{"type": "func", "start": 6443633372, "end": 6443633650, "name": "dllmain_crt_process_attach", "pseudocode": "// \n// dllmain_crt_process_attach from 0x180120adc to 0x180120bf2 (278 bytes)\n// \n// 3 xrefs:\n// > dllmain_crt_dispatch @ 0x180120ac8\n// > @ 0x180202570\n// > @ 0x18020257c\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\n__int64 __fastcall dllmain_crt_process_attach(HINSTANCE a1, void *const a2)\n{\n char v2; // bl\n char v3; // di\n _QWORD *v4; // rax\n\n if ( !_scrt_initialize_crt(0) )\n return 0;\n v2 = _scrt_acquire_startup_lock();\n v3 = 1;\n if ( dword_1801F4998 )\n {\n _scrt_fastfail(7);\n __debugbreak();\n JUMPOUT(0x180120BF2LL);\n }\n dword_1801F4998 = 1;\n if ( _scrt_dllmain_before_initialize_c() )\n {\n sub_180123DD0();\n sub_180123D88();\n _scrt_initialize_default_local_stdio_options();\n if ( !initterm_e((_PIFV *)&qword_180144510, (_PIFV *)&qword_180144540) )\n {\n if ( _scrt_dllmain_after_initialize_c() )\n {\n initterm((_PVFV *)&First, (_PVFV *)&Last);\n dword_1801F4998 = 2;\n v3 = 0;\n }\n }\n }\n _scrt_release_startup_lock(v2);\n if ( v3 )\n return 0;\n v4 = (_QWORD *)sub_180123DC8();\n if ( *v4 )\n {\n if ( _scrt_is_nonwritable_in_current_image((__int64)v4) )\n _guard_dispatch_icall_fptr();\n }\n ++dword_1801F4A2C;\n return 1;\n}", "assembly": "; \n; dllmain_crt_process_attach from 0x180120adc to 0x180120bf2 (278 bytes)\n; \n; 3 xrefs:\n; > dllmain_crt_dispatch @ 0x180120ac8\n; > @ 0x180202570\n; > @ 0x18020257c\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov [rsp+arg_0], rbx ; +0x0, 0x180120adc\nmov [rsp+arg_8], rsi ; +0x5, 0x180120ae1\nmov [rsp+arg_18], rdi ; +0xa, 0x180120ae6\npush r14 ; +0xf, 0x180120aeb\nsub rsp, 20h ; +0x11, 0x180120aed\nmov rsi, rdx ; +0x15, 0x180120af1\nmov r14, rcx ; +0x18, 0x180120af4\nxor ecx, ecx ; +0x1b, 0x180120af7\ncall __scrt_initialize_crt ; +0x1d, 0x180120af9\ntest al, al ; +0x22, 0x180120afe\njz loc_180120BCE ; +0x24, 0x180120b00\ncall __scrt_acquire_startup_lock ; +0x2a, 0x180120b06\nmov bl, al ; +0x2f, 0x180120b0b\nmov [rsp+28h+arg_10], al ; +0x31, 0x180120b0d\nmov dil, 1 ; +0x35, 0x180120b11\ncmp cs:dword_1801F4998, 0 ; +0x38, 0x180120b14\njnz loc_180120BE6 ; +0x3f, 0x180120b1b\nmov cs:dword_1801F4998, 1 ; +0x45, 0x180120b21\ncall __scrt_dllmain_before_initialize_c ; +0x4f, 0x180120b2b\ntest al, al ; +0x54, 0x180120b30\njz short loc_180120B83 ; +0x56, 0x180120b32\ncall sub_180123DD0 ; +0x58, 0x180120b34\ncall sub_180123D88 ; +0x5d, 0x180120b39\ncall __scrt_initialize_default_local_stdio_options ; +0x62, 0x180120b3e\nlea rdx, qword_180144540; Last ; +0x67, 0x180120b43\nlea rcx, qword_180144510; First ; +0x6e, 0x180120b4a\ncall _initterm_e ; +0x75, 0x180120b51\ntest eax, eax ; +0x7a, 0x180120b56\njnz short loc_180120B83 ; +0x7c, 0x180120b58\ncall __scrt_dllmain_after_initialize_c ; +0x7e, 0x180120b5a\ntest al, al ; +0x83, 0x180120b5f\njz short loc_180120B83 ; +0x85, 0x180120b61\nlea rdx, Last; Last ; +0x87, 0x180120b63\nlea rcx, First; First ; +0x8e, 0x180120b6a\ncall _initterm ; +0x95, 0x180120b71\nmov cs:dword_1801F4998, 2 ; +0x9a, 0x180120b76\nxor dil, dil ; +0xa4, 0x180120b80\nmov cl, bl ; +0xa7, 0x180120b83\ncall __scrt_release_startup_lock ; +0xa9, 0x180120b85\ntest dil, dil ; +0xae, 0x180120b8a\njnz short loc_180120BCE ; +0xb1, 0x180120b8d\ncall sub_180123DC8 ; +0xb3, 0x180120b8f\nmov rbx, rax ; +0xb8, 0x180120b94\ncmp qword ptr [rax], 0 ; +0xbb, 0x180120b97\njz short loc_180120BC1 ; +0xbf, 0x180120b9b\nmov rcx, rax ; +0xc1, 0x180120b9d\ncall __scrt_is_nonwritable_in_current_image ; +0xc4, 0x180120ba0\ntest al, al ; +0xc9, 0x180120ba5\njz short loc_180120BC1 ; +0xcb, 0x180120ba7\nmov r8, rsi ; +0xcd, 0x180120ba9\nmov edx, 2 ; +0xd0, 0x180120bac\nmov rcx, r14 ; +0xd5, 0x180120bb1\nmov rax, [rbx] ; +0xd8, 0x180120bb4\nmov r9, cs:__guard_dispatch_icall_fptr ; +0xdb, 0x180120bb7\ncall r9 ; _guard_dispatch_icall_nop ; +0xe2, 0x180120bbe\ninc cs:dword_1801F4A2C ; +0xe5, 0x180120bc1\nmov eax, 1 ; +0xeb, 0x180120bc7\njmp short loc_180120BD0 ; +0xf0, 0x180120bcc\nxor eax, eax ; +0xf2, 0x180120bce\nmov rbx, [rsp+28h+arg_0] ; +0xf4, 0x180120bd0\nmov rsi, [rsp+28h+arg_8] ; +0xf9, 0x180120bd5\nmov rdi, [rsp+28h+arg_18] ; +0xfe, 0x180120bda\nadd rsp, 20h ; +0x103, 0x180120bdf\npop r14 ; +0x107, 0x180120be3\nretn ; +0x109, 0x180120be5\nmov ecx, 7 ; +0x10a, 0x180120be6\ncall __scrt_fastfail ; +0x10f, 0x180120beb\nnop ; +0x114, 0x180120bf0\nint 3; Trap to Debugger ; +0x115, 0x180120bf1", "xrefs": ["dllmain_crt_dispatch @ 0x180120ac8", " @ 0x180202570", " @ 0x18020257c"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}