; ; dllmain_dispatch from 0x18001fa30 to 0x18001fb61 (305 bytes) ; ; 4 xrefs: ; > dllmain_crt_process_detach @ 0x18001fa2f ; > DllEntryPoint @ 0x18001fb9c ; > @ 0x18004b25c ; > @ 0x18004b268 ; ; This function is hookable on this platform! ; ; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA ; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings ; mov rax, rsp ; +0x0, 0x18001fa30 mov [rax+20h], rbx ; +0x3, 0x18001fa33 mov [rax+18h], r8 ; +0x7, 0x18001fa37 mov [rax+10h], edx ; +0xb, 0x18001fa3b mov [rax+8], rcx ; +0xe, 0x18001fa3e push rsi ; +0x12, 0x18001fa42 push rdi ; +0x13, 0x18001fa43 push r14 ; +0x14, 0x18001fa44 sub rsp, 40h ; +0x16, 0x18001fa46 mov rsi, r8 ; +0x1a, 0x18001fa4a mov edi, edx ; +0x1d, 0x18001fa4d mov r14, rcx ; +0x1f, 0x18001fa4f test edx, edx ; +0x22, 0x18001fa52 jnz short loc_18001FA65 ; +0x24, 0x18001fa54 cmp cs:dword_180048038, edx ; +0x26, 0x18001fa56 jg short loc_18001FA65 ; +0x2c, 0x18001fa5c xor eax, eax ; +0x2e, 0x18001fa5e jmp loc_18001FB53 ; +0x30, 0x18001fa60 lea eax, [rdx-1] ; +0x35, 0x18001fa65 cmp eax, 1 ; +0x38, 0x18001fa68 ja short loc_18001FAB2 ; +0x3b, 0x18001fa6b mov rax, cs:qword_180023318 ; +0x3d, 0x18001fa6d test rax, rax ; +0x44, 0x18001fa74 jnz short loc_18001FA83 ; +0x47, 0x18001fa77 mov [rsp+58h+var_28], 1 ; +0x49, 0x18001fa79 jmp short loc_18001FA97 ; +0x51, 0x18001fa81 call cs:__guard_dispatch_icall_fptr ; +0x53, 0x18001fa83 mov ebx, eax ; +0x59, 0x18001fa89 mov [rsp+58h+var_28], eax ; +0x5b, 0x18001fa8b test eax, eax ; +0x5f, 0x18001fa8f jz loc_18001FB49 ; +0x61, 0x18001fa91 mov r8, rsi; void * ; +0x67, 0x18001fa97 mov edx, edi; unsigned int ; +0x6a, 0x18001fa9a mov rcx, r14; HINSTANCE ; +0x6c, 0x18001fa9c call ?dllmain_crt_dispatch@@YAHQEAUHINSTANCE__@@KQEAX@Z ; +0x6f, 0x18001fa9f mov ebx, eax ; +0x74, 0x18001faa4 mov [rsp+58h+var_28], eax ; +0x76, 0x18001faa6 test eax, eax ; +0x7a, 0x18001faaa jz loc_18001FB49 ; +0x7c, 0x18001faac mov r8, rsi; lpvReserved ; +0x82, 0x18001fab2 mov edx, edi; fdwReason ; +0x85, 0x18001fab5 mov rcx, r14; hinstDLL ; +0x87, 0x18001fab7 call DllMain ; +0x8a, 0x18001faba mov ebx, eax ; +0x8f, 0x18001fabf mov [rsp+58h+var_28], eax ; +0x91, 0x18001fac1 cmp edi, 1 ; +0x95, 0x18001fac5 jnz short loc_18001FB00 ; +0x98, 0x18001fac8 test eax, eax ; +0x9a, 0x18001faca jnz short loc_18001FB00 ; +0x9c, 0x18001facc mov r8, rsi; lpvReserved ; +0x9e, 0x18001face xor edx, edx; fdwReason ; +0xa1, 0x18001fad1 mov rcx, r14; hinstDLL ; +0xa3, 0x18001fad3 call DllMain ; +0xa6, 0x18001fad6 test rsi, rsi ; +0xab, 0x18001fadb setnz cl; bool ; +0xae, 0x18001fade call ?dllmain_crt_process_detach@@YAH_N@Z ; +0xb1, 0x18001fae1 mov rax, cs:qword_180023318 ; +0xb6, 0x18001fae6 test rax, rax ; +0xbd, 0x18001faed jz short loc_18001FB00 ; +0xc0, 0x18001faf0 mov r8, rsi ; +0xc2, 0x18001faf2 xor edx, edx ; +0xc5, 0x18001faf5 mov rcx, r14 ; +0xc7, 0x18001faf7 call cs:__guard_dispatch_icall_fptr ; +0xca, 0x18001fafa test edi, edi ; +0xd0, 0x18001fb00 jz short loc_18001FB09 ; +0xd2, 0x18001fb02 cmp edi, 3 ; +0xd4, 0x18001fb04 jnz short loc_18001FB49 ; +0xd7, 0x18001fb07 mov r8, rsi; void * ; +0xd9, 0x18001fb09 mov edx, edi; unsigned int ; +0xdc, 0x18001fb0c mov rcx, r14; HINSTANCE ; +0xde, 0x18001fb0e call ?dllmain_crt_dispatch@@YAHQEAUHINSTANCE__@@KQEAX@Z ; +0xe1, 0x18001fb11 mov ebx, eax ; +0xe6, 0x18001fb16 mov [rsp+58h+var_28], eax ; +0xe8, 0x18001fb18 test eax, eax ; +0xec, 0x18001fb1c jz short loc_18001FB49 ; +0xee, 0x18001fb1e mov rax, cs:qword_180023318 ; +0xf0, 0x18001fb20 test rax, rax ; +0xf7, 0x18001fb27 jnz short loc_18001FB35 ; +0xfa, 0x18001fb2a lea ebx, [rax+1] ; +0xfc, 0x18001fb2c mov [rsp+58h+var_28], ebx ; +0xff, 0x18001fb2f jmp short loc_18001FB49 ; +0x103, 0x18001fb33 mov r8, rsi ; +0x105, 0x18001fb35 mov edx, edi ; +0x108, 0x18001fb38 mov rcx, r14 ; +0x10a, 0x18001fb3a call cs:__guard_dispatch_icall_fptr ; +0x10d, 0x18001fb3d mov ebx, eax ; +0x113, 0x18001fb43 mov [rsp+58h+var_28], eax ; +0x115, 0x18001fb45 jmp short loc_18001FB51 ; +0x119, 0x18001fb49 xor ebx, ebx ; +0x11b, 0x18001fb4b mov [rsp+58h+var_28], ebx ; +0x11d, 0x18001fb4d mov eax, ebx ; +0x121, 0x18001fb51 mov rbx, [rsp+58h+arg_18] ; +0x123, 0x18001fb53 add rsp, 40h ; +0x128, 0x18001fb58 pop r14 ; +0x12c, 0x18001fb5c pop rdi ; +0x12e, 0x18001fb5e pop rsi ; +0x12f, 0x18001fb5f retn ; +0x130, 0x18001fb60