; ; sub_180001540 from 0x180001540 to 0x180001906 (966 bytes) ; ; 2 xrefs: ; > sub_180007A70 @ 0x180007ab3 ; > @ 0x1801f60cc ; ; This function is hookable on this platform! ; ; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA ; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings ; push rbp ; +0x0, 0x180001540 push r12 ; +0x2, 0x180001542 push r13 ; +0x4, 0x180001544 push r14 ; +0x6, 0x180001546 push r15 ; +0x8, 0x180001548 sub rsp, 40h ; +0xa, 0x18000154a lea rbp, [rsp+20h] ; +0xe, 0x18000154e mov [rbp+40h+arg_0], rbx ; +0x13, 0x180001553 mov [rbp+40h+arg_8], rsi ; +0x17, 0x180001557 mov [rbp+40h+arg_10], rdi ; +0x1b, 0x18000155b mov rax, cs:__security_cookie ; +0x1f, 0x18000155f xor rax, rbp ; +0x26, 0x180001566 mov [rbp+40h+var_30], rax ; +0x29, 0x180001569 xor r12d, r12d ; +0x2d, 0x18000156d mov r15, rcx ; +0x30, 0x180001570 mov r13d, r12d ; +0x33, 0x180001573 lea edx, [r12+18h] ; +0x36, 0x180001576 call sub_180001340 ; +0x3b, 0x18000157b cmp eax, 564342h ; +0x40, 0x180001580 jnz loc_1800018DB ; +0x45, 0x180001585 lea edx, [r12+10h] ; +0x4b, 0x18000158b mov rcx, r15 ; +0x50, 0x180001590 call sub_180001340 ; +0x53, 0x180001593 lea edx, [r12+18h] ; +0x58, 0x180001598 mov [rbp+40h+var_38], eax ; +0x5d, 0x18000159d mov rcx, r15 ; +0x60, 0x1800015a0 call sub_180001340 ; +0x63, 0x1800015a3 movsxd rdi, eax ; +0x68, 0x1800015a8 cmp edi, 0FFFFFFFFh ; +0x6b, 0x1800015ab jz loc_1800018DB ; +0x6e, 0x1800015ae lea edx, [r12+1] ; +0x74, 0x1800015b4 mov rcx, r15 ; +0x79, 0x1800015b9 mov rsi, rdi ; +0x7c, 0x1800015bc call sub_180001340 ; +0x7f, 0x1800015bf test eax, eax ; +0x84, 0x1800015c4 jz loc_1800016D8 ; +0x86, 0x1800015c6 cmp eax, 1 ; +0x8c, 0x1800015cc jnz loc_1800018DB ; +0x8f, 0x1800015cf lea edx, [rax+4] ; +0x95, 0x1800015d5 mov rcx, r15 ; +0x98, 0x1800015d8 call sub_180001340 ; +0x9b, 0x1800015db lea r14d, [rax+1] ; +0xa0, 0x1800015e0 lea rax, [rdi+0Fh] ; +0xa4, 0x1800015e4 cmp rax, rdi ; +0xa8, 0x1800015e8 ja short loc_1800015F7 ; +0xab, 0x1800015eb mov rax, 0FFFFFFFFFFFFFF0h ; +0xad, 0x1800015ed and rax, 0FFFFFFFFFFFFFFF0h ; +0xb7, 0x1800015f7 call __alloca_probe ; +0xbb, 0x1800015fb sub rsp, rax ; +0xc0, 0x180001600 mov edi, r12d ; +0xc3, 0x180001603 lea r13, [rsp+60h+var_40] ; +0xc6, 0x180001606 test rsi, rsi ; +0xcb, 0x18000160b jle short loc_18000165C ; +0xce, 0x18000160e mov rbx, r12 ; +0xd0, 0x180001610 mov eax, esi ; +0xd3, 0x180001613 mov edx, r12d ; +0xd5, 0x180001615 sub eax, edi ; +0xd8, 0x180001618 jz short loc_180001626 ; +0xda, 0x18000161a nop dword ptr [rax+00h] ; +0xdc, 0x18000161c inc edx ; +0xe0, 0x180001620 shr eax, 1 ; +0xe2, 0x180001622 jnz short loc_180001620 ; +0xe4, 0x180001624 mov rcx, r15 ; +0xe6, 0x180001626 call sub_180001340 ; +0xe9, 0x180001629 cmp eax, 0FFFFFFFFh ; +0xee, 0x18000162e jz