0x18012548e\njnb short loc_18012542F ; +0x99, 0x180125491\nmov rax, [r12] ; +0x9b, 0x180125493\nlea rcx, [rcx+rcx*4] ; +0x9f, 0x180125497\nmovsxd rcx, dword ptr [r8+rcx*4+10h] ; +0xa3, 0x18012549b\nmov rcx, [rcx+rax] ; +0xa8, 0x1801254a0\nmov [rsi], rcx ; +0xac, 0x1801254a4\nmov rbx, [rsp+48h+arg_8] ; +0xaf, 0x1801254a7\nmov rax, rsi ; +0xb4, 0x1801254ac\nmov rbp, [rsp+48h+arg_10] ; +0xb7, 0x1801254af\nadd rsp, 20h ; +0xbc, 0x1801254b4\npop r15 ; +0xc0, 0x1801254b8\npop r14 ; +0xc2, 0x1801254ba\npop r12 ; +0xc4, 0x1801254bc\npop rdi ; +0xc6, 0x1801254be\npop rsi ; +0xc7, 0x1801254bf\nretn ; +0xc8, 0x1801254c0", "xrefs": ["__FrameHandler3::FrameUnwindToEmptyState @ 0x1801253ae", "__GetUnwindTryBlock @ 0x1801258ae", "__SetUnwindTryBlock @ 0x1801258ed", "CatchIt<__FrameHandler3> @ 0x180125c7c", "FindHandler<__FrameHandler3> @ 0x1801260e4", "__FrameHandler3::GetHandlerSearchState @ 0x180126cd1", " @ 0x1802027f8", " @ 0x180202804"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}