{"type": "func", "start": 6442580528, "end": 6442580833, "name": "dllmain_dispatch", "pseudocode": "// \n// dllmain_dispatch from 0x18001fa30 to 0x18001fb61 (305 bytes)\n// \n// 4 xrefs:\n// > dllmain_crt_process_detach @ 0x18001fa2f\n// > DllEntryPoint @ 0x18001fb9c\n// > @ 0x18004b25c\n// > @ 0x18004b268\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\n__int64 __fastcall dllmain_dispatch(HINSTANCE a1, DWORD a2, void *const a3)\n{\n unsigned int v7; // ebx\n BOOL v8; // eax\n\n if ( !a2 && dword_180048038 <= 0 )\n return 0;\n if ( a2 - 1 > 1 || (v7 = dllmain_crt_dispatch(a1, a2, a3)) != 0 )\n {\n v8 = DllMain(a1, a2, a3);\n v7 = v8;\n if ( a2 == 1 && !v8 )\n {\n DllMain(a1, 0, a3);\n dllmain_crt_process_detach(a3 != nullptr);\n }\n if ( !a2 || a2 == 3 )\n return (unsigned int)dllmain_crt_dispatch(a1, a2, a3) != 0;\n }\n return v7;\n}", "assembly": "; \n; dllmain_dispatch from 0x18001fa30 to 0x18001fb61 (305 bytes)\n; \n; 4 xrefs:\n; > dllmain_crt_process_detach @ 0x18001fa2f\n; > DllEntryPoint @ 0x18001fb9c\n; > @ 0x18004b25c\n; > @ 0x18004b268\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov rax, rsp ; +0x0, 0x18001fa30\nmov [rax+20h], rbx ; +0x3, 0x18001fa33\nmov [rax+18h], r8 ; +0x7, 0x18001fa37\nmov [rax+10h], edx ; +0xb, 0x18001fa3b\nmov [rax+8], rcx ; +0xe, 0x18001fa3e\npush rsi ; +0x12, 0x18001fa42\npush rdi ; +0x13, 0x18001fa43\npush r14 ; +0x14, 0x18001fa44\nsub rsp, 40h ; +0x16, 0x18001fa46\nmov rsi, r8 ; +0x1a, 0x18001fa4a\nmov edi, edx ; +0x1d, 0x18001fa4d\nmov r14, rcx ; +0x1f, 0x18001fa4f\ntest edx, edx ; +0x22, 0x18001fa52\njnz short loc_18001FA65 ; +0x24, 0x18001fa54\ncmp cs:dword_180048038, edx ; +0x26, 0x18001fa56\njg short loc_18001FA65 ; +0x2c, 0x18001fa5c\nxor eax, eax ; +0x2e, 0x18001fa5e\njmp loc_18001FB53 ; +0x30, 0x18001fa60\nlea eax, [rdx-1] ; +0x35, 0x18001fa65\ncmp eax, 1 ; +0x38, 0x18001fa68\nja short loc_18001FAB2 ; +0x3b, 0x18001fa6b\nmov rax, cs:qword_180023318 ; +0x3d, 0x18001fa6d\ntest rax, rax ; +0x44, 0x18001fa74\njnz short loc_18001FA83 ; +0x47, 0x18001fa77\nmov [rsp+58h+var_28], 1 ; +0x49, 0x18001fa79\njmp short loc_18001FA97 ; +0x51, 0x18001fa81\ncall cs:__guard_dispatch_icall_fptr ; +0x53, 0x18001fa83\nmov ebx, eax ; +0x59, 0x18001fa89\nmov [rsp+58h+var_28], eax ; +0x5b, 0x18001fa8b\ntest eax, eax ; +0x5f, 0x18001fa8f\njz loc_18001FB49 ; +0x61, 0x18001fa91\nmov r8, rsi; void * ; +0x67, 0x18001fa97\nmov edx, edi; unsigned int ; +0x6a, 0x18001fa9a\nmov rcx, r14; HINSTANCE ; +0x6c, 0x18001fa9c\ncall ?dllmain_crt_dispatch@@YAHQEAUHINSTANCE__@@KQEAX@Z ; +0x6f, 0x18001fa9f\nmov ebx, eax ; +0x74, 0x18001faa4\nmov [rsp+58h+var_28], eax ; +0x76, 0x18001faa6\ntest eax, eax ; +0x7a, 