loc_1800018DB ; +0xf1, 0x180001631 mov ecx, r12d ; +0xf7, 0x180001637 test eax, eax ; +0xfa, 0x18000163a jle short loc_180001654 ; +0xfc, 0x18000163c xchg ax, ax ; +0xfe, 0x18000163e cmp rbx, rsi ; +0x100, 0x180001640 jge short loc_180001654 ; +0x103, 0x180001643 mov [rbx+r13], r14b ; +0x105, 0x180001645 inc ecx ; +0x109, 0x180001649 inc rbx ; +0x10b, 0x18000164b inc edi ; +0x10e, 0x18000164e cmp ecx, eax ; +0x110, 0x180001650 jl short loc_180001640 ; +0x112, 0x180001652 inc r14d ; +0x114, 0x180001654 cmp rbx, rsi ; +0x117, 0x180001657 jl short loc_180001613 ; +0x11a, 0x18000165a mov r13d, esi ; +0x11c, 0x18000165c mov edi, esi ; +0x11f, 0x18000165f mov edx, 4 ; +0x121, 0x180001661 mov rcx, r15 ; +0x126, 0x180001666 call sub_180001340 ; +0x129, 0x180001669 mov ebx, eax ; +0x12e, 0x18000166e test eax, eax ; +0x130, 0x180001670 jle loc_1800017A9 ; +0x132, 0x180001672 mov r9d, [r15+10h] ; +0x138, 0x180001678 mov edx, 4 ; +0x13c, 0x18000167c add r9d, 20h ; ' ' ; +0x141, 0x180001681 mov r8d, r9d ; +0x145, 0x180001685 movsxd rax, r9d ; +0x148, 0x180001688 and r8d, 7 ; +0x14b, 0x18000168b sar rax, 3 ; +0x14f, 0x18000168f add r8d, 20h ; ' ' ; +0x153, 0x180001693 mov ecx, r8d ; +0x157, 0x180001697 and ecx, 7 ; +0x15a, 0x18000169a mov [r15+10h], ecx ; +0x15d, 0x18000169d mov ecx, r8d ; +0x161, 0x1800016a1 shr rcx, 3 ; +0x164, 0x1800016a4 add rcx, rax ; +0x168, 0x1800016a8 add [r15], rcx ; +0x16b, 0x1800016ab mov rcx, r15 ; +0x16e, 0x1800016ae call sub_180001340 ; +0x171, 0x1800016b1 mov edx, [r15+10h] ; +0x176, 0x1800016b6 inc edx ; +0x17a, 0x1800016ba mov ecx, edx ; +0x17c, 0x1800016bc and ecx, 7 ; +0x17e, 0x1800016be lea r11d, [rax+1] ; +0x181, 0x1800016c1 mov [r15+10h], ecx ; +0x185, 0x1800016c5 movsxd rcx, edx ; +0x189, 0x1800016c9 sar rcx, 3 ; +0x18c, 0x1800016cc add [r15], rcx ; +0x190, 0x1800016d0 jmp loc_1800017AC ; +0x193, 0x1800016d3 lea rax, [rdi+0Fh] ; +0x198, 0x1800016d8 cmp rax, rsi ; +0x19c, 0x1800016dc ja short loc_1800016EB ; +0x19f, 0x1800016df mov rax, 0FFFFFFFFFFFFFF0h ; +0x1a1, 0x1800016e1 and rax, 0FFFFFFFFFFFFFFF0h ; +0x1ab, 0x1800016eb call __alloca_probe ; +0x1af, 0x1800016ef sub rsp, rax ; +0x1b4, 0x1800016f4 mov edx, 1 ; +0x1b7, 0x1800016f7 mov rcx, r15 ; +0x1bc, 0x1800016fc lea r14, [rsp+60h+var_40] ; +0x1bf, 0x1800016ff call sub_180001340 ; +0x1c4, 0x180001704 test eax, eax ; +0x1c9, 0x180001709 jz short loc_180001768 ; +0x1cb, 0x18000170b test edi, edi ; +0x1cd, 0x18000170d jle loc_180001661 ; +0x1cf, 0x18000170f mov rbx, r14 ; +0x1d5, 0x180001715 nop dword ptr [rax+rax+00000000h] ; +0x1d8, 0x180001718 mov edx, 1 ; +0x1e0, 0x180001720 mov rcx, r15 ; +0x1e5, 0x180001725 call sub_180001340 ; +0x1e8, 0x180001728 test eax, eax ; +0x1ed, 0x18000172d jz short loc_18000174E ; +0x1ef, 0x18000172f mov edx, 5 ; +0x1f1, 