{"type": "func", "start": 6442582136, "end": 6442582308, "name": "__security_init_cookie", "pseudocode": "// \n// __security_init_cookie from 0x180020078 to 0x180020124 (172 bytes)\n// \n// 3 xrefs:\n// > DllEntryPoint @ 0x18001fb80\n// > <???> @ 0x18004b2bc\n// > <???> @ 0x18004b2c8\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nvoid __cdecl _security_init_cookie()\n{\n  uintptr_t v0; // rax\n  struct _FILETIME v1; // [rsp+20h] [rbp-10h] BYREF\n  struct _FILETIME SystemTimeAsFileTime; // [rsp+40h] [rbp+10h] BYREF\n  LARGE_INTEGER PerformanceCount; // [rsp+48h] [rbp+18h] BYREF\n\n  v0 = _security_cookie;\n  if ( _security_cookie == 0x2B992DDFA232LL )\n  {\n    SystemTimeAsFileTime = 0;\n    GetSystemTimeAsFileTime(&SystemTimeAsFileTime);\n    v1 = SystemTimeAsFileTime;\n    v1 = (struct _FILETIME)(GetCurrentThreadId() ^ *(unsigned __int64 *)&v1);\n    v1 = (struct _FILETIME)(GetCurrentProcessId() ^ *(unsigned __int64 *)&v1);\n    QueryPerformanceCounter(&PerformanceCount);\n    v0 = ((unsigned __int64)&v1\n        ^ *(_QWORD *)&v1\n        ^ PerformanceCount.QuadPart\n        ^ ((unsigned __int64)PerformanceCount.LowPart << 32))\n       & 0xFFFFFFFFFFFFLL;\n    if ( v0 == 0x2B992DDFA232LL )\n      v0 = 0x2B992DDFA233LL;\n    _security_cookie = v0;\n  }\n  qword_180047080 = ~v0;\n}", "assembly": "; \n; __security_init_cookie from 0x180020078 to 0x180020124 (172 bytes)\n; \n; 3 xrefs:\n; > DllEntryPoint @ 0x18001fb80\n; > <???> @ 0x18004b2bc\n; > <???> @ 0x18004b2c8\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov     [rsp-8+arg_10], rbx                                            ; +0x0, 0x180020078\npush    rbp                                                            ; +0x5, 0x18002007d\nmov     rbp, rsp                                                       ; +0x6, 0x18002007e\nsub     rsp, 30h                                                       ; +0x9, 0x180020081\nmov     rax, cs:__security_cookie                                      ; +0xd, 0x180020085\nmov     rbx, 2B992DDFA232h                                             ; +0x14, 0x18002008c\ncmp     rax, rbx                                                       ; +0x1e, 0x180020096\njnz     short loc_18002010F                                            ; +0x21, 0x180020099\nand     qword ptr [rbp+SystemTimeAsFileTime.dwLowDateTime], 0          ; +0x23, 0x18002009b\nlea     rcx, [rbp+SystemTimeAsFileTime]; lpSystemTimeAsFileTime        ; +0x28, 0x1800200a0\ncall    cs:GetSystemTimeAsFileTime                                     ; +0x2c, 0x1800200a4\nmov     rax, qword ptr [rbp+SystemTimeAsFileTime.dwLowDateTime]        ; +0x32, 0x1800200aa\nmov     [rbp+var_10], rax                                              ; +0x36, 0x1800200ae\ncall    cs:GetCurrentThreadId                                          ; +0x3a, 0x1800200b2\nmov     eax, eax                                                       ; +0x40, 0x1800200b8\nxor     [rbp+var_10], rax                                              ; +0x42, 0x1800200ba\ncall    cs:GetCurrentProcessId                                         ; +0x46, 0x1800200be\nmov     eax, eax                                                       ; +0x4c, 0x1800200c4\nlea     rcx, [rbp+PerformanceCount]; lpPerformanceCount                ; +0x4e, 0x1800200c6\nxor     [rbp+var_10], rax                                              ; +0x52, 0x1800200ca\ncall    cs:QueryPerformanceCounter                                     ; +0x56, 0x1800200ce\nmov     eax, dword ptr [rbp+PerformanceCount]                          ; +0x5c, 0x1800200d4\nlea     rcx, [rbp+var_10]                                              ; +0x5f, 0x1800200d7\nshl     rax, 20h                                                       ; +0x63, 0x1800200db\nxor     rax, qword ptr [rbp+PerformanceCount]                          ; +0x67, 0x1800200df\nxor     rax, [rbp+var_10]                                              ; +0x6b, 0x1800200e3\nxor     rax, rcx                                                       ; +0x6f, 0x1800200e7\nmov     rcx, 0FFFFFFFFFFFFh                                            ; +0x72, 0x1800200ea\nand     rax, rcx                                                       ; +0x7c, 0x1800200f4\nmov     rcx, 2B992DDFA233h                                             ; +0x7f, 0x1800200f7\ncmp     rax, rbx                                                       ; +0x89, 0x180020101\ncmovz   rax, rcx                                                       ; +0x8c, 0x180020104\nmov     cs:__security_cookie, rax                                      ; +0x90, 0x180020108\nmov     rbx, [rsp+30h+arg_10]                                          ; +0x97, 0x18002010f\nnot     rax                                                            ; +0x9c, 0x180020114\nmov     cs:qword_180047080, rax                                        ; +0x9f, 0x180020117\nadd     rsp, 30h                                                       ; +0xa6, 0x18002011e\npop     rbp                                                            ; +0xaa, 0x180020122\nretn                                                                   ; +0xab, 0x180020123", "xrefs": ["DllEntryPoint @ 0x18001fb80", "<???> @ 0x18004b2bc", "<???> @ 0x18004b2c8"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}