sub.msvcrt.dll__XcptFilter();
0x1400018ee jmp qword [_XcptFilter] ; 0x140002240
void sub.msvcrt.dll__XcptFilter(void)
{
// WARNING: Treating indirect jump as call
(*(code *)0x2ab6)();
return;
}
another one, notice the arg1_00 = (*(code *)0x2bec)(0);
uint64_t fcn.140001958(int64_t arg1)
{
uintmax_t arg1_00;
int64_t iVar1;
arg1_00 = (*(code *)0x2bec)(0);
if ((arg1_00 != 0) && (iVar1 = fcn.1400018fc(arg1_00), iVar1 != 0)) {
if (*(int16_t *)(iVar1 + 0x5c) == 2) {
return 2;
}
if (*(int16_t *)(iVar1 + 0x5c) == 3) {
return 1;
}
}
return arg1 & 0xffffffff;
}
fcn.140001958(int64_t arg1);
; arg int64_t arg1 @ rcx
0x140001958 push rbx
0x14000195a sub rsp, 0x20
0x14000195e mov ebx, ecx ; arg1
0x140001960 xor ecx, ecx ; LPCWSTR lpModuleName
0x140001962 call qword [GetModuleHandleW] ; 0x1400021c0 ; HMODULE GetModuleHandleW(LPCWSTR lpModuleName)
0x140001968 test rax, rax
0x14000196b jz 0x140001995
0x14000196d mov rcx, rax ; uintmax_t arg1
0x140001970 call fcn.1400018fc ; fcn.1400018fc
0x140001975 test rax, rax
0x140001978 jz 0x140001995
0x14000197a mov ecx, 0x02
0x14000197f cmp word [rax+0x5c], cx
0x140001983 jnz 0x140001989
0x140001985 mov eax, ecx
0x140001987 jmp 0x140001997
0x140001989 cmp word [rax+0x5c], 0x03
0x14000198e mov eax, 0x01
0x140001993 jz 0x140001997
0x140001995 mov eax, ebx
0x140001997 add rsp, 0x20
0x14000199b pop rbx
0x14000199c ret
calc.tar.gz
another one, notice the
arg1_00 = (*(code *)0x2bec)(0);calc.tar.gz