0x180001731 mov rcx, r15 ; +0x1f6, 0x180001736 call sub_180001340 ; +0x1f9, 0x180001739 cmp eax, 0FFFFFFFFh ; +0x1fe, 0x18000173e jz loc_1800018DB ; +0x201, 0x180001741 inc r13d ; +0x207, 0x180001747 inc al ; +0x20a, 0x18000174a jmp short loc_180001750 ; +0x20c, 0x18000174c xor al, al ; +0x20e, 0x18000174e mov [rbx], al ; +0x210, 0x180001750 mov rcx, rbx ; +0x212, 0x180001752 inc rbx ; +0x215, 0x180001755 mov rax, rbx ; +0x218, 0x180001758 sub rax, r14 ; +0x21b, 0x18000175b cmp rax, rsi ; +0x21e, 0x18000175e jl short loc_180001720 ; +0x221, 0x180001761 jmp loc_180001661 ; +0x223, 0x180001763 mov r13d, edi ; +0x228, 0x180001768 test edi, edi ; +0x22b, 0x18000176b jle loc_180001661 ; +0x22d, 0x18000176d mov rbx, r12 ; +0x233, 0x180001773 nop word ptr [rax+rax+00000000h] ; +0x236, 0x180001776 mov edx, 5 ; +0x240, 0x180001780 mov rcx, r15 ; +0x245, 0x180001785 call sub_180001340 ; +0x248, 0x180001788 cmp eax, 0FFFFFFFFh ; +0x24d, 0x18000178d jz loc_1800018DB ; +0x250, 0x180001790 inc al ; +0x256, 0x180001796 mov [rbx+r14], al ; +0x258, 0x180001798 inc rbx ; +0x25c, 0x18000179c cmp rbx, rsi ; +0x25f, 0x18000179f jl short loc_180001780 ; +0x262, 0x1800017a2 jmp loc_180001661 ; +0x264, 0x1800017a4 mov r11d, r12d ; +0x269, 0x1800017a9 test ebx, ebx ; +0x26c, 0x1800017ac jz loc_18000186D ; +0x26e, 0x1800017ae sub ebx, 1 ; +0x274, 0x1800017b4 jz short loc_1800017C8 ; +0x277, 0x1800017b7 cmp ebx, 1 ; +0x279, 0x1800017b9 jnz loc_18000186D ; +0x27c, 0x1800017bc imul edi, [rbp+40h+var_38] ; +0x282, 0x1800017c2 jmp short loc_180001847 ; +0x286, 0x1800017c6 mov ecx, edi ; +0x288, 0x1800017c8 mov eax, r12d ; +0x28a, 0x1800017ca test edi, edi ; +0x28d, 0x1800017cd jz short loc_1800017D7 ; +0x28f, 0x1800017cf inc eax ; +0x291, 0x1800017d1 shr ecx, 1 ; +0x293, 0x1800017d3 jnz short loc_1800017D1 ; +0x295, 0x1800017d5 mov r10d, [rbp+40h+var_38] ; +0x297, 0x1800017d7 dec eax ; +0x29b, 0x1800017db mov r8d, edi ; +0x29d, 0x1800017dd lea ecx, [r10-1] ; +0x2a0, 0x1800017e0 imul eax, ecx ; +0x2a4, 0x1800017e4 cdq ; +0x2a7, 0x1800017e7 idiv r10d ; +0x2a8, 0x1800017e8 mov ecx, eax ; +0x2ab, 0x1800017eb sar r8d, cl ; +0x2ad, 0x1800017ed lea r9d, [r8+1] ; +0x2b0, 0x1800017f0 mov eax, 1 ; +0x2b4, 0x1800017f4 mov ecx, eax ; +0x2b9, 0x1800017f9 test r10d, r10d ; +0x2bb, 0x1800017fb jle short loc_18000181E ; +0x2be, 0x1800017fe mov rdx, r10 ; +0x2c0, 0x180001800 nop dword ptr [rax+00h] ; +0x2c3, 0x180001803 nop word ptr [rax+rax+00000000h] ; +0x2c7, 0x180001807 imul eax, r8d ; +0x2d0, 0x180001810 imul ecx, r9d ; +0x2d4, 0x180001814 sub rdx, 1 ; +0x2d8, 0x180001818 jnz short loc_180001810 ; +0x2dc, 0x18000181c cmp eax, edi ; +0x2de, 0x18000181e jg short loc_180001835 ; +0x2e0, 0x180001820 cmp ecx, edi ; +0x2e2, 0x180001822 jg short loc_180001844 ; +0x2e4, 0x180001824 