// // capture_previous_context from 0x18001fcac to 0x18001fd1d (113 bytes) // // 2 xrefs: // > __report_gsfailure @ 0x18001fbfe // > @ 0x18004b298 // // This function is hookable on this platform! // // Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA // Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings // struct _IMAGE_RUNTIME_FUNCTION_ENTRY *__fastcall capture_previous_context(PCONTEXT ContextRecord) { ULONG64 Rip; // rsi int i; // edi struct _IMAGE_RUNTIME_FUNCTION_ENTRY *result; // rax unsigned __int64 ImageBase; // [rsp+60h] [rbp+8h] BYREF unsigned __int64 EstablisherFrame; // [rsp+68h] [rbp+10h] BYREF PVOID HandlerData; // [rsp+70h] [rbp+18h] BYREF RtlCaptureContext(ContextRecord); Rip = ContextRecord->Rip; for ( i = 0; i < 2; ++i ) { result = RtlLookupFunctionEntry(Rip, &ImageBase, nullptr); if ( !result ) break; result = (struct _IMAGE_RUNTIME_FUNCTION_ENTRY *)RtlVirtualUnwind( 0, ImageBase, Rip, result, ContextRecord, &HandlerData, &EstablisherFrame, nullptr); } return result; }