{"type": "func", "start": 6443656504, "end": 6443657071, "name": "__InternalCxxFrameHandler<__FrameHandler3>", "pseudocode": "// \n// __InternalCxxFrameHandler<__FrameHandler3> from 0x180126538 to 0x18012676f (567 bytes)\n// \n// 3 xrefs:\n// > __CxxFrameHandler3 @ 0x18012585c\n// > unknown_libname_15 @ 0x180142c26\n// > @ 0x1802028f4\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\n__int64 __fastcall __InternalCxxFrameHandler<__FrameHandler3>(\n struct EHExceptionRecord *a1,\n unsigned __int64 *a2,\n struct _CONTEXT *a3,\n struct _xDISPATCHER_CONTEXT *a4,\n struct _s_FuncInfo *a5,\n int a6,\n __int64 a7,\n unsigned __int8 a8)\n{\n __int64 v12; // rcx\n __int64 v13; // rax\n __int64 dispESTypeList; // rcx\n bool v15; // zf\n __ehstate_t v16; // eax\n __ehstate_t pThrowImageBase; // r9d\n unsigned __int64 *pExceptionObject; // rcx\n __int64 ImageBase; // rax\n __int64 (__fastcall *v20)(struct EHExceptionRecord *, unsigned __int64 *, struct _CONTEXT *, struct _xDISPATCHER_CONTEXT *, struct _s_FuncInfo *, int, __int64, _DWORD); // r10\n\n _except_validate_context_record((__int64)a3);\n v13 = _vcrt_getptd(v12);\n dispESTypeList = 2147483689LL;\n if ( *(_DWORD *)(v13 + 64) || a1->ExceptionCode == -529697949 )\n goto LABEL_10;\n if ( a1->ExceptionCode != -2147483607 )\n {\n v15 = a1->ExceptionCode == -2147483610;\nLABEL_7:\n if ( v15 )\n goto LABEL_10;\n goto LABEL_8;\n }\n if ( a1->NumberParameters == 15 )\n {\n v15 = *(_QWORD *)&a1[1].params.magicNumber == 429065504;\n goto LABEL_7;\n }\nLABEL_8:\n if ( (*(_DWORD *)a5 & 0x1FFFFFFFu) >= 0x19930522 && (a5->EHFlags & 1) != 0 )\n return 1;\nLABEL_10:\n if ( (a1->ExceptionFlags & 0x66) != 0 )\n {\n if ( !a5->maxState || a6 )\n return 1;\n if ( (a1->ExceptionFlags & 0x20) != 0 )\n {\n if ( a1->ExceptionCode == -2147483610 )\n {\n v16 = __FrameHandler3::StateFromIp(a5, a4, a4->TargetIp);\n if ( v16 >= -1 && v16 < a5->maxState )\n {\n pThrowImageBase = v16;\n pExceptionObject = a2;\nLABEL_18:\n __FrameHandler3::FrameUnwindToState(pExceptionObject, a4, a5, pThrowImageBase);\n return 1;\n }\n goto LABEL_38;\n }\n if ( a1->ExceptionCode == -2147483607 )\n {\n pThrowImageBase = (__ehstate_t)a1->params.pThrowImageBase;\n if ( pThrowImageBase >= -1 && pThrowImageBase < a5->maxState )\n {\n pExceptionObject = (unsigned __int64 *)a1->params.pExceptionObject;\n goto LABEL_18;\n }\nLABEL_38:\n abort();\n }\n }\n __FrameHandler3::FrameUnwindToEmptyState(a2, a4, a5);\n return 1;\n }\n if ( a5->nTryBlocks\n || (*(_DWORD *)a5 & 0x1FFFFFFFu) >= 0x19930521\n && a5->dispESTypeList\n && (ImageBase = GetImageBase(2147483689LL), dispESTypeList = a5->dispESTypeList, dispESTypeList + ImageBase)\n || (*(_DWORD *)a5 & 0x1FFFFFFFu) >= 0x19930522 && (a5->EHFlags & 4) != 0 )\n {\n if ( a1->ExceptionCode == -529697949 && a1->NumberParameters >= 3 && a1->params.magicNumber > 0x19930522 )\n {\n if ( a1->params.pThrowInfo->pForwardCompat )\n {\n v20 = (__int64 (__fastcall *)(struct EHExceptionRecord *, unsigned __int64 *, struct _CONTEXT *, struct _xDISPATCHER_CONTEXT *, struct _s_FuncInfo *, int, __int64, _DWORD))(a1->params.pThrowInfo->pForwardCompat + GetThrowImageBase(dispESTypeList));\n if ( v20 )\n return v20(a1, a2, a3, a4, a5, a6, a7, a8);\n }\n }\n FindHandler<__FrameHandler3>(a1, a2, a3, a4, a5, a8, a6, a7);\n }\n return 1;\n}", "assembly": "; \n; __InternalCxxFrameHandler<__FrameHandler3> from 0x180126538 to 0x18012676f (567 bytes)\n; \n; 3 xrefs:\n; > __CxxFrameHandler3 @ 0x18012585c\n; > unknown_libname_15 @ 0x180142c26\n; > @ 0x1802028f4\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov rax, rsp ; +0x0, 0x180126538\nmov [rax+8], rbx ; +0x3, 0x18012653b\nmov [rax+10h], rbp ; +0x7, 0x18012653f\nmov [rax+18h], rsi ; +0xb, 0x180126543\nmov [rax+20h], rdi ; +0xf, 0x180126547\npush r14 ; +0x13, 0x18012654b\nsub rsp, 50h ; +0x15, 0x18012654d\nmov rdi, rcx ; +0x19, 0x180126551\nmov rsi, r9 ; +0x1c, 0x180126554\nmov rcx, r8 ; +0x1f, 0x180126557\nmov r14, r8 ; +0x22, 0x18012655a\nmov rbp, rdx ; +0x25, 0x18012655d\ncall __except_validate_context_record ; +0x28, 0x180126560\ncall __vcrt_getptd ; +0x2d, 0x180126565\nmov rbx, [rsp+58h+arg_20] ; +0x32, 0x18012656a\nmov ecx, 80000029h ; +0x3a, 0x180126572\nmov edx, 80000026h ; +0x3f, 0x180126577\ncmp dword ptr [rax+40h], 0 ; +0x44, 0x18012657c\njnz short loc_1801265BA ; +0x48, 0x180126580\ncmp dword ptr [rdi], 0E06D7363h ; +0x4a, 0x180126582\njz short loc_1801265BA ; +0x50, 0x180126588\ncmp [rdi], ecx ; +0x52, 0x18012658a\njnz short loc_18012659E ; +0x54, 0x18012658c\ncmp dword ptr [rdi+18h], 0Fh ; +0x56, 0x18012658e\njnz short loc_1801265A2 ; +0x5a, 0x180126592\ncmp qword ptr [rdi+60h], 19930520h ; +0x5c, 0x180126594\njmp short loc_1801265A0 ; +0x64, 0x18012659c\ncmp [rdi], edx ; +0x66, 0x18012659e\njz short loc_1801265BA ; +0x68, 0x1801265a0\nmov eax, [rbx] ; +0x6a, 0x1801265a2\nand eax, 1FFFFFFFh ; +0x6c, 0x1801265a4\ncmp eax, 19930522h ; +0x71, 0x1801265a9\njb short loc_1801265BA ; +0x76, 0x1801265ae\ntest byte ptr [rbx+24h], 1 ; +0x78, 0x1801265b0\njnz loc_180126749 ; +0x7c, 0x1801265b4\ntest byte ptr [rdi+4], 66h ; +0x82, 0x1801265ba\njz loc_180126652 ; +0x86, 0x1801265be\ncmp dword ptr [rbx+4], 0 ; +0x8c, 0x1801265c4\njz loc_180126749 ; +0x90, 0x1801265c8\ncmp [rsp+58h+arg_28], 0 ; +0x96, 