{"type": "func", "start": 6443701872, "end": 6443702258, "name": "_seh_filter_exe", "pseudocode": "// \n// _seh_filter_exe from 0x180131670 to 0x1801317f2 (386 bytes)\n// \n// 3 xrefs:\n// > _seh_filter_dll @ 0x18013166a\n// > unknown_libname_61 @ 0x180142da1\n// > @ 0x180202ef4\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nint __cdecl seh_filter_exe(unsigned int ExceptionNum, struct _EXCEPTION_POINTERS *ExceptionPtr)\n{\n _QWORD *v4; // rax\n _QWORD *v5; // rbx\n __int64 v6; // rcx\n __int64 v7; // rax\n void (__fastcall *v8)(__int64); // r8\n __int64 v10; // rbp\n __int64 v11; // rcx\n __int64 v12; // rdx\n unsigned int v13; // edi\n __int64 v14; // rdx\n __int64 v15; // rcx\n\n v4 = (_QWORD *)_acrt_getptd_noexit();\n v5 = v4;\n if ( v4 )\n {\n v6 = *v4;\n v7 = *v4;\n while ( *(_DWORD *)v7 != ExceptionNum )\n {\n v7 += 16;\n if ( v7 == v6 + 192 )\n {\n v7 = 0;\n break;\n }\n }\n if ( v7 )\n {\n v8 = *(void (__fastcall **)(__int64))(v7 + 8);\n if ( v8 )\n {\n if ( v8 == (void (__fastcall *)(__int64))5 )\n {\n *(_QWORD *)(v7 + 8) = 0;\n return 1;\n }\n if ( v8 == (void (__fastcall *)(__int64))1 )\n return -1;\n v10 = v5[1];\n v5[1] = ExceptionPtr;\n if ( *(_DWORD *)(v7 + 4) != 8 )\n {\n v15 = *(unsigned int *)(v7 + 4);\n *(_QWORD *)(v7 + 8) = 0;\n v8(v15);\n goto LABEL_37;\n }\n v11 = v6 + 48;\n v12 = v11 + 144;\n while ( v11 != v12 )\n {\n *(_QWORD *)(v11 + 8) = 0;\n v11 += 16;\n }\n v13 = *((_DWORD *)v5 + 4);\n switch ( *(_DWORD *)v7 )\n {\n case 0xC000008D:\n v14 = 130;\n break;\n case 0xC000008E:\n v14 = 131;\n break;\n case 0xC000008F:\n v14 = 134;\n break;\n case 0xC0000090:\n v14 = 129;\n break;\n case 0xC0000091:\n v14 = 132;\n break;\n case 0xC0000092:\n v14 = 138;\n break;\n case 0xC0000093:\n v14 = 133;\n break;\n case 0xC00002B4:\n v14 = 142;\n break;\n default:\n v14 = v13;\n if ( *(_DWORD *)v7 != -1073741131 )\n {\nLABEL_35:\n ((void (__fastcall *)(__int64, __int64, void (__fastcall *)(__int64), _QWORD))v8)(8, v14, v8, 0);\n *((_DWORD *)v5 + 4) = v13;\nLABEL_37:\n v5[1] = v10;\n return -1;\n }\n v14 = 141;\n break;\n }\n *((_DWORD *)v5 + 4) = v14;\n goto LABEL_35;\n }\n }\n }\n return 0;\n}", "assembly": "; \n; _seh_filter_exe from 0x180131670 to 0x1801317f2 (386 bytes)\n; \n; 3 xrefs:\n; > _seh_filter_dll @ 0x18013166a\n; > unknown_libname_61 @ 0x180142da1\n; > @ 0x180202ef4\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov [rsp+arg_0], rbx ; +0x0, 0x180131670\nmov [rsp+arg_8], rbp ; +0x5, 0x180131675\nmov [rsp+arg_10], rsi ; +0xa, 0x18013167a\npush rdi ; +0xf, 0x18013167f\nsub rsp, 20h ; +0x10, 0x180131680\nmov rsi, rdx ; +0x14, 0x180131684\nmov edi, ecx ; +0x17, 0x180131687\ncall __acrt_getptd_noexit ; +0x19, 0x180131689\nxor r9d, r9d ; +0x1e, 0x18013168e\nmov rbx, rax ; +0x21, 0x180131691\ntest rax, rax ; +0x24, 0x180131694\njz loc_1801317DB ; +0x27, 0x180131697\nmov rcx, [rax] ; +0x2d, 0x18013169d\nmov rax, rcx ; +0x30, 0x1801316a0\nlea r8, [rcx+0C0h] ; +0x33, 0x1801316a3\ncmp rcx, r8 ; +0x3a, 0x1801316aa\njz short loc_1801316BC ; +0x3d, 0x1801316ad\ncmp [rax], edi ; +0x3f, 0x1801316af\njz short loc_1801316BF ; +0x41, 0x1801316b1\nadd rax, 10h ; +0x43, 0x1801316b3\ncmp rax, r8 ; +0x47, 0x1801316b7\njnz short loc_1801316AF ; +0x4a, 0x1801316ba\nmov rax, r9 ; +0x4c, 0x1801316bc\ntest rax, rax ; +0x4f, 0x1801316bf\njz loc_1801317DB ; +0x52, 0x1801316c2\nmov r8, [rax+8] ; +0x58, 0x1801316c8\ntest r8, r8 ; +0x5c, 0x1801316cc\njz loc_1801317DB ; +0x5f, 0x1801316cf\ncmp r8, 5 ; +0x65, 0x1801316d5\njnz short loc_1801316E8 ; +0x69, 0x1801316d9\nmov [rax+8], r9 ; +0x6b, 0x1801316db\nlea eax, [r8-4] ; +0x6f, 0x1801316df\njmp loc_1801317DD ; +0x73, 0x1801316e3\ncmp r8, 1 ; +0x78, 0x1801316e8\njnz short loc_1801316F6 ; +0x7c, 0x1801316ec\nor eax, 0FFFFFFFFh ; +0x7e, 0x1801316ee\njmp loc_1801317DD ; +0x81, 0x1801316f1\nmov rbp, [rbx+8] ; +0x86, 0x1801316f6\nmov [rbx+8], rsi ; +0x8a, 0x1801316fa\ncmp dword ptr [rax+4], 8 ; +0x8e, 0x1801316fe\njnz loc_1801317C2 ; +0x92, 0x180131702\nadd rcx, 30h ; '0' ; +0x98, 0x180131708\nlea rdx, [rcx+90h] ; +0x9c, 0x18013170c\njmp short loc_18013171D ; +0xa3, 0x180131713\nmov [rcx+8], r9 ; +0xa5, 0x180131715\nadd rcx, 10h ; +0xa9, 0x180131719\ncmp rcx, rdx ; +0xad, 0x18013171d\njnz short loc_180131715 ; +0xb0, 0x180131720\ncmp dword ptr [rax], 0C000008Dh ; +0xb2, 0x180131722\nmov edi, [rbx+10h] ; +0xb8, 0x180131728\njz short loc_1801317A7 ; +0xbb, 0x18013172b\ncmp dword ptr [rax], 0C000008Eh ; +0xbd, 0x18013172d\njz short loc_1801317A0 ; +0xc3, 0x180131733\ncmp dword ptr [rax], 0C000008Fh ; +0xc5, 0x180131735\njz short loc_180131799 ; +0xcb, 0x18013173b\ncmp dword ptr [rax], 0C0000090h ; +0xcd, 0x18013173d\njz short loc_180131792 ; +0xd3, 0x180131743\ncmp dword ptr [rax], 0C0000091h ; +0xd5, 0x180131745\njz short loc_18013178B ; +0xdb, 0x18013174b\ncmp dword ptr [rax], 0C0000092h ; +0xdd, 0x18013174d\njz short loc_180131784 ; +0xe3, 0x180131753\ncmp dword ptr [rax], 0C0000093h ; +0xe5, 0x180131755\njz short loc_18013177D ; +0xeb, 0x18013175b\ncmp dword ptr [rax], 0C00002B4h ; +0xed, 0x18013175d\njz short loc_180131776 ; +0xf3, 0x180131763\ncmp dword ptr [rax], 0C00002B5h ; +0xf5, 0x180131765\nmov edx, edi ; +0xfb, 0x18013176b\njnz short loc_1801317AF ; +0xfd, 0x18013176d\nmov edx, 8Dh ; +0xff, 0x18013176f\njmp short loc_1801317AC ; +0x104, 0x180131774\nmov edx, 8Eh ; +0x106, 0x180131776\njmp short loc_1801317AC ; +0x10b, 0x18013177b\nmov edx, 85h ; +0x10d, 0x18013177d\njmp short loc_1801317AC ; +0x112, 0x180131782\nmov edx, 8Ah ; +0x114, 0x180131784\njmp short loc_1801317AC ; +0x119, 0x180131789\nmov edx, 84h ; +0x11b, 0x18013178b\njmp short loc_1801317AC ; +0x120, 0x180131790\nmov edx, 81h ; +0x122, 0x180131792\njmp short loc_1801317AC ; +0x127, 0x180131797\nmov edx, 86h ; +0x129, 0x180131799\njmp short loc_1801317AC ; +0x12e, 0x18013179e\nmov edx, 83h ; +0x130, 0x1801317a0\njmp short loc_1801317AC ; +0x135, 0x1801317a5\nmov edx, 82h ; +0x137, 0x1801317a7\nmov [rbx+10h], edx ; +0x13c, 0x1801317ac\nmov ecx, 8 ; +0x13f, 0x1801317af\nmov rax, r8 ; +0x144, 0x1801317b4\ncall cs:__guard_dispatch_icall_fptr ; +0x147, 0x1801317b7\nmov [rbx+10h], edi ; +0x14d, 0x1801317bd\njmp short loc_1801317D2 ; +0x150, 0x1801317c0\nmov ecx, [rax+4] ; +0x152, 0x1801317c2\nmov [rax+8], r9 ; +0x155, 0x1801317c5\nmov rax, r8 ; +0x159, 0x1801317c9\ncall cs:__guard_dispatch_icall_fptr ; +0x15c, 0x1801317cc\nmov [rbx+8], rbp ; +0x162, 0x1801317d2\njmp loc_1801316EE ; +0x166, 0x1801317d6\nxor eax, eax ; +0x16b, 0x1801317db\nmov rbx, [rsp+28h+arg_0] ; +0x16d, 0x1801317dd\nmov rbp, [rsp+28h+arg_8] ; +0x172, 0x1801317e2\nmov rsi, [rsp+28h+arg_10] ; +0x177, 0x1801317e7\nadd rsp, 20h ; +0x17c, 0x1801317ec\npop rdi ; +0x180, 0x1801317f0\nretn ; +0x181, 0x1801317f1", "xrefs": ["_seh_filter_dll @ 0x18013166a", "unknown_libname_61 @ 0x180142da1", " @ 0x180202ef4"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}