{"type": "func", "start": 6443631048, "end": 6443631157, "name": "capture_current_context", "pseudocode": "// \n// capture_current_context from 0x1801201c8 to 0x180120235 (109 bytes)\n// \n// 3 xrefs:\n// > __report_securityfailure @ 0x180120152\n// > <???> @ 0x180202444\n// > <???> @ 0x180202450\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nstruct _IMAGE_RUNTIME_FUNCTION_ENTRY *__fastcall capture_current_context(PCONTEXT ContextRecord)\n{\n  ULONG64 Rip; // rdi\n  struct _IMAGE_RUNTIME_FUNCTION_ENTRY *result; // rax\n  unsigned __int64 ImageBase; // [rsp+50h] [rbp+8h] BYREF\n  unsigned __int64 EstablisherFrame; // [rsp+58h] [rbp+10h] BYREF\n  PVOID HandlerData; // [rsp+60h] [rbp+18h] BYREF\n\n  RtlCaptureContext(ContextRecord);\n  Rip = ContextRecord->Rip;\n  result = RtlLookupFunctionEntry(Rip, &ImageBase, nullptr);\n  if ( result )\n    return (struct _IMAGE_RUNTIME_FUNCTION_ENTRY *)RtlVirtualUnwind(\n                                                     0,\n                                                     ImageBase,\n                                                     Rip,\n                                                     result,\n                                                     ContextRecord,\n                                                     &HandlerData,\n                                                     &EstablisherFrame,\n                                                     nullptr);\n  return result;\n}", "assembly": "; \n; capture_current_context from 0x1801201c8 to 0x180120235 (109 bytes)\n; \n; 3 xrefs:\n; > __report_securityfailure @ 0x180120152\n; > <???> @ 0x180202444\n; > <???> @ 0x180202450\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov     [rsp+arg_18], rbx                                              ; +0x0, 0x1801201c8\npush    rdi                                                            ; +0x5, 0x1801201cd\nsub     rsp, 40h                                                       ; +0x6, 0x1801201ce\nmov     rbx, rcx                                                       ; +0xa, 0x1801201d2\ncall    cs:RtlCaptureContext                                           ; +0xd, 0x1801201d5\nmov     rdi, [rbx+0F8h]                                                ; +0x13, 0x1801201db\nlea     rdx, [rsp+48h+ImageBase]; ImageBase                            ; +0x1a, 0x1801201e2\nmov     rcx, rdi; ControlPc                                            ; +0x1f, 0x1801201e7\nxor     r8d, r8d; HistoryTable                                         ; +0x22, 0x1801201ea\ncall    cs:RtlLookupFunctionEntry                                      ; +0x25, 0x1801201ed\ntest    rax, rax                                                       ; +0x2b, 0x1801201f3\njz      short loc_18012022A                                            ; +0x2e, 0x1801201f6\nand     [rsp+48h+var_10], 0                                            ; +0x30, 0x1801201f8\nlea     rcx, [rsp+48h+arg_8]                                           ; +0x36, 0x1801201fe\nmov     rdx, [rsp+48h+ImageBase]; ImageBase                            ; +0x3b, 0x180120203\nmov     r9, rax; FunctionEntry                                         ; +0x40, 0x180120208\nmov     [rsp+48h+EstablisherFrame], rcx; EstablisherFrame              ; +0x43, 0x18012020b\nmov     r8, rdi; ControlPc                                             ; +0x48, 0x180120210\nlea     rcx, [rsp+48h+arg_10]                                          ; +0x4b, 0x180120213\nmov     [rsp+48h+HandlerData], rcx; HandlerData                        ; +0x50, 0x180120218\nxor     ecx, ecx; HandlerType                                          ; +0x55, 0x18012021d\nmov     [rsp+48h+ContextRecord], rbx; ContextRecord                    ; +0x57, 0x18012021f\ncall    cs:RtlVirtualUnwind                                            ; +0x5c, 0x180120224\nmov     rbx, [rsp+48h+arg_18]                                          ; +0x62, 0x18012022a\nadd     rsp, 40h                                                       ; +0x67, 0x18012022f\npop     rdi                                                            ; +0x6b, 0x180120233\nretn                                                                   ; +0x6c, 0x180120234", "xrefs": ["__report_securityfailure @ 0x180120152", "<???> @ 0x180202444", "<???> @ 0x180202450"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}