{"type": "func", "start": 6442580120, "end": 6442580398, "name": "dllmain_crt_process_attach", "pseudocode": "// \n// dllmain_crt_process_attach from 0x18001f898 to 0x18001f9ae (278 bytes)\n// \n// 3 xrefs:\n// > dllmain_crt_dispatch @ 0x18001f884\n// > @ 0x18004b244\n// > @ 0x18004b250\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\n__int64 __fastcall dllmain_crt_process_attach(HINSTANCE a1, void *const a2)\n{\n char v2; // bl\n char v3; // di\n _QWORD *v4; // rax\n\n if ( !_scrt_initialize_crt(0) )\n return 0;\n v2 = _scrt_acquire_startup_lock();\n v3 = 1;\n if ( dword_180047FF0 )\n {\n _scrt_fastfail(7);\n __debugbreak();\n JUMPOUT(0x18001F9AELL);\n }\n dword_180047FF0 = 1;\n if ( _scrt_dllmain_before_initialize_c() )\n {\n sub_180020190();\n sub_180020148();\n _scrt_initialize_default_local_stdio_options();\n if ( !initterm_e((_PIFV *)&First, (_PIFV *)&Last) )\n {\n if ( _scrt_dllmain_after_initialize_c() )\n {\n initterm((_PVFV *)&qword_180023208, (_PVFV *)&qword_180023268);\n dword_180047FF0 = 2;\n v3 = 0;\n }\n }\n }\n _scrt_release_startup_lock(v2);\n if ( v3 )\n return 0;\n v4 = (_QWORD *)sub_180020188();\n if ( *v4 )\n {\n if ( _scrt_is_nonwritable_in_current_image((__int64)v4) )\n _guard_dispatch_icall_fptr();\n }\n ++dword_180048038;\n return 1;\n}", "assembly": "; \n; dllmain_crt_process_attach from 0x18001f898 to 0x18001f9ae (278 bytes)\n; \n; 3 xrefs:\n; > dllmain_crt_dispatch @ 0x18001f884\n; > @ 0x18004b244\n; > @ 0x18004b250\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov [rsp+arg_0], rbx ; +0x0, 0x18001f898\nmov [rsp+arg_8], rsi ; +0x5, 0x18001f89d\nmov [rsp+arg_18], rdi ; +0xa, 0x18001f8a2\npush r14 ; +0xf, 0x18001f8a7\nsub rsp, 20h ; +0x11, 0x18001f8a9\nmov rsi, rdx ; +0x15, 0x18001f8ad\nmov r14, rcx ; +0x18, 0x18001f8b0\nxor ecx, ecx ; +0x1b, 0x18001f8b3\ncall __scrt_initialize_crt ; +0x1d, 0x18001f8b5\ntest al, al ; +0x22, 0x18001f8ba\njz loc_18001F98A ; +0x24, 0x18001f8bc\ncall __scrt_acquire_startup_lock ; +0x2a, 0x18001f8c2\nmov bl, al ; +0x2f, 0x18001f8c7\nmov [rsp+28h+arg_10], al ; +0x31, 0x18001f8c9\nmov dil, 1 ; +0x35, 0x18001f8cd\ncmp cs:dword_180047FF0, 0 ; +0x38, 0x18001f8d0\njnz loc_18001F9A2 ; +0x3f, 0x18001f8d7\nmov cs:dword_180047FF0, 1 ; +0x45, 0x18001f8dd\ncall __scrt_dllmain_before_initialize_c ; +0x4f, 0x18001f8e7\ntest al, al ; +0x54, 0x18001f8ec\njz short loc_18001F93F ; +0x56, 0x18001f8ee\ncall sub_180020190 ; +0x58, 0x18001f8f0\ncall sub_180020148 ; +0x5d, 0x18001f8f5\ncall __scrt_initialize_default_local_stdio_options ; +0x62, 0x18001f8fa\nlea rdx, Last; Last ; +0x67, 0x18001f8ff\nlea rcx, First; First ; +0x6e, 0x18001f906\ncall _initterm_e ; +0x75, 0x18001f90d\ntest eax, eax ; +0x7a, 0x18001f912\njnz short loc_18001F93F ; +0x7c, 0x18001f914\ncall __scrt_dllmain_after_initialize_c ; +0x7e, 0x18001f916\ntest al, al ; +0x83, 0x18001f91b\njz short loc_18001F93F ; +0x85, 0x18001f91d\nlea rdx, qword_180023268; Last ; +0x87, 0x18001f91f\nlea rcx, qword_180023208; First ; +0x8e, 0x18001f926\ncall _initterm ; +0x95, 0x18001f92d\nmov cs:dword_180047FF0, 2 ; +0x9a, 0x18001f932\nxor dil, dil ; +0xa4, 0x18001f93c\nmov cl, bl ; +0xa7, 0x18001f93f\ncall __scrt_release_startup_lock ; +0xa9, 0x18001f941\ntest dil, dil ; +0xae, 0x18001f946\njnz short loc_18001F98A ; +0xb1, 0x18001f949\ncall sub_180020188 ; +0xb3, 0x18001f94b\nmov rbx, rax ; +0xb8, 0x18001f950\ncmp qword ptr [rax], 0 ; +0xbb, 0x18001f953\njz short loc_18001F97D ; +0xbf, 0x18001f957\nmov rcx, rax ; +0xc1, 0x18001f959\ncall __scrt_is_nonwritable_in_current_image ; +0xc4, 0x18001f95c\ntest al, al ; +0xc9, 0x18001f961\njz short loc_18001F97D ; +0xcb, 0x18001f963\nmov r8, rsi ; +0xcd, 0x18001f965\nmov edx, 2 ; +0xd0, 0x18001f968\nmov rcx, r14 ; +0xd5, 0x18001f96d\nmov rax, [rbx] ; +0xd8, 0x18001f970\nmov r9, cs:__guard_dispatch_icall_fptr ; +0xdb, 0x18001f973\ncall r9 ; _guard_dispatch_icall_nop ; +0xe2, 0x18001f97a\ninc cs:dword_180048038 ; +0xe5, 0x18001f97d\nmov eax, 1 ; +0xeb, 0x18001f983\njmp short loc_18001F98C ; +0xf0, 0x18001f988\nxor eax, eax ; +0xf2, 0x18001f98a\nmov rbx, [rsp+28h+arg_0] ; +0xf4, 0x18001f98c\nmov rsi, [rsp+28h+arg_8] ; +0xf9, 0x18001f991\nmov rdi, [rsp+28h+arg_18] ; +0xfe, 0x18001f996\nadd rsp, 20h ; +0x103, 0x18001f99b\npop r14 ; +0x107, 0x18001f99f\nretn ; +0x109, 0x18001f9a1\nmov ecx, 7 ; +0x10a, 0x18001f9a2\ncall __scrt_fastfail ; +0x10f, 0x18001f9a7\nnop ; +0x114, 0x18001f9ac\nint 3; Trap to Debugger ; +0x115, 0x18001f9ad", "xrefs": ["dllmain_crt_dispatch @ 0x18001f884", " @ 0x18004b244", " @ 0x18004b250"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}