0x18001faaa\njz loc_18001FB49 ; +0x7c, 0x18001faac\nmov r8, rsi; lpvReserved ; +0x82, 0x18001fab2\nmov edx, edi; fdwReason ; +0x85, 0x18001fab5\nmov rcx, r14; hinstDLL ; +0x87, 0x18001fab7\ncall DllMain ; +0x8a, 0x18001faba\nmov ebx, eax ; +0x8f, 0x18001fabf\nmov [rsp+58h+var_28], eax ; +0x91, 0x18001fac1\ncmp edi, 1 ; +0x95, 0x18001fac5\njnz short loc_18001FB00 ; +0x98, 0x18001fac8\ntest eax, eax ; +0x9a, 0x18001faca\njnz short loc_18001FB00 ; +0x9c, 0x18001facc\nmov r8, rsi; lpvReserved ; +0x9e, 0x18001face\nxor edx, edx; fdwReason ; +0xa1, 0x18001fad1\nmov rcx, r14; hinstDLL ; +0xa3, 0x18001fad3\ncall DllMain ; +0xa6, 0x18001fad6\ntest rsi, rsi ; +0xab, 0x18001fadb\nsetnz cl; bool ; +0xae, 0x18001fade\ncall ?dllmain_crt_process_detach@@YAH_N@Z ; +0xb1, 0x18001fae1\nmov rax, cs:qword_180023318 ; +0xb6, 0x18001fae6\ntest rax, rax ; +0xbd, 0x18001faed\njz short loc_18001FB00 ; +0xc0, 0x18001faf0\nmov r8, rsi ; +0xc2, 0x18001faf2\nxor edx, edx ; +0xc5, 0x18001faf5\nmov rcx, r14 ; +0xc7, 0x18001faf7\ncall cs:__guard_dispatch_icall_fptr ; +0xca, 0x18001fafa\ntest edi, edi ; +0xd0, 0x18001fb00\njz short loc_18001FB09 ; +0xd2, 0x18001fb02\ncmp edi, 3 ; +0xd4, 0x18001fb04\njnz short loc_18001FB49 ; +0xd7, 0x18001fb07\nmov r8, rsi; void * ; +0xd9, 0x18001fb09\nmov edx, edi; unsigned int ; +0xdc, 0x18001fb0c\nmov rcx, r14; HINSTANCE ; +0xde, 0x18001fb0e\ncall ?dllmain_crt_dispatch@@YAHQEAUHINSTANCE__@@KQEAX@Z ; +0xe1, 0x18001fb11\nmov ebx, eax ; +0xe6, 0x18001fb16\nmov [rsp+58h+var_28], eax ; +0xe8, 0x18001fb18\ntest eax, eax ; +0xec, 0x18001fb1c\njz short loc_18001FB49 ; +0xee, 0x18001fb1e\nmov rax, cs:qword_180023318 ; +0xf0, 0x18001fb20\ntest rax, rax ; +0xf7, 0x18001fb27\njnz short loc_18001FB35 ; +0xfa, 0x18001fb2a\nlea ebx, [rax+1] ; +0xfc, 0x18001fb2c\nmov [rsp+58h+var_28], ebx ; +0xff, 0x18001fb2f\njmp short loc_18001FB49 ; +0x103, 0x18001fb33\nmov r8, rsi ; +0x105, 0x18001fb35\nmov edx, edi ; +0x108, 0x18001fb38\nmov rcx, r14 ; +0x10a, 0x18001fb3a\ncall cs:__guard_dispatch_icall_fptr ; +0x10d, 0x18001fb3d\nmov ebx, eax ; +0x113, 0x18001fb43\nmov [rsp+58h+var_28], eax ; +0x115, 0x18001fb45\njmp short loc_18001FB51 ; +0x119, 0x18001fb49\nxor ebx, ebx ; +0x11b, 0x18001fb4b\nmov [rsp+58h+var_28], ebx ; +0x11d, 0x18001fb4d\nmov eax, ebx ; +0x121, 0x18001fb51\nmov rbx, [rsp+58h+arg_18] ; +0x123, 0x18001fb53\nadd rsp, 40h ; +0x128, 0x18001fb58\npop r14 ; +0x12c, 0x18001fb5c\npop rdi ; +0x12e, 0x18001fb5e\npop rsi ; +0x12f, 0x18001fb5f\nretn ; +0x130, 0x18001fb60", "xrefs": ["dllmain_crt_process_detach @ 0x18001fa2f", "DllEntryPoint @ 0x18001fb9c", " @ 0x18004b25c", " @ 0x18004b268"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}