{"type": "func", "start": 6442579396, "end": 6442579548, "name": "__scrt_is_nonwritable_in_current_image", "pseudocode": "// \n// __scrt_is_nonwritable_in_current_image from 0x18001f5c4 to 0x18001f65c (152 bytes)\n// \n// 2 xrefs:\n// > dllmain_crt_process_attach @ 0x18001f95c\n// > <???> @ 0x18004b1f0\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nbool __fastcall _scrt_is_nonwritable_in_current_image(__int64 a1)\n{\n  _DWORD *v2; // rcx\n  unsigned __int64 v3; // r8\n  _DWORD *v4; // rdx\n  _DWORD *v5; // r9\n  unsigned __int64 v6; // rcx\n\n  if ( MEMORY[0x180000000] != 23117 )\n    return 0;\n  v2 = (_DWORD *)(0x180000000LL + MEMORY[0x18000003C]);\n  if ( *v2 != 17744 || *(_WORD *)(0x180000018LL + MEMORY[0x18000003C]) != 523 )\n    return 0;\n  v3 = a1 - 0x180000000LL;\n  v4 = (_DWORD *)((char *)v2 + *(unsigned __int16 *)(0x180000014LL + MEMORY[0x18000003C]) + 24);\n  v5 = &v4[10 * *(unsigned __int16 *)(0x180000006LL + MEMORY[0x18000003C])];\n  while ( v4 != v5 )\n  {\n    v6 = (unsigned int)v4[3];\n    if ( v3 >= v6 && v3 < (unsigned int)(v6 + v4[2]) )\n      return v4 && v4[9] >= 0;\n    v4 += 10;\n  }\n  v4 = nullptr;\n  return v4 && v4[9] >= 0;\n}", "assembly": "; \n; __scrt_is_nonwritable_in_current_image from 0x18001f5c4 to 0x18001f65c (152 bytes)\n; \n; 2 xrefs:\n; > dllmain_crt_process_attach @ 0x18001f95c\n; > <???> @ 0x18004b1f0\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nsub     rsp, 18h                                                       ; +0x0, 0x18001f5c4\nmov     r8, rcx                                                        ; +0x4, 0x18001f5c8\nmov     eax, 5A4Dh                                                     ; +0x7, 0x18001f5cb\ncmp     cs:180000000h, ax                                              ; +0xc, 0x18001f5d0\njnz     short loc_18001F651                                            ; +0x13, 0x18001f5d7\nmovsxd  rcx, dword ptr cs:18000003Ch                                   ; +0x15, 0x18001f5d9\nlea     rdx, cs:180000000h                                             ; +0x1c, 0x18001f5e0\nadd     rcx, rdx                                                       ; +0x23, 0x18001f5e7\ncmp     dword ptr [rcx], 4550h                                         ; +0x26, 0x18001f5ea\njnz     short loc_18001F651                                            ; +0x2c, 0x18001f5f0\nmov     eax, 20Bh                                                      ; +0x2e, 0x18001f5f2\ncmp     [rcx+18h], ax                                                  ; +0x33, 0x18001f5f7\njnz     short loc_18001F651                                            ; +0x37, 0x18001f5fb\nsub     r8, rdx                                                        ; +0x39, 0x18001f5fd\nmovzx   edx, word ptr [rcx+14h]                                        ; +0x3c, 0x18001f600\nadd     rdx, 18h                                                       ; +0x40, 0x18001f604\nadd     rdx, rcx                                                       ; +0x44, 0x18001f608\nmovzx   eax, word ptr [rcx+6]                                          ; +0x47, 0x18001f60b\nlea     rcx, [rax+rax*4]                                               ; +0x4b, 0x18001f60f\nlea     r9, [rdx+rcx*8]                                                ; +0x4f, 0x18001f613\nmov     [rsp+18h+var_18], rdx                                          ; +0x53, 0x18001f617\ncmp     rdx, r9                                                        ; +0x57, 0x18001f61b\njz      short loc_18001F638                                            ; +0x5a, 0x18001f61e\nmov     ecx, [rdx+0Ch]                                                 ; +0x5c, 0x18001f620\ncmp     r8, rcx                                                        ; +0x5f, 0x18001f623\njb      short loc_18001F632                                            ; +0x62, 0x18001f626\nmov     eax, [rdx+8]                                                   ; +0x64, 0x18001f628\nadd     eax, ecx                                                       ; +0x67, 0x18001f62b\ncmp     r8, rax                                                        ; +0x69, 0x18001f62d\njb      short loc_18001F63A                                            ; +0x6c, 0x18001f630\nadd     rdx, 28h ; '('                                                 ; +0x6e, 0x18001f632\njmp     short loc_18001F617                                            ; +0x72, 0x18001f636\nxor     edx, edx                                                       ; +0x74, 0x18001f638\ntest    rdx, rdx                                                       ; +0x76, 0x18001f63a\njnz     short loc_18001F643                                            ; +0x79, 0x18001f63d\nxor     al, al                                                         ; +0x7b, 0x18001f63f\njmp     short loc_18001F657                                            ; +0x7d, 0x18001f641\ncmp     dword ptr [rdx+24h], 0                                         ; +0x7f, 0x18001f643\njge     short loc_18001F64D                                            ; +0x83, 0x18001f647\nxor     al, al                                                         ; +0x85, 0x18001f649\njmp     short loc_18001F657                                            ; +0x87, 0x18001f64b\nmov     al, 1                                                          ; +0x89, 0x18001f64d\njmp     short loc_18001F657                                            ; +0x8b, 0x18001f64f\nxor     al, al                                                         ; +0x8d, 0x18001f651\njmp     short loc_18001F657                                            ; +0x8f, 0x18001f653\nxor     al, al                                                         ; +0x91, 0x18001f655\nadd     rsp, 18h                                                       ; +0x93, 0x18001f657\nretn                                                                   ; +0x97, 0x18001f65b", "xrefs": ["dllmain_crt_process_attach @ 0x18001f95c", "<???> @ 0x18004b1f0"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}