; ; sub_180001A10 from 0x180001a10 to 0x180001e8a (1146 bytes) ; ; 2 xrefs: ; > sub_180007790 @ 0x1800077ff ; > @ 0x1801f60d8 ; ; This function is hookable on this platform! ; ; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA ; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings ; push rbp ; +0x0, 0x180001a10 push r12 ; +0x2, 0x180001a12 push r13 ; +0x4, 0x180001a14 push r14 ; +0x6, 0x180001a16 push r15 ; +0x8, 0x180001a18 sub rsp, 40h ; +0xa, 0x180001a1a lea rbp, [rsp+20h] ; +0xe, 0x180001a1e mov [rbp+40h+arg_0], rbx ; +0x13, 0x180001a23 mov [rbp+40h+arg_8], rsi ; +0x17, 0x180001a27 mov [rbp+40h+arg_10], rdi ; +0x1b, 0x180001a2b mov rax, cs:__security_cookie ; +0x1f, 0x180001a2f xor rax, rbp ; +0x26, 0x180001a36 mov [rbp+40h+var_30], rax ; +0x29, 0x180001a39 xorps xmm0, xmm0 ; +0x2d, 0x180001a3d xor eax, eax ; +0x30, 0x180001a40 movups xmmword ptr [rdx], xmm0 ; +0x32, 0x180001a42 mov rdi, rdx ; +0x35, 0x180001a45 xor r15d, r15d ; +0x38, 0x180001a48 movups xmmword ptr [rdx+10h], xmm0 ; +0x3b, 0x180001a4b mov r12, rcx ; +0x3f, 0x180001a4f mov [rbp+40h+var_40], r15d ; +0x42, 0x180001a52 movups xmmword ptr [rdx+20h], xmm0 ; +0x46, 0x180001a56 movups xmmword ptr [rdx+30h], xmm0 ; +0x4a, 0x180001a5a movups xmmword ptr [rdx+40h], xmm0 ; +0x4e, 0x180001a5e movups xmmword ptr [rdx+50h], xmm0 ; +0x52, 0x180001a62 movups xmmword ptr [rdx+60h], xmm0 ; +0x56, 0x180001a66 mov [rdx+70h], rax ; +0x5a, 0x180001a6a lea edx, [rax+18h] ; +0x5e, 0x180001a6e call sub_180001340 ; +0x61, 0x180001a71 cmp eax, 564342h ; +0x66, 0x180001a76 jnz loc_180001E5F ; +0x6b, 0x180001a7b lea edx, [r15+10h] ; +0x71, 0x180001a81 mov rcx, r12 ; +0x75, 0x180001a85 call sub_180001340 ; +0x78, 0x180001a88 lea edx, [r15+18h] ; +0x7d, 0x180001a8d mov [rdi+64h], al ; +0x81, 0x180001a91 mov rcx, r12 ; +0x84, 0x180001a94 call sub_180001340 ; +0x87, 0x180001a97 mov [rdi+60h], ax ; +0x8c, 0x180001a9c cmp ax, 0FFFFh ; +0x90, 0x180001aa0 jz loc_180001E5F ; +0x94, 0x180001aa4 mov r14d, 1 ; +0x9a, 0x180001aaa mov rcx, r12 ; +0xa0, 0x180001ab0 mov edx, r14d ; +0xa3, 0x180001ab3 call sub_180001340 ; +0xa6, 0x180001ab6 test eax, eax ; +0xab, 0x180001abb jz loc_180001C93 ; +0xad, 0x180001abd cmp eax, r14d ; +0xb3, 0x180001ac3 jnz loc_180001E5F ; +0xb6, 0x180001ac6 lea edx, [r15+5] ; +0xbc, 0x180001acc mov rcx, r12 ; +0xc0, 0x180001ad0 call sub_180001340 ; +0xc3, 0x180001ad3 movsx rdx, word ptr [rdi+60h] ; +0xc8, 0x180001ad8 mov r8, 0FFFFFFFFFFFFFF0h ; +0xcd, 0x180001add mov [rdi+62h], dx ; +0xd7, 0x180001ae7 lea r14d, [rax+1] ; +0xdb, 0x180001aeb lea rax, [rdx+0Fh] ; +0xdf, 0x180001aef cmp rax, rdx ; +0xe3, 0x180001af3 ja short loc_180001AFB ; +0xe6, 0x180001af6 mov rax, r8 ; +0xe8, 0x180001af8 and rax, 0FFFFFFFFFFFFFFF0h ; +0xeb, 0x180001afb call __alloca_probe ; +0xef, 0x180001aff sub rsp, rax ; +0xf4, 0x180001b04 mov ebx, r15d ; +0xf7, 0x180001b07 lea r13, [rsp+60h+var_40] ; +0xfa, 0x180001b0a cmp r15w, dx ; +0xff, 0x180001b0f jge short loc_180001B86 ; +0x103, 0x180001b13 mov rsi, r15 ; +0x105, 0x180001b15 nop dword ptr [rax+rax+00000000h] ; +0x108, 0x180001b18 movsx eax, dx ; +0x110, 0x180001b20 mov edx, r15d ; +0x113, 0x180001b23 sub eax, ebx ; +0x116, 0x180001b26 jz short loc_180001B36 ; +0x118, 0x180001b28 nop word ptr [rax+rax+00