{"type": "func", "start": 6443702524, "end": 6443702711, "name": "common_exit", "pseudocode": "// \n// common_exit from 0x1801318fc to 0x1801319b7 (187 bytes)\n// \n// 3 xrefs:\n// > _cexit @ 0x180131a70\n// > _exit @ 0x180131a7f\n// > <???> @ 0x180202f18\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nvoid __fastcall common_exit(unsigned int a1, enum _crt_exit_cleanup_mode a2, enum _crt_exit_return_mode a3)\n{\n  HMODULE ModuleHandleW; // rax\n  char *v5; // rcx\n  _BYTE v6[4]; // [rsp+20h] [rbp-30h] BYREF\n  unsigned int v7; // [rsp+24h] [rbp-2Ch] BYREF\n  unsigned int v8; // [rsp+28h] [rbp-28h] BYREF\n  _QWORD v9[4]; // [rsp+30h] [rbp-20h] BYREF\n  enum _crt_exit_cleanup_mode v10; // [rsp+68h] [rbp+18h] BYREF\n  enum _crt_exit_return_mode v11; // [rsp+70h] [rbp+20h] BYREF\n  char v12; // [rsp+78h] [rbp+28h] BYREF\n\n  v11 = a3;\n  v10 = a2;\n  if ( a3 == _crt_exit_terminate_process )\n  {\n    ModuleHandleW = GetModuleHandleW(nullptr);\n    if ( ModuleHandleW )\n    {\n      if ( *(_WORD *)ModuleHandleW == 23117 )\n      {\n        v5 = (char *)ModuleHandleW + *((int *)ModuleHandleW + 15);\n        if ( *(_DWORD *)v5 == 17744 && *((_WORD *)v5 + 12) == 523 && *((_DWORD *)v5 + 33) > 0xEu && *((_DWORD *)v5 + 62) )\n          try_cor_exit_process(a1);\n      }\n    }\n  }\n  v12 = 0;\n  v9[0] = &v10;\n  v9[1] = &v11;\n  v9[2] = &v12;\n  v7 = 2;\n  v8 = 2;\n  __crt_seh_guarded_call<void>::operator()<_lambda_99476a1ad63dd22509b5d3e65b0ffc95_,_lambda_ad1ced32f4ac17aa236e5ef05d6b3b7c_ &,_lambda_f7424dd8d45958661754dc4f2697e9c3_>(\n    (__int64)v6,\n    &v8,\n    (__int64)v9,\n    &v7);\n  if ( v11 == _crt_exit_terminate_process )\n    exit_or_terminate_process(a1);\n}", "assembly": "; \n; common_exit from 0x1801318fc to 0x1801319b7 (187 bytes)\n; \n; 3 xrefs:\n; > _cexit @ 0x180131a70\n; > _exit @ 0x180131a7f\n; > <???> @ 0x180202f18\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov     [rsp-8+arg_0], rbx                                             ; +0x0, 0x1801318fc\nmov     [rsp-8+arg_10], r8d                                            ; +0x5, 0x180131901\nmov     [rsp-8+arg_8], edx                                             ; +0xa, 0x180131906\npush    rbp                                                            ; +0xe, 0x18013190a\nmov     rbp, rsp                                                       ; +0xf, 0x18013190b\nsub     rsp, 50h                                                       ; +0x12, 0x18013190e\nmov     ebx, ecx                                                       ; +0x16, 0x180131912\ntest    r8d, r8d                                                       ; +0x18, 0x180131914\njnz     short loc_180131963                                            ; +0x1b, 0x180131917\nxor     ecx, ecx; lpModuleName                                         ; +0x1d, 0x180131919\ncall    cs:GetModuleHandleW                                            ; +0x1f, 0x18013191b\ntest    rax, rax                                                       ; +0x25, 0x180131921\njz      short loc_180131963                                            ; +0x28, 0x180131924\nmov     ecx, 5A4Dh                                                     ; +0x2a, 0x180131926\ncmp     [rax], cx                                                      ; +0x2f, 0x18013192b\njnz     short loc_180131963                                            ; +0x32, 0x18013192e\nmovsxd  rcx, dword ptr [rax+3Ch]                                       ; +0x34, 0x180131930\nadd     rcx, rax                                                       ; +0x38, 