{"type": "func", "start": 6443646164, "end": 6443646336, "name": "__security_init_cookie", "pseudocode": "// \n// __security_init_cookie from 0x180123cd4 to 0x180123d80 (172 bytes)\n// \n// 2 xrefs:\n// > DllEntryPoint @ 0x180120dc8\n// > <???> @ 0x1802025f4\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nvoid __cdecl _security_init_cookie()\n{\n  uintptr_t v0; // rax\n  struct _FILETIME v1; // [rsp+30h] [rbp+10h] BYREF\n  struct _FILETIME SystemTimeAsFileTime; // [rsp+38h] [rbp+18h] BYREF\n  LARGE_INTEGER PerformanceCount; // [rsp+40h] [rbp+20h] BYREF\n\n  v0 = _security_cookie;\n  if ( _security_cookie == 0x2B992DDFA232LL )\n  {\n    SystemTimeAsFileTime = 0;\n    GetSystemTimeAsFileTime(&SystemTimeAsFileTime);\n    v1 = SystemTimeAsFileTime;\n    v1 = (struct _FILETIME)(GetCurrentThreadId() ^ *(unsigned __int64 *)&v1);\n    v1 = (struct _FILETIME)(GetCurrentProcessId() ^ *(unsigned __int64 *)&v1);\n    QueryPerformanceCounter(&PerformanceCount);\n    v0 = ((unsigned __int64)&v1\n        ^ *(_QWORD *)&v1\n        ^ PerformanceCount.QuadPart\n        ^ ((unsigned __int64)PerformanceCount.LowPart << 32))\n       & 0xFFFFFFFFFFFFLL;\n    if ( v0 == 0x2B992DDFA232LL )\n      v0 = 0x2B992DDFA233LL;\n    _security_cookie = v0;\n  }\n  qword_1801B16E0 = ~v0;\n}", "assembly": "; \n; __security_init_cookie from 0x180123cd4 to 0x180123d80 (172 bytes)\n; \n; 2 xrefs:\n; > DllEntryPoint @ 0x180120dc8\n; > <???> @ 0x1802025f4\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov     [rsp-8+arg_18], rbx                                            ; +0x0, 0x180123cd4\npush    rbp                                                            ; +0x5, 0x180123cd9\nmov     rbp, rsp                                                       ; +0x6, 0x180123cda\nsub     rsp, 20h                                                       ; +0x9, 0x180123cdd\nmov     rax, cs:__security_cookie                                      ; +0xd, 0x180123ce1\nmov     rbx, 2B992DDFA232h                                             ; +0x14, 0x180123ce8\ncmp     rax, rbx                                                       ; +0x1e, 0x180123cf2\njnz     short loc_180123D6B                                            ; +0x21, 0x180123cf5\nand     qword ptr [rbp+SystemTimeAsFileTime.dwLowDateTime], 0          ; +0x23, 0x180123cf7\nlea     rcx, [rbp+SystemTimeAsFileTime]; lpSystemTimeAsFileTime        ; +0x28, 0x180123cfc\ncall    cs:GetSystemTimeAsFileTime                                     ; +0x2c, 0x180123d00\nmov     rax, qword ptr [rbp+SystemTimeAsFileTime.dwLowDateTime]        ; +0x32, 0x180123d06\nmov     [rbp+arg_0], rax                                               ; +0x36, 0x180123d0a\ncall    cs:GetCurrentThreadId                                          ; +0x3a, 0x180123d0e\nmov     eax, eax                                                       ; +0x40, 0x180123d14\nxor     [rbp+arg_0], rax                                               ; +0x42, 0x180123d16\ncall    cs:GetCurrentProcessId                                         ; +0x46, 0x180123d1a\nmov     eax, eax                                                       ; +0x4c, 0x180123d20\nlea     rcx, [rbp+PerformanceCount]; lpPerformanceCount                ; +0x4e, 0x180123d22\nxor     [rbp+arg_0], rax                                               ; +0x52, 0x180123d26\ncall    cs:QueryPerformanceCounter                                     ; +0x56, 0x180123d2a\nmov     eax, dword ptr [rbp+PerformanceCount]                          ; +0x5c, 0x180123d30\nlea     rcx, [rbp+arg_0]                                               ; +0x5f, 0x180123d33\nshl     rax, 20h                                                       ; +0x63, 0x180123d37\nxor     rax, qword ptr [rbp+PerformanceCount]                          ; +0x67, 0x180123d3b\nxor     rax, [rbp+arg_0]                                               ; +0x6b, 0x180123d3f\nxor     rax, rcx                                                       ; +0x6f, 0x180123d43\nmov     rcx, 0FFFFFFFFFFFFh                                            ; +0x72, 0x180123d46\nand     rax, rcx                                                       ; +0x7c, 0x180123d50\nmov     rcx, 2B992DDFA233h                                             ; +0x7f, 0x180123d53\ncmp     rax, rbx                                                       ; +0x89, 0x180123d5d\ncmovz   rax, rcx                                                       ; +0x8c, 0x180123d60\nmov     cs:__security_cookie, rax                                      ; +0x90, 0x180123d64\nmov     rbx, [rsp+20h+arg_18]                                          ; +0x97, 0x180123d6b\nnot     rax                                                            ; +0x9c, 0x180123d70\nmov     cs:qword_1801B16E0, rax                                        ; +0x9f, 0x180123d73\nadd     rsp, 20h                                                       ; +0xa6, 0x180123d7a\npop     rbp                                                            ; +0xaa, 0x180123d7e\nretn                                                                   ; +0xab, 0x180123d7f", "xrefs": ["DllEntryPoint @ 0x180120dc8", "<???> @ 0x1802025f4"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}