{"type": "func", "start": 6443743112, "end": 6443743164, "name": "_query_new_handler", "pseudocode": "// \n// _query_new_handler from 0x18013b788 to 0x18013b7bc (52 bytes)\n// \n// 2 xrefs:\n// > _callnewh @ 0x18013b761\n// > <???> @ 0x180203938\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\n_PNH __cdecl query_new_handler()\n{\n  int (__cdecl *v0)(size_t); // rbx\n\n  sub_1801346AC(0);\n  v0 = (int (__cdecl *)(size_t))__ROR8__(qword_1801F5618 ^ _security_cookie, _security_cookie & 0x3F);\n  sub_180134700(0);\n  return v0;\n}", "assembly": "; \n; _query_new_handler from 0x18013b788 to 0x18013b7bc (52 bytes)\n; \n; 2 xrefs:\n; > _callnewh @ 0x18013b761\n; > <???> @ 0x180203938\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\npush    rbx                                                            ; +0x0, 0x18013b788\nsub     rsp, 20h                                                       ; +0x2, 0x18013b78a\nxor     ecx, ecx                                                       ; +0x6, 0x18013b78e\ncall    sub_1801346AC                                                  ; +0x8, 0x18013b790\nnop                                                                    ; +0xd, 0x18013b795\nmov     rbx, cs:__security_cookie                                      ; +0xe, 0x18013b796\nmov     ecx, ebx                                                       ; +0x15, 0x18013b79d\nand     ecx, 3Fh                                                       ; +0x17, 0x18013b79f\nxor     rbx, cs:qword_1801F5618                                        ; +0x1a, 0x18013b7a2\nror     rbx, cl                                                        ; +0x21, 0x18013b7a9\nxor     ecx, ecx                                                       ; +0x24, 0x18013b7ac\ncall    sub_180134700                                                  ; +0x26, 0x18013b7ae\nmov     rax, rbx                                                       ; +0x2b, 0x18013b7b3\nadd     rsp, 20h                                                       ; +0x2e, 0x18013b7b6\npop     rbx                                                            ; +0x32, 0x18013b7ba\nretn                                                                   ; +0x33, 0x18013b7bb", "xrefs": ["_callnewh @ 0x18013b761", "<???> @ 0x180203938"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}