; ; qsort from 0x180127140 to 0x1801274dd (925 bytes) ; ; 10 xrefs: ; > sub_180001E90 @ 0x180002004 ; > sub_18004A8C0 @ 0x18004ac95 ; > sub_18004AD20 @ 0x18004af73 ; > sub_18004F920 @ 0x18004fb73 ; > sub_1800BC0F0 @ 0x1800bc303 ; > _wsetlocale_set_cat @ 0x18013a089 ; > @ 0x18019250c ; > @ 0x18019251c ; > @ 0x1802029c0 ; > @ 0x1802029cc ; ; This function is hookable on this platform! ; ; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA ; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings ; push r12 ; +0x0, 0x180127140 push r13 ; +0x2, 0x180127142 push r14 ; +0x4, 0x180127144 sub rsp, 450h ; +0x6, 0x180127146 mov rax, cs:__security_cookie ; +0xd, 0x18012714d xor rax, rsp ; +0x14, 0x180127154 mov [rsp+468h+var_58], rax ; +0x17, 0x180127157 mov r12, r9 ; +0x1f, 0x18012715f mov r14, r8 ; +0x22, 0x180127162 mov r13, rcx ; +0x25, 0x180127165 test rcx, rcx ; +0x28, 0x180127168 jnz short loc_180127187 ; +0x2b, 0x18012716b test rdx, rdx ; +0x2d, 0x18012716d jz short loc_180127187 ; +0x30, 0x180127170 call _errno ; +0x32, 0x180127172 mov dword ptr [rax], 16h ; +0x37, 0x180127177 call _invalid_parameter_noinfo ; +0x3d, 0x18012717d jmp loc_1801274BF ; +0x42, 0x180127182 test r14, r14 ; +0x47, 0x180127187 jz short loc_180127172 ; +0x4a, 0x18012718a test r12, r12 ; +0x4c, 0x18012718c jz short loc_180127172 ; +0x4f, 0x18012718f cmp rdx, 2 ; +0x51, 0x180127191 jb loc_1801274BF ; +0x55, 0x180127195 mov [rsp+468h+var_20], rbx ; +0x5b, 0x18012719b mov [rsp+468h+var_28], rbp ; +0x63, 0x1801271a3 mov [rsp+468h+var_30], rsi ; +0x6b, 0x1801271ab mov [rsp+468h+var_38], rdi ; +0x73, 0x1801271b3 mov [rsp+468h+var_40], r15 ; +0x7b, 0x1801271bb lea r15, [rdx-1] ; +0x83, 0x1801271c3 imul r15, r14 ; +0x87, 0x1801271c7 add r15, rcx ; +0x8b, 0x1801271cb xor ecx, ecx ; +0x8e, 0x1801271ce mov [rsp+468h+var_448], rcx ; +0x90, 0x1801271d0 nop word ptr [rax+rax+00000000h] ; +0x95, 0x1801271d5 xor edx, edx ; +0xa0, 0x1801271e0 mov rax, r15 ; +0xa2, 0x1801271e2 sub rax, r13 ; +0xa5, 0x1801271e5 div r14 ; +0xa8, 0x1801271e8 lea rbx, [rax+1] ; +0xab, 0x1801271eb cmp rbx, 8 ; +0xaf, 0x1801271ef ja loc_180127284 ; +0xb3, 0x1801271f3 cmp r15, r13 ; +0xb9, 0x1801271f9 jbe short loc_180127263 ; +0xbc, 0x1801271fc lea rsi, [r14+r13] ; +0xbe, 0x1801271fe mov rbx, r13 ; +0xc2, 0x180127202 mov rdi, rsi ; +0xc5, 0x180127205 cmp rsi, r15 ; +0xc8, 0x180127208 ja short loc_18012722D ; +0xcb, 0x18012720b nop dword ptr [rax] ; +0xcd, 0x18012720d mov rdx, rbx ; +0xd0, 0x180127210 mov rcx, rdi ; +0xd3, 0x180127213 mov rax, r12 ; +0xd6, 0x180127216 call cs:__guard_dispatch_icall_fptr ; +0xd9, 0x180127219 test eax, eax ; +0xdf, 0x18012721f cmovg rbx, rdi ; +0xe1, 0x180127221 add rdi, r14 ; +0xe5, 0x180127225 cmp rdi, r15 ; +0xe8, 0x180127228 jbe short loc_180127210 ; +0xeb, 0x18012722b mov r8, r14 ; +0xed, 0x18012722d mov rdx, r15 ; +0xf0, 0x180127230 cmp rbx, r15 ; +0xf3, 0x180127233 jz short loc_180127256 ; +0xf6, 0x180127236 sub rbx, r15 ; +0xf8, 0x180127238 nop dword ptr [rax+rax+00h] ; +0xfb, 0x18012723b movzx eax, byte ptr [rdx] ; +0x100, 0x180127240 movzx ecx, byte ptr [rbx+rdx] ; +0x103, 0x180127243 mov [rbx+rdx], al ; +0x107, 0x180127247 mov [rdx], cl ; +0x10a, 0x18012724a lea rdx, [rdx+1] ; +0x10c, 0x18012724c sub r8, 1 ; +0x110, 0x180127250 jnz short loc_180127240 ; +0x114, 0x180127254 sub r15, r14 ; +0x116, 0x180127256 cmp r15, r13 ; +0x119, 0x180127259 ja short loc_180127202 ; +0x11c, 0x18012725c mov rcx, [rsp+468h+var_448] ; +0x11e, 0x18012725e sub rcx, 1 ; +0x123, 0x180127263 mov [rsp+468h+var_448], rcx ; +0x127, 0x180127267 js loc_180127497 ; +0x12c, 0x18012726c mov r13, [rsp+rcx*8+468h+var_438] ; +0x132, 0x180127272 mov r15, [rsp+rcx*8+468h+var_248] ; +0x137, 0x180127277 jmp $recurse$210 ; +0x13f, 0x18012727f shr rbx, 1 ; +0x144, 0x180127284 mov rcx, r13 ; +0x147, 0x180127287 imul rbx, r14 ; +0x14a, 0x18012728a mov rax, r12 ; +0x14e, 0x18012728e lea rsi, [rbx+r13] ; +0x151, 0x180127291 mov rdx, rsi ; +0x155, 0x180127295 call cs:__guard_dispatch_icall_fptr ; +0x158, 0x180127298 test eax, eax ; +0x15e, 0x18012729e jle short loc_1801272CB ; +0x160, 0x1801272a0 mov r9, r14 ; +0x162, 0x1801272a2 mov r8, rsi ; +0x165, 0x1801272a5 cmp r13, rsi ; +0x168, 0x1801272a8 jz short loc_1801272CB ; +0x16b, 0x1801272ab nop dword ptr [rax] ; +0x16d, 0x1801272ad movzx eax, byte ptr [r8] ; +0x170, 0x1801272b0 mov rdx, r8 ; +0x174, 0x1801272b4 sub rdx, rbx ; +0x177, 0x1801272b7 movzx ecx, byte ptr [rdx] ; +0x17a, 0x1801272ba mov [rdx], al ; +0x17d, 0x1801272bd mov [r8], cl ; +0x17f, 0x1801272bf inc r8 ; +0x182, 0x1801272c2 sub r9, 1 ; +0x185, 0x1801272c5 jnz short loc_1801272B0 ; +0x189, 0x1801272c9 mov rdx, r15 ; +0x18b, 0x1801272cb mov rcx, r13 ; +0x18e, 0x1801272ce mov rax, r12 ; +0x191, 0x1801272d1 call cs:__guard_dispatch_icall_fptr ; +0x194, 0x1801272d4 test eax, eax ; +0x19a, 0x1801272da jle short loc_180127308 ; +0x19c, 0x1801272dc mov r8, r14 ; +0x19e, 0x1801272de mov rdx, r15 ; +0x1a1, 0x1801272e1 cmp r13, r15 ; +0x1a4, 0x1801272e4 jz short loc_180127308 ; +0x1a7, 0x1801272e7 mov r9, r13 ; +0x1a9, 0x1801272e9 sub r9, r15 ; +0x1ac, 0x1801272ec nop ; +0x1af, 0x1801272ef movzx eax, byte ptr [rdx] ; +0x1b0, 0x1801272f0 movzx ecx, byte ptr [r9+rdx] ; +0x1b3, 0x1801272f3 mov [r9+rdx], al ; +0x1b8, 0x1801272f8 mov [rdx], cl ; +0x1bc, 0x1801272fc lea rdx, [rdx+1] ; +0x1be, 0x1801272fe sub r8, 1 ; +0x1c2, 0x180127302 jnz short loc_1801272F0 ; +0x1c6, 0x180127306 mov rdx, r15 ; +0x1c8, 