{"type": "func", "start": 6442581164, "end": 6442581277, "name": "capture_previous_context", "pseudocode": "// \n// capture_previous_context from 0x18001fcac to 0x18001fd1d (113 bytes)\n// \n// 2 xrefs:\n// > __report_gsfailure @ 0x18001fbfe\n// > <???> @ 0x18004b298\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nstruct _IMAGE_RUNTIME_FUNCTION_ENTRY *__fastcall capture_previous_context(PCONTEXT ContextRecord)\n{\n  ULONG64 Rip; // rsi\n  int i; // edi\n  struct _IMAGE_RUNTIME_FUNCTION_ENTRY *result; // rax\n  unsigned __int64 ImageBase; // [rsp+60h] [rbp+8h] BYREF\n  unsigned __int64 EstablisherFrame; // [rsp+68h] [rbp+10h] BYREF\n  PVOID HandlerData; // [rsp+70h] [rbp+18h] BYREF\n\n  RtlCaptureContext(ContextRecord);\n  Rip = ContextRecord->Rip;\n  for ( i = 0; i < 2; ++i )\n  {\n    result = RtlLookupFunctionEntry(Rip, &ImageBase, nullptr);\n    if ( !result )\n      break;\n    result = (struct _IMAGE_RUNTIME_FUNCTION_ENTRY *)RtlVirtualUnwind(\n                                                       0,\n                                                       ImageBase,\n                                                       Rip,\n                                                       result,\n                                                       ContextRecord,\n                                                       &HandlerData,\n                                                       &EstablisherFrame,\n                                                       nullptr);\n  }\n  return result;\n}", "assembly": "; \n; capture_previous_context from 0x18001fcac to 0x18001fd1d (113 bytes)\n; \n; 2 xrefs:\n; > __report_gsfailure @ 0x18001fbfe\n; > <???> @ 0x18004b298\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\npush    rbx                                                            ; +0x0, 0x18001fcac\npush    rsi                                                            ; +0x2, 0x18001fcae\npush    rdi                                                            ; +0x3, 0x18001fcaf\nsub     rsp, 40h                                                       ; +0x4, 0x18001fcb0\nmov     rbx, rcx                                                       ; +0x8, 0x18001fcb4\ncall    cs:RtlCaptureContext                                           ; +0xb, 0x18001fcb7\nmov     rsi, [rbx+0F8h]                                                ; +0x11, 0x18001fcbd\nxor     edi, edi                                                       ; +0x18, 0x18001fcc4\nxor     r8d, r8d; HistoryTable                                         ; +0x1a, 0x18001fcc6\nlea     rdx, [rsp+58h+ImageBase]; ImageBase                            ; +0x1d, 0x18001fcc9\nmov     rcx, rsi; ControlPc                                            ; +0x22, 0x18001fcce\ncall    cs:RtlLookupFunctionEntry                                      ; +0x25, 0x18001fcd1\ntest    rax, rax                                                       ; +0x2b, 0x18001fcd7\njz      short loc_18001FD15                                            ; +0x2e, 0x18001fcda\nand     [rsp+58h+var_20], 0                                            ; +0x30, 0x18001fcdc\nlea     rcx, [rsp+58h+arg_8]                                           ; +0x36, 0x18001fce2\nmov     rdx, [rsp+58h+ImageBase]; ImageBase                            ; +0x3b, 0x18001fce7\nmov     r9, rax; FunctionEntry                                         ; +0x40, 0x18001fcec\nmov     [rsp+58h+EstablisherFrame], rcx; EstablisherFrame              ; +0x43, 0x18001fcef\nmov     r8, rsi; ControlPc                                             ; +0x48, 0x18001fcf4\nlea     rcx, [rsp+58h+arg_10]                                          ; +0x4b, 0x18001fcf7\nmov     [rsp+58h+HandlerData], rcx; HandlerData                        ; +0x50, 0x18001fcfc\nxor     ecx, ecx; HandlerType                                          ; +0x55, 0x18001fd01\nmov     [rsp+58h+ContextRecord], rbx; ContextRecord                    ; +0x57, 0x18001fd03\ncall    cs:RtlVirtualUnwind                                            ; +0x5c, 0x18001fd08\ninc     edi                                                            ; +0x62, 0x18001fd0e\ncmp     edi, 2                                                         ; +0x64, 0x18001fd10\njl      short loc_18001FCC6                                            ; +0x67, 0x18001fd13\nadd     rsp, 40h                                                       ; +0x69, 0x18001fd15\npop     rdi                                                            ; +0x6d, 0x18001fd19\npop     rsi                                                            ; +0x6e, 0x18001fd1a\npop     rbx                                                            ; +0x6f, 0x18001fd1b\nretn                                                                   ; +0x70, 0x18001fd1c", "xrefs": ["__report_gsfailure @ 0x18001fbfe", "<???> @ 0x18004b298"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}