// // __security_init_cookie from 0x180020078 to 0x180020124 (172 bytes) // // 3 xrefs: // > DllEntryPoint @ 0x18001fb80 // > @ 0x18004b2bc // > @ 0x18004b2c8 // // This function is hookable on this platform! // // Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA // Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings // void __cdecl _security_init_cookie() { uintptr_t v0; // rax struct _FILETIME v1; // [rsp+20h] [rbp-10h] BYREF struct _FILETIME SystemTimeAsFileTime; // [rsp+40h] [rbp+10h] BYREF LARGE_INTEGER PerformanceCount; // [rsp+48h] [rbp+18h] BYREF v0 = _security_cookie; if ( _security_cookie == 0x2B992DDFA232LL ) { SystemTimeAsFileTime = 0; GetSystemTimeAsFileTime(&SystemTimeAsFileTime); v1 = SystemTimeAsFileTime; v1 = (struct _FILETIME)(GetCurrentThreadId() ^ *(unsigned __int64 *)&v1); v1 = (struct _FILETIME)(GetCurrentProcessId() ^ *(unsigned __int64 *)&v1); QueryPerformanceCounter(&PerformanceCount); v0 = ((unsigned __int64)&v1 ^ *(_QWORD *)&v1 ^ PerformanceCount.QuadPart ^ ((unsigned __int64)PerformanceCount.LowPart << 32)) & 0xFFFFFFFFFFFFLL; if ( v0 == 0x2B992DDFA232LL ) v0 = 0x2B992DDFA233LL; _security_cookie = v0; } qword_180047080 = ~v0; }