0x180127308 mov rcx, rsi ; +0x1cb, 0x18012730b mov rax, r12 ; +0x1ce, 0x18012730e call cs:__guard_dispatch_icall_fptr ; +0x1d1, 0x180127311 test eax, eax ; +0x1d7, 0x180127317 jle short loc_180127348 ; +0x1d9, 0x180127319 mov r8, r14 ; +0x1db, 0x18012731b mov rdx, r15 ; +0x1de, 0x18012731e cmp rsi, r15 ; +0x1e1, 0x180127321 jz short loc_180127348 ; +0x1e4, 0x180127324 mov r9, rsi ; +0x1e6, 0x180127326 sub r9, r15 ; +0x1e9, 0x180127329 nop dword ptr [rax+00h] ; +0x1ec, 0x18012732c movzx eax, byte ptr [rdx] ; +0x1f0, 0x180127330 movzx ecx, byte ptr [r9+rdx] ; +0x1f3, 0x180127333 mov [r9+rdx], al ; +0x1f8, 0x180127338 mov [rdx], cl ; +0x1fc, 0x18012733c lea rdx, [rdx+1] ; +0x1fe, 0x18012733e sub r8, 1 ; +0x202, 0x180127342 jnz short loc_180127330 ; +0x206, 0x180127346 mov rbx, r13 ; +0x208, 0x180127348 mov rdi, r15 ; +0x20b, 0x18012734b xchg ax, ax ; +0x20e, 0x18012734e cmp rsi, rbx ; +0x210, 0x180127350 jbe short loc_180127372 ; +0x213, 0x180127353 add rbx, r14 ; +0x215, 0x180127355 cmp rbx, rsi ; +0x218, 0x180127358 jnb short loc_180127372 ; +0x21b, 0x18012735b mov rdx, rsi ; +0x21d, 0x18012735d mov rcx, rbx ; +0x220, 0x180127360 mov rax, r12 ; +0x223, 0x180127363 call cs:__guard_dispatch_icall_fptr ; +0x226, 0x180127366 test eax, eax ; +0x22c, 0x18012736c jle short loc_180127355 ; +0x22e, 0x18012736e jmp short loc_180127390 ; +0x230, 0x180127370 add rbx, r14 ; +0x232, 0x180127372 cmp rbx, r15 ; +0x235, 0x180127375 ja short loc_180127390 ; +0x238, 0x180127378 mov rdx, rsi ; +0x23a, 0x18012737a mov rcx, rbx ; +0x23d, 0x18012737d mov rax, r12 ; +0x240, 0x180127380 call cs:__guard_dispatch_icall_fptr ; +0x243, 0x180127383 test eax, eax ; +0x249, 0x180127389 jle short loc_180127372 ; +0x24b, 0x18012738b nop dword ptr [rax] ; +0x24d, 0x18012738d mov rbp, rdi ; +0x250, 0x180127390 sub rdi, r14 ; +0x253, 0x180127393 cmp rdi, rsi ; +0x256, 0x180127396 jbe short loc_1801273AE ; +0x259, 0x180127399 mov rdx, rsi ; +0x25b, 0x18012739b mov rcx, rdi ; +0x25e, 0x18012739e mov rax, r12 ; +0x261, 0x1801273a1 call cs:__guard_dispatch_icall_fptr ; +0x264, 0x1801273a4 test eax, eax ; +0x26a, 0x1801273aa jg short loc_180127390 ; +0x26c, 0x1801273ac cmp rdi, rbx ; +0x26e, 0x1801273ae jb short loc_1801273EB ; +0x271, 0x1801273b1 mov r8, r14 ; +0x273, 0x1801273b3 mov rdx, rdi ; +0x276, 0x1801273b6 jz short loc_1801273D9 ; +0x279, 0x1801273b9 mov r9, rbx ; +0x27b, 0x1801273bb sub r9, rdi ; +0x27e, 0x1801273be movzx eax, byte ptr [rdx] ; +0x281, 0x1801273c1 movzx ecx, byte ptr [r9+rdx] ; +0x284, 0x1801273c4 mov [r9+rdx], al ; +0x289, 0x1801273c9 mov [rdx], cl ; +0x28d, 0x1801273cd lea rdx, [rdx+1] ; +0x28f, 0x1801273cf sub r8, 1 ; +0x293, 0x1801273d3 jnz short loc_1801273C1 ; +0x297, 0x1801273d7 cmp