{"type": "func", "start": 6443652612, "end": 6443652871, "name": "__FrameHandler3::UnwindNestedFrames", "pseudocode": "// \n// __FrameHandler3::UnwindNestedFrames from 0x180125604 to 0x180125707 (259 bytes)\n// \n// 3 xrefs:\n// > CatchIt<__FrameHandler3> @ 0x180125cf8\n// > FindHandler<__FrameHandler3> @ 0x180126120\n// > @ 0x18020281c\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nvoid __fastcall __FrameHandler3::UnwindNestedFrames(\n void **a1,\n struct EHExceptionRecord *a2,\n struct _CONTEXT *a3,\n unsigned __int64 *a4,\n void *a5,\n const struct _s_FuncInfo *a6,\n int a7,\n int a8,\n const struct _s_HandlerType *a9,\n struct _xDISPATCHER_CONTEXT *a10,\n unsigned __int8 a11)\n{\n void *v11; // rcx\n struct _CONTEXT *ContextRecord; // rax\n void *ControlPc; // rdx\n struct _UNWIND_HISTORY_TABLE *HistoryTable; // [rsp+28h] [rbp-99h]\n EXCEPTION_RECORD ExceptionRecord; // [rsp+30h] [rbp-91h] BYREF\n\n ExceptionRecord = *(EXCEPTION_RECORD *)byte_180170B30;\n v11 = *a1;\n ExceptionRecord.ExceptionInformation[0] = (ULONG_PTR)unknown_libname_19;\n ExceptionRecord.ExceptionInformation[2] = (ULONG_PTR)a5;\n ExceptionRecord.ExceptionInformation[3] = a7;\n ExceptionRecord.ExceptionInformation[5] = (ULONG_PTR)a6;\n ExceptionRecord.ExceptionInformation[7] = a11;\n HistoryTable = a10->HistoryTable;\n ContextRecord = a10->ContextRecord;\n ExceptionRecord.ExceptionInformation[1] = (ULONG_PTR)a4;\n ExceptionRecord.ExceptionInformation[4] = (ULONG_PTR)a3;\n ExceptionRecord.ExceptionInformation[6] = (ULONG_PTR)a2;\n ControlPc = (void *)a10->ControlPc;\n ExceptionRecord.ExceptionInformation[8] = 429065504;\n RtlUnwindEx(v11, ControlPc, &ExceptionRecord, nullptr, ContextRecord, HistoryTable);\n}", "assembly": "; \n; __FrameHandler3::UnwindNestedFrames from 0x180125604 to 0x180125707 (259 bytes)\n; \n; 3 xrefs:\n; > CatchIt<__FrameHandler3> @ 0x180125cf8\n; > FindHandler<__FrameHandler3> @ 0x180126120\n; > @ 0x18020281c\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\npush rbp ; +0x0, 0x180125604\nlea rbp, [rsp-1Fh] ; +0x2, 0x180125606\nsub rsp, 0E0h ; +0x7, 0x18012560b\nmov rax, cs:__security_cookie ; +0xe, 0x180125612\nxor rax, rsp ; +0x15, 0x180125619\nmov [rbp+1Fh+var_10], rax ; +0x18, 0x18012561c\nmov r10, [rbp+1Fh+arg_48] ; +0x1c, 0x180125620\nlea rax, byte_180170B30 ; +0x20, 0x180125624\nmovups xmm0, xmmword ptr [rax] ; +0x27, 0x18012562b\nmov r11, rcx ; +0x2a, 0x18012562e\nlea rcx, [rsp+0E0h+ExceptionRecord] ; +0x2d, 0x180125631\nmovups xmm1, xmmword ptr [rax+10h] ; +0x32, 0x180125636\nmovups xmmword ptr [rcx], xmm0 ; +0x36, 0x18012563a\nmovups xmm0, xmmword ptr [rax+20h] ; +0x39, 0x18012563d\nmovups xmmword ptr [rcx+10h], xmm1 ; +0x3d, 0x180125641\nmovups xmm1, xmmword ptr [rax+30h] ; +0x41, 0x180125645\nmovups xmmword ptr [rcx+20h], xmm0 ; +0x45, 0x180125649\nmovups xmm0, xmmword ptr [rax+40h] ; +0x49, 0x18012564d\nmovups xmmword ptr [rcx+30h], xmm1 ; +0x4d, 0x180125651\nmovups xmm1, xmmword ptr [rax+50h] ; +0x51, 0x180125655\nmovups xmmword ptr [rcx+40h], xmm0 ; +0x55, 0x180125659\nmovups xmm0, xmmword ptr [rax+60h] ; +0x59, 0x18012565d\nmovups xmmword ptr [rcx+50h], xmm1 ; +0x5d, 0x180125661\nmovups xmm1, xmmword ptr [rax+80h] ; +0x61, 0x180125665\nmovups xmmword ptr [rcx+60h], xmm0 ; +0x68, 0x18012566c\nmovups xmm0, xmmword ptr [rax+70h] ; +0x6c, 0x180125670\nmov rax, [rax+90h] ; +0x70, 0x180125674\nmovups xmmword ptr [rcx+70h], xmm0 ; +0x77, 0x18012567b\nmovups xmmword ptr [rcx+80h], xmm1 ; +0x7b, 0x18012567f\nmov [rcx+90h], rax ; +0x82, 0x180125686\nlea rax, unknown_libname_19; Microsoft VisualC v14 64bit runtime ; +0x89, 0x18012568d\nmov rcx, [r11]; TargetFrame ; +0x90, 0x180125694\nmov [rbp+1Fh+ExceptionRecord.ExceptionInformation], rax ; +0x93, 0x180125697\nmov rax, [rbp+1Fh+arg_20] ; +0x97, 0x18012569b\nmov [rbp+1Fh+ExceptionRecord.ExceptionInformation+10h], rax ; +0x9b, 0x18012569f\nmovsxd rax, [rbp+1Fh+arg_30] ; +0x9f, 0x1801256a3\nmov [rbp+1Fh+ExceptionRecord.ExceptionInformation+18h], rax ; +0xa3, 0x1801256a7\nmov rax, [rbp+1Fh+arg_28] ; +0xa7, 0x1801256ab\nmov [rbp+1Fh+ExceptionRecord.ExceptionInformation+28h], rax ; +0xab, 0x1801256af\nmovzx eax, [rbp+1Fh+arg_50] ; +0xaf, 0x1801256b3\nmov [rbp+1Fh+ExceptionRecord.ExceptionInformation+38h], rax ; +0xb3, 0x1801256b7\nmov rax, [r10+40h] ; +0xb7, 0x1801256bb\nmov [rsp+0E0h+HistoryTable], rax; HistoryTable ; +0xbb, 0x1801256bf\nmov rax, [r10+28h] ; +0xc0, 0x1801256c4\nmov [rbp+1Fh+ExceptionRecord.ExceptionInformation+8], r9 ; +0xc4, 0x1801256c8\nxor r9d, r9d; ReturnValue ; +0xc8, 0x1801256cc\nmov [rbp+1Fh+ExceptionRecord.ExceptionInformation+20h], r8 ; +0xcb, 0x1801256cf\nlea r8, [rsp+0E0h+ExceptionRecord]; ExceptionRecord ; +0xcf, 0x1801256d3\nmov [rbp+1Fh+ExceptionRecord.ExceptionInformation+30h], rdx ; +0xd4, 0x1801256d8\nmov rdx, [r10]; TargetIp ; +0xd8, 0x1801256dc\nmov [rsp+0E0h+ContextRecord], rax; ContextRecord ; +0xdb, 0x1801256df\nmov [rbp+1Fh+ExceptionRecord.ExceptionInformation+40h], 19930520h ; +0xe0, 0x1801256e4\ncall cs:RtlUnwindEx ; +0xe8, 0x1801256ec\nmov rcx, [rbp+1Fh+var_10] ; +0xee, 0x1801256f2\nxor rcx, rsp; StackCookie ; +0xf2, 0x1801256f6\ncall __security_check_cookie ; +0xf5, 0x1801256f9\nadd rsp, 0E0h ; +0xfa, 0x1801256fe\npop rbp ; +0x101, 0x180125705\nretn ; +0x102, 0x180125706", "xrefs": ["CatchIt<__FrameHandler3> @ 0x180125cf8", "FindHandler<__FrameHandler3> @ 0x180126120", " @ 0x18020281c"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}