mov eax, 1 ; +0x2e6, 0x180001826 add r9d, eax ; +0x2eb, 0x18000182b mov ecx, eax ; +0x2ee, 0x18000182e add r8d, eax ; +0x2f0, 0x180001830 jmp short loc_1800017F4 ; +0x2f3, 0x180001833 mov eax, 0FFFFFFFFh ; +0x2f5, 0x180001835 add r9d, eax ; +0x2fa, 0x18000183a mov ecx, eax ; +0x2fd, 0x18000183d add r8d, eax ; +0x2ff, 0x18000183f jmp short loc_1800017F4 ; +0x302, 0x180001842 mov edi, r8d ; +0x304, 0x180001844 test edi, edi ; +0x307, 0x180001847 jle short loc_18000186D ; +0x309, 0x180001849 mov ecx, [r15+10h] ; +0x30b, 0x18000184b mov edx, edi ; +0x30f, 0x18000184f lea eax, [rcx+r11] ; +0x311, 0x180001851 mov ecx, eax ; +0x315, 0x180001855 cdqe ; +0x317, 0x180001857 sar rax, 3 ; +0x319, 0x180001859 and ecx, 7 ; +0x31d, 0x18000185d add [r15], rax ; +0x320, 0x180001860 sub rdx, 1 ; +0x323, 0x180001863 jnz short loc_180001851 ; +0x327, 0x180001867 mov [r15+10h], ecx ; +0x329, 0x180001869 lea eax, ds:13h[r13*4] ; +0x32d, 0x18000186d and eax, 0FFFFFFF0h ; +0x335, 0x180001875 lea ecx, ds:0Fh[r13*2] ; +0x338, 0x180001878 add ecx, eax ; +0x340, 0x180001880 lea ebx, [r13+10h] ; +0x342, 0x180001882 and ecx, 0FFFFFFF0h ; +0x346, 0x180001886 add ebx, ecx ; +0x349, 0x180001889 and ebx, 0FFFFFFF0h ; +0x34b, 0x18000188b test r13d, r13d ; +0x34e, 0x18000188e jz short loc_18000189B ; +0x351, 0x180001891 inc r12d ; +0x353, 0x180001893 shr r13d, 1 ; +0x356, 0x180001896 jnz short loc_180001893 ; +0x359, 0x180001899 lea eax, [r12+r12*4] ; +0x35b, 0x18000189b cdq ; +0x35f, 0x18000189f and edx, 3 ; +0x360, 0x1800018a0 add eax, edx ; +0x363, 0x1800018a3 sar eax, 2 ; +0x365, 0x1800018a5 cmp eax, 5 ; +0x368, 0x1800018a8 jge short loc_1800018B4 ; +0x36b, 0x1800018ab mov edi, 5 ; +0x36d, 0x1800018ad jmp short loc_1800018C0 ; +0x372, 0x1800018b2 mov ecx, 8 ; +0x374, 0x1800018b4 mov edi, eax ; +0x379, 0x1800018b9 cmp eax, ecx ; +0x37b, 0x1800018bb cmovg edi, ecx ; +0x37d, 0x1800018bd mov rcx, r15 ; +0x380, 0x1800018c0 call sub_180001310 ; +0x383, 0x1800018c3 test eax, eax ; +0x388, 0x1800018c8 jnz short loc_1800018DB ; +0x38a, 0x1800018ca movzx ecx, dil ; +0x38c, 0x1800018cc mov eax, 2 ; +0x390, 0x1800018d0 shl eax, cl ; +0x395, 0x1800018d5 add eax, ebx ; +0x397, 0x1800018d7 jmp short loc_1800018E0 ; +0x399, 0x1800018d9 mov eax, 0FFFFFFFFh ; +0x39b, 0x1800018db mov rcx, [rbp+40h+var_30] ; +0x3a0, 0x1800018e0 xor rcx, rbp; StackCookie ; +0x3a4, 0x1800018e4 call __security_check_cookie ; +0x3a7, 0x1800018e7 mov rbx, [rbp+40h+arg_0] ; +0x3ac, 0x1800018ec mov rsi, [rbp+40h+arg_8] ; +0x3b0, 0x1800018f0 mov rdi, [rbp+40h+arg_10] ; +0x3b4, 0x1800018f4 lea rsp, [rbp+20h] ; +0x3b8, 0x1800018f8 pop r15 ; +0x3bc, 0x1800018fc pop r14 ; +0x3be, 0x1800018fe pop r13 ; +0x3c0, 0x180001900 pop r12 ; +0x3c2, 0x180001902 pop rbp ; +0x3c4, 0x180001904 retn ; +0x3c5, 0x180001905