rsi, rdi ; +0x299, 0x1801273d9 mov rax, rbx ; +0x29c, 0x1801273dc cmovnz rax, rsi ; +0x29f, 0x1801273df mov rsi, rax ; +0x2a3, 0x1801273e3 jmp loc_180127350 ; +0x2a6, 0x1801273e6 cmp rsi, rbp ; +0x2ab, 0x1801273eb jnb short loc_180127410 ; +0x2ae, 0x1801273ee sub rbp, r14 ; +0x2b0, 0x1801273f0 cmp rbp, rsi ; +0x2b3, 0x1801273f3 jbe short loc_180127410 ; +0x2b6, 0x1801273f6 mov rdx, rsi ; +0x2b8, 0x1801273f8 mov rcx, rbp ; +0x2bb, 0x1801273fb mov rax, r12 ; +0x2be, 0x1801273fe call cs:__guard_dispatch_icall_fptr ; +0x2c1, 0x180127401 test eax, eax ; +0x2c7, 0x180127407 jz short loc_1801273F0 ; +0x2c9, 0x180127409 jmp short loc_18012742B ; +0x2cb, 0x18012740b align 10h ; +0x2cd, 0x18012740d sub rbp, r14 ; +0x2d0, 0x180127410 cmp rbp, r13 ; +0x2d3, 0x180127413 jbe short loc_18012742B ; +0x2d6, 0x180127416 mov rdx, rsi ; +0x2d8, 0x180127418 mov rcx, rbp ; +0x2db, 0x18012741b mov rax, r12 ; +0x2de, 0x18012741e call cs:__guard_dispatch_icall_fptr ; +0x2e1, 0x180127421 test eax, eax ; +0x2e7, 0x180127427 jz short loc_180127410 ; +0x2e9, 0x180127429 mov rcx, r15 ; +0x2eb, 0x18012742b mov rax, rbp ; +0x2ee, 0x18012742e sub rcx, rbx ; +0x2f1, 0x180127431 sub rax, r13 ; +0x2f4, 0x180127434 cmp rax, rcx ; +0x2f7, 0x180127437 mov rcx, [rsp+468h+var_448] ; +0x2fa, 0x18012743a jl short loc_18012746C ; +0x2ff, 0x18012743f cmp r13, rbp ; +0x301, 0x180127441 jnb short loc_18012745B ; +0x304, 0x180127444 mov [rsp+rcx*8+468h+var_438], r13 ; +0x306, 0x180127446 mov [rsp+rcx*8+468h+var_248], rbp ; +0x30b, 0x18012744b inc rcx ; +0x313, 0x180127453 mov [rsp+468h+var_448], rcx ; +0x316, 0x180127456 cmp rbx, r15 ; +0x31b, 0x18012745b jnb loc_180127263 ; +0x31e, 0x18012745e mov r13, rbx ; +0x324, 0x180127464 jmp $recurse$210 ; +0x327, 0x180127467 cmp rbx, r15 ; +0x32c, 0x18012746c jnb short loc_180127486 ; +0x32f, 0x18012746f mov [rsp+rcx*8+468h+var_438], rbx ; +0x331, 0x180127471 mov [rsp+rcx*8+468h+var_248], r15 ; +0x336, 0x180127476 inc rcx ; +0x33e, 0x18012747e mov [rsp+468h+var_448], rcx ; +0x341, 0x180127481 cmp r13, rbp ; +0x346, 0x180127486 jnb loc_180127263 ; +0x349, 0x180127489 mov r15, rbp ; +0x34f, 0x18012748f jmp $recurse$210 ; +0x352, 0x180127492 mov rdi, [rsp+468h+var_38] ; +0x357, 0x180127497 mov rsi, [rsp+468h+var_30] ; +0x35f, 0x18012749f mov rbp, [rsp+468h+var_28] ; +0x367, 0x1801274a7 mov rbx, [rsp+468h+var_20] ; +0x36f, 0x1801274af mov r15, [rsp+468h+var_40] ; +0x377, 0x1801274b7 mov rcx, [rsp+468h+var_58] ; +0x37f, 0x1801274bf xor rcx, rsp; StackCookie ; +0x387, 0x1801274c7 call __security_check_cookie ; +0x38a, 0x1801274ca add rsp, 450h ; +0x38f, 0x1801274cf pop r14 ; +0x396, 0x1801274d6 pop r13 ; +0x398, 0x1801274d8 pop r12 ; +0x39a, 0x1801274da retn ; +0x39c, 0x1801274dc