{"type": "func", "start": 6443632360, "end": 6443632512, "name": "__scrt_is_nonwritable_in_current_image", "pseudocode": "// \n// __scrt_is_nonwritable_in_current_image from 0x1801206e8 to 0x180120780 (152 bytes)\n// \n// 2 xrefs:\n// > dllmain_crt_process_attach @ 0x180120ba0\n// > <???> @ 0x1802024ec\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nbool __fastcall _scrt_is_nonwritable_in_current_image(__int64 a1)\n{\n  unsigned __int64 v1; // r8\n  _DWORD *v2; // rdx\n  _DWORD *v3; // r9\n  unsigned __int64 v4; // rcx\n\n  if ( MEMORY[0x180000000] != 23117\n    || *(_DWORD *)(0x180000000LL + MEMORY[0x18000003C]) != 17744\n    || *(_WORD *)(0x180000018LL + MEMORY[0x18000003C]) != 523 )\n  {\n    return 0;\n  }\n  v1 = a1 - 0x180000000LL;\n  v2 = (_DWORD *)(*(unsigned __int16 *)(0x180000014LL + MEMORY[0x18000003C]) + 0x180000018LL + MEMORY[0x18000003C]);\n  v3 = &v2[10 * *(unsigned __int16 *)(0x180000006LL + MEMORY[0x18000003C])];\n  while ( v2 != v3 )\n  {\n    v4 = (unsigned int)v2[3];\n    if ( v1 >= v4 && v1 < (unsigned int)(v4 + v2[2]) )\n      return v2 && v2[9] >= 0;\n    v2 += 10;\n  }\n  v2 = nullptr;\n  return v2 && v2[9] >= 0;\n}", "assembly": "; \n; __scrt_is_nonwritable_in_current_image from 0x1801206e8 to 0x180120780 (152 bytes)\n; \n; 2 xrefs:\n; > dllmain_crt_process_attach @ 0x180120ba0\n; > <???> @ 0x1802024ec\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nsub     rsp, 18h                                                       ; +0x0, 0x1801206e8\nmov     r8, rcx                                                        ; +0x4, 0x1801206ec\nmov     eax, 5A4Dh                                                     ; +0x7, 0x1801206ef\ncmp     cs:180000000h, ax                                              ; +0xc, 0x1801206f4\njnz     short loc_180120775                                            ; +0x13, 0x1801206fb\nmovsxd  rcx, dword ptr cs:18000003Ch                                   ; +0x15, 0x1801206fd\nlea     rdx, cs:180000000h                                             ; +0x1c, 0x180120704\nadd     rcx, rdx                                                       ; +0x23, 0x18012070b\ncmp     dword ptr [rcx], 4550h                                         ; +0x26, 0x18012070e\njnz     short loc_180120775                                            ; +0x2c, 0x180120714\nmov     eax, 20Bh                                                      ; +0x2e, 0x180120716\ncmp     [rcx+18h], ax                                                  ; +0x33, 0x18012071b\njnz     short loc_180120775                                            ; +0x37, 0x18012071f\nsub     r8, rdx                                                        ; +0x39, 0x180120721\nmovzx   eax, word ptr [rcx+14h]                                        ; +0x3c, 0x180120724\nlea     rdx, [rcx+18h]                                                 ; +0x40, 0x180120728\nadd     rdx, rax                                                       ; +0x44, 0x18012072c\nmovzx   eax, word ptr [rcx+6]                                          ; +0x47, 0x18012072f\nlea     rcx, [rax+rax*4]                                               ; +0x4b, 0x180120733\nlea     r9, [rdx+rcx*8]                                                ; +0x4f, 0x180120737\nmov     [rsp+18h+var_18], rdx                                          ; +0x53, 0x18012073b\ncmp     rdx, r9                                                        ; +0x57, 0x18012073f\njz      short loc_18012075C                                            ; +0x5a, 0x180120742\nmov     ecx, [rdx+0Ch]                                                 ; +0x5c, 0x180120744\ncmp     r8, rcx                                                        ; +0x5f, 0x180120747\njb      short loc_180120756                                            ; +0x62, 0x18012074a\nmov     eax, [rdx+8]                                                   ; +0x64, 0x18012074c\nadd     eax, ecx                                                       ; +0x67, 0x18012074f\ncmp     r8, rax                                                        ; +0x69, 0x180120751\njb      short loc_18012075E                                            ; +0x6c, 0x180120754\nadd     rdx, 28h ; '('                                                 ; +0x6e, 0x180120756\njmp     short loc_18012073B                                            ; +0x72, 0x18012075a\nxor     edx, edx                                                       ; +0x74, 0x18012075c\ntest    rdx, rdx                                                       ; +0x76, 0x18012075e\njnz     short loc_180120767                                            ; +0x79, 0x180120761\nxor     al, al                                                         ; +0x7b, 0x180120763\njmp     short loc_18012077B                                            ; +0x7d, 0x180120765\ncmp     dword ptr [rdx+24h], 0                                         ; +0x7f, 0x180120767\njge     short loc_180120771                                            ; +0x83, 0x18012076b\nxor     al, al                                                         ; +0x85, 0x18012076d\njmp     short loc_18012077B                                            ; +0x87, 0x18012076f\nmov     al, 1                                                          ; +0x89, 0x180120771\njmp     short loc_18012077B                                            ; +0x8b, 0x180120773\nxor     al, al                                                         ; +0x8d, 0x180120775\njmp     short loc_18012077B                                            ; +0x8f, 0x180120777\nxor     al, al                                                         ; +0x91, 0x180120779\nadd     rsp, 18h                                                       ; +0x93, 0x18012077b\nretn                                                                   ; +0x97, 0x18012077f", "xrefs": ["dllmain_crt_process_attach @ 0x180120ba0", "<???> @ 0x1802024ec"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}