{"type": "func", "start": 6443631160, "end": 6443631273, "name": "capture_previous_context", "pseudocode": "// \n// capture_previous_context from 0x180120238 to 0x1801202a9 (113 bytes)\n// \n// 2 xrefs:\n// > __report_gsfailure @ 0x18012006a\n// > <???> @ 0x18020245c\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nstruct _IMAGE_RUNTIME_FUNCTION_ENTRY *__fastcall capture_previous_context(PCONTEXT ContextRecord)\n{\n  ULONG64 Rip; // rsi\n  int i; // edi\n  struct _IMAGE_RUNTIME_FUNCTION_ENTRY *result; // rax\n  unsigned __int64 ImageBase; // [rsp+60h] [rbp+8h] BYREF\n  unsigned __int64 EstablisherFrame; // [rsp+68h] [rbp+10h] BYREF\n  PVOID HandlerData; // [rsp+70h] [rbp+18h] BYREF\n\n  RtlCaptureContext(ContextRecord);\n  Rip = ContextRecord->Rip;\n  for ( i = 0; i < 2; ++i )\n  {\n    result = RtlLookupFunctionEntry(Rip, &ImageBase, nullptr);\n    if ( !result )\n      break;\n    result = (struct _IMAGE_RUNTIME_FUNCTION_ENTRY *)RtlVirtualUnwind(\n                                                       0,\n                                                       ImageBase,\n                                                       Rip,\n                                                       result,\n                                                       ContextRecord,\n                                                       &HandlerData,\n                                                       &EstablisherFrame,\n                                                       nullptr);\n  }\n  return result;\n}", "assembly": "; \n; capture_previous_context from 0x180120238 to 0x1801202a9 (113 bytes)\n; \n; 2 xrefs:\n; > __report_gsfailure @ 0x18012006a\n; > <???> @ 0x18020245c\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\npush    rbx                                                            ; +0x0, 0x180120238\npush    rsi                                                            ; +0x2, 0x18012023a\npush    rdi                                                            ; +0x3, 0x18012023b\nsub     rsp, 40h                                                       ; +0x4, 0x18012023c\nmov     rbx, rcx                                                       ; +0x8, 0x180120240\ncall    cs:RtlCaptureContext                                           ; +0xb, 0x180120243\nmov     rsi, [rbx+0F8h]                                                ; +0x11, 0x180120249\nxor     edi, edi                                                       ; +0x18, 0x180120250\nxor     r8d, r8d; HistoryTable                                         ; +0x1a, 0x180120252\nlea     rdx, [rsp+58h+ImageBase]; ImageBase                            ; +0x1d, 0x180120255\nmov     rcx, rsi; ControlPc                                            ; +0x22, 0x18012025a\ncall    cs:RtlLookupFunctionEntry                                      ; +0x25, 0x18012025d\ntest    rax, rax                                                       ; +0x2b, 0x180120263\njz      short loc_1801202A1                                            ; +0x2e, 0x180120266\nand     [rsp+58h+var_20], 0                                            ; +0x30, 0x180120268\nlea     rcx, [rsp+58h+arg_8]                                           ; +0x36, 0x18012026e\nmov     rdx, [rsp+58h+ImageBase]; ImageBase                            ; +0x3b, 0x180120273\nmov     r9, rax; FunctionEntry                                         ; +0x40, 0x180120278\nmov     [rsp+58h+EstablisherFrame], rcx; EstablisherFrame              ; +0x43, 0x18012027b\nmov     r8, rsi; ControlPc                                             ; +0x48, 0x180120280\nlea     rcx, [rsp+58h+arg_10]                                          ; +0x4b, 0x180120283\nmov     [rsp+58h+HandlerData], rcx; HandlerData                        ; +0x50, 0x180120288\nxor     ecx, ecx; HandlerType                                          ; +0x55, 0x18012028d\nmov     [rsp+58h+ContextRecord], rbx; ContextRecord                    ; +0x57, 0x18012028f\ncall    cs:RtlVirtualUnwind                                            ; +0x5c, 0x180120294\ninc     edi                                                            ; +0x62, 0x18012029a\ncmp     edi, 2                                                         ; +0x64, 0x18012029c\njl      short loc_180120252                                            ; +0x67, 0x18012029f\nadd     rsp, 40h                                                       ; +0x69, 0x1801202a1\npop     rdi                                                            ; +0x6d, 0x1801202a5\npop     rsi                                                            ; +0x6e, 0x1801202a6\npop     rbx                                                            ; +0x6f, 0x1801202a7\nretn                                                                   ; +0x70, 0x1801202a8", "xrefs": ["__report_gsfailure @ 0x18012006a", "<???> @ 0x18020245c"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}