0x1801265ce\njnz loc_180126749 ; +0x9e, 0x1801265d6\ntest byte ptr [rdi+4], 20h ; +0xa4, 0x1801265dc\njz short loc_18012663F ; +0xa8, 0x1801265e0\ncmp [rdi], edx ; +0xaa, 0x1801265e2\njnz short loc_18012661D ; +0xac, 0x1801265e4\nmov r8, [rsi+20h]; unsigned __int64 ; +0xae, 0x1801265e6\nmov rdx, rsi; struct _xDISPATCHER_CONTEXT * ; +0xb2, 0x1801265ea\nmov rcx, rbx; struct _s_FuncInfo * ; +0xb5, 0x1801265ed\ncall ?StateFromIp@__FrameHandler3@@SAHPEBU_s_FuncInfo@@PEAU_xDISPATCHER_CONTEXT@@_K@Z ; +0xb8, 0x1801265f0\ncmp eax, 0FFFFFFFFh ; +0xbd, 0x1801265f5\njl loc_180126769 ; +0xc0, 0x1801265f8\ncmp eax, [rbx+4] ; +0xc6, 0x1801265fe\njge loc_180126769 ; +0xc9, 0x180126601\nmov r9d, eax; int ; +0xcf, 0x180126607\nmov rcx, rbp; unsigned __int64 * ; +0xd2, 0x18012660a\nmov rdx, rsi; struct _xDISPATCHER_CONTEXT * ; +0xd5, 0x18012660d\nmov r8, rbx; struct _s_FuncInfo * ; +0xd8, 0x180126610\ncall ?FrameUnwindToState@__FrameHandler3@@SAXPEA_KPEAU_xDISPATCHER_CONTEXT@@PEBU_s_FuncInfo@@H@Z ; +0xdb, 0x180126613\njmp loc_180126749 ; +0xe0, 0x180126618\ncmp [rdi], ecx ; +0xe5, 0x18012661d\njnz short loc_18012663F ; +0xe7, 0x18012661f\nmov r9d, [rdi+38h] ; +0xe9, 0x180126621\ncmp r9d, 0FFFFFFFFh ; +0xed, 0x180126625\njl loc_180126769 ; +0xf1, 0x180126629\ncmp r9d, [rbx+4] ; +0xf7, 0x18012662f\njge loc_180126769 ; +0xfb, 0x180126633\nmov rcx, [rdi+28h] ; +0x101, 0x180126639\njmp short loc_18012660D ; +0x105, 0x18012663d\nmov r8, rbx; struct _s_FuncInfo * ; +0x107, 0x18012663f\nmov rdx, rsi; struct _xDISPATCHER_CONTEXT * ; +0x10a, 0x180126642\nmov rcx, rbp; unsigned __int64 * ; +0x10d, 0x180126645\ncall ?FrameUnwindToEmptyState@__FrameHandler3@@SAXPEA_KPEAU_xDISPATCHER_CONTEXT@@PEBU_s_FuncInfo@@@Z ; +0x110, 0x180126648\njmp loc_180126749 ; +0x115, 0x18012664d\ncmp dword ptr [rbx+0Ch], 0 ; +0x11a, 0x180126652\njnz short loc_18012669A ; +0x11e, 0x180126656\nmov eax, [rbx] ; +0x120, 0x180126658\nand eax, 1FFFFFFFh ; +0x122, 0x18012665a\ncmp eax, 19930521h ; +0x127, 0x18012665f\njb short loc_18012667A ; +0x12c, 0x180126664\ncmp dword ptr [rbx+20h], 0 ; +0x12e, 0x180126666\njz short loc_18012667A ; +0x132, 0x18012666a\ncall _GetImageBase ; +0x134, 0x18012666c\nmovsxd rcx, dword ptr [rbx+20h] ; +0x139, 0x180126671\nadd rax, rcx ; +0x13d, 0x180126675\njnz short loc_18012669A ; +0x140, 0x180126678\nmov eax, [rbx] ; +0x142, 0x18012667a\nand eax, 1FFFFFFFh ; +0x144, 0x18012667c\ncmp eax, 19930522h ; +0x149, 0x180126681\njb loc_180126749 ; +0x14e, 0x180126686\nmov eax, [rbx+24h] ; +0x154, 0x18012668c\nshr eax, 2 ; +0x157, 0x18012668f\ntest al, 1 ; +0x15a, 0x180126692\njz loc_180126749 ; +0x15c, 0x180126694\ncmp