// // __scrt_fastfail from 0x18001ff30 to 0x180020078 (328 bytes) // // 4 xrefs: // > __scrt_initialize_onexit_tables @ 0x18001f5bd // > dllmain_crt_process_attach @ 0x18001f9a7 // > dllmain_crt_process_detach @ 0x18001fa28 // > @ 0x18004b2bc // // This function is hookable on this platform! // // Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA // Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings // void __fastcall _scrt_fastfail(unsigned int a1) { ULONG64 Rip; // rbx struct _IMAGE_RUNTIME_FUNCTION_ENTRY *v3; // rax BOOL v4; // ebx struct _EXCEPTION_POINTERS ExceptionInfo; // [rsp+40h] [rbp-C0h] BYREF _QWORD v6[20]; // [rsp+50h] [rbp-B0h] BYREF struct _CONTEXT ContextRecord; // [rsp+F0h] [rbp-10h] BYREF DWORD64 retaddr; // [rsp+5C8h] [rbp+4C8h] __int64 v9; // [rsp+5D0h] [rbp+4D0h] BYREF unsigned __int64 ImageBase; // [rsp+5D8h] [rbp+4D8h] BYREF unsigned __int64 EstablisherFrame; // [rsp+5E0h] [rbp+4E0h] BYREF PVOID HandlerData; // [rsp+5E8h] [rbp+4E8h] BYREF if ( IsProcessorFeaturePresent(0x17u) ) __fastfail(a1); sub_18001FF28(); memset(&ContextRecord, 0, sizeof(ContextRecord)); RtlCaptureContext(&ContextRecord); Rip = ContextRecord.Rip; v3 = RtlLookupFunctionEntry(ContextRecord.Rip, &ImageBase, nullptr); if ( v3 ) RtlVirtualUnwind(0, ImageBase, Rip, v3, &ContextRecord, &HandlerData, &EstablisherFrame, nullptr); ContextRecord.Rip = retaddr; ContextRecord.Rsp = (DWORD64)&v9; memset(v6, 0, 0x98u); v6[2] = retaddr; v6[0] = 0x140000015LL; v4 = IsDebuggerPresent(); ExceptionInfo.ExceptionRecord = (PEXCEPTION_RECORD)v6; ExceptionInfo.ContextRecord = &ContextRecord; SetUnhandledExceptionFilter(nullptr); if ( !UnhandledExceptionFilter(&ExceptionInfo) && !v4 ) sub_18001FF28(); }