0x180131934\ncmp     dword ptr [rcx], 4550h                                         ; +0x3b, 0x180131937\njnz     short loc_180131963                                            ; +0x41, 0x18013193d\nmov     eax, 20Bh                                                      ; +0x43, 0x18013193f\ncmp     [rcx+18h], ax                                                  ; +0x48, 0x180131944\njnz     short loc_180131963                                            ; +0x4c, 0x180131948\ncmp     dword ptr [rcx+84h], 0Eh                                       ; +0x4e, 0x18013194a\njbe     short loc_180131963                                            ; +0x55, 0x180131951\ncmp     dword ptr [rcx+0F8h], 0                                        ; +0x57, 0x180131953\njz      short loc_180131963                                            ; +0x5e, 0x18013195a\nmov     ecx, ebx; unsigned int                                         ; +0x60, 0x18013195c\ncall    ?try_cor_exit_process@@YAXI@Z                                  ; +0x62, 0x18013195e\nlea     rax, [rbp+arg_8]                                               ; +0x67, 0x180131963\nmov     [rbp+arg_18], 0                                                ; +0x6b, 0x180131967\nmov     [rbp+var_20], rax                                              ; +0x6f, 0x18013196b\nlea     r9, [rbp+var_2C]                                               ; +0x73, 0x18013196f\nlea     rax, [rbp+arg_10]                                              ; +0x77, 0x180131973\nmov     [rbp+var_18], rax                                              ; +0x7b, 0x180131977\nlea     r8, [rbp+var_20]                                               ; +0x7f, 0x18013197b\nlea     rax, [rbp+arg_18]                                              ; +0x83, 0x18013197f\nmov     [rbp+var_10], rax                                              ; +0x87, 0x180131983\nlea     rdx, [rbp+var_28]                                              ; +0x8b, 0x180131987\nmov     eax, 2                                                         ; +0x8f, 0x18013198b\nlea     rcx, [rbp+var_30]                                              ; +0x94, 0x180131990\nmov     [rbp+var_2C], eax                                              ; +0x98, 0x180131994\nmov     [rbp+var_28], eax                                              ; +0x9b, 0x180131997\ncall    ??$?RV_lambda_99476a1ad63dd22509b5d3e65b0ffc95_@@AEAV_lambda_ad1ced32f4ac17aa236e5ef05d6b3b7c_@@V_lambda_f7424dd8d45958661754dc4f2697e9c3_@@@?$__crt_seh_guarded_call@X@@QEAAX$$QEAV_lambda_99476a1ad63dd22509b5d3e65b0ffc95_@@AEAV_lambda_ad1ced32f4ac17aa236e5ef05d6b3b7c_@@$$QEAV_lambda_f7424dd8d45958661754dc4f2697e9c3_@@@Z ; +0x9e, 0x18013199a\ncmp     [rbp+arg_10], 0                                                ; +0xa3, 0x18013199f\njz      short loc_1801319B0                                            ; +0xa7, 0x1801319a3\nmov     rbx, [rsp+50h+arg_0]                                           ; +0xa9, 0x1801319a5\nadd     rsp, 50h                                                       ; +0xae, 0x1801319aa\npop     rbp                                                            ; +0xb2, 0x1801319ae\nretn                                                                   ; +0xb3, 0x1801319af\nmov     ecx, ebx; unsigned int                                         ; +0xb4, 0x1801319b0\ncall    ?exit_or_terminate_process@@YAXI@Z                             ; +0xb6, 0x1801319b2", "xrefs": ["_cexit @ 0x180131a70", "_exit @ 0x180131a7f", "<???> @ 0x180202f18"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}