dword ptr [rdi], 0E06D7363h ; +0x162, 0x18012669a\njnz short loc_180126710 ; +0x168, 0x1801266a0\ncmp dword ptr [rdi+18h], 3 ; +0x16a, 0x1801266a2\njb short loc_180126710 ; +0x16e, 0x1801266a6\ncmp dword ptr [rdi+20h], 19930522h ; +0x170, 0x1801266a8\njbe short loc_180126710 ; +0x177, 0x1801266af\nmov rax, [rdi+30h] ; +0x179, 0x1801266b1\ncmp dword ptr [rax+8], 0 ; +0x17d, 0x1801266b5\njz short loc_180126710 ; +0x181, 0x1801266b9\ncall _GetThrowImageBase ; +0x183, 0x1801266bb\nmov r10, rax ; +0x188, 0x1801266c0\nmov rax, [rdi+30h] ; +0x18b, 0x1801266c3\nmovsxd rcx, dword ptr [rax+8] ; +0x18f, 0x1801266c7\nadd r10, rcx ; +0x193, 0x1801266cb\njz short loc_180126710 ; +0x196, 0x1801266ce\nmovzx ecx, [rsp+58h+arg_38] ; +0x198, 0x1801266d0\nmov r9, rsi ; +0x1a0, 0x1801266d8\nmov dword ptr [rsp+58h+var_20], ecx ; +0x1a3, 0x1801266db\nmov r8, r14 ; +0x1a7, 0x1801266df\nmov rcx, [rsp+58h+arg_30] ; +0x1aa, 0x1801266e2\nmov rdx, rbp ; +0x1b2, 0x1801266ea\nmov qword ptr [rsp+58h+var_28], rcx ; +0x1b5, 0x1801266ed\nmov rax, r10 ; +0x1ba, 0x1801266f2\nmov ecx, [rsp+58h+arg_28] ; +0x1bd, 0x1801266f5\nmov dword ptr [rsp+58h+var_30], ecx ; +0x1c4, 0x1801266fc\nmov rcx, rdi ; +0x1c8, 0x180126700\nmov [rsp+58h+var_38], rbx ; +0x1cb, 0x180126703\ncall cs:__guard_dispatch_icall_fptr ; +0x1d0, 0x180126708\njmp short loc_18012674E ; +0x1d6, 0x18012670e\nmov rax, [rsp+58h+arg_30] ; +0x1d8, 0x180126710\nmov r9, rsi ; +0x1e0, 0x180126718\nmov [rsp+58h+var_20], rax; __int64 ; +0x1e3, 0x18012671b\nmov r8, r14 ; +0x1e8, 0x180126720\nmov eax, [rsp+58h+arg_28] ; +0x1eb, 0x180126723\nmov rdx, rbp; unsigned __int64 * ; +0x1f2, 0x18012672a\nmov [rsp+58h+var_28], eax; int ; +0x1f5, 0x18012672d\nmov rcx, rdi; struct EHExceptionRecord * ; +0x1f9, 0x180126731\nmov al, [rsp+58h+arg_38] ; +0x1fc, 0x180126734\nmov [rsp+58h+var_30], al; char ; +0x203, 0x18012673b\nmov [rsp+58h+var_38], rbx; struct _s_FuncInfo * ; +0x207, 0x18012673f\ncall ??$FindHandler@V__FrameHandler3@@@@YAXPEAUEHExceptionRecord@@PEA_KPEAU_CONTEXT@@PEAU_xDISPATCHER_CONTEXT@@PEBU_s_FuncInfo@@EH1@Z ; +0x20c, 0x180126744\nmov eax, 1 ; +0x211, 0x180126749\nmov rbx, [rsp+58h+arg_0] ; +0x216, 0x18012674e\nmov rbp, [rsp+58h+arg_8] ; +0x21b, 0x180126753\nmov rsi, [rsp+58h+arg_10] ; +0x220, 0x180126758\nmov rdi, [rsp+58h+arg_18] ; +0x225, 0x18012675d\nadd rsp, 50h ; +0x22a, 0x180126762\npop r14 ; +0x22e, 0x180126766\nretn ; +0x230, 0x180126768\ncall abort ; +0x231, 0x180126769\ndb 0CCh ; +0x236, 0x18012676e", "xrefs": ["__CxxFrameHandler3 @ 0x18012585c", "unknown_libname_15 @ 0x180142c26", " @ 0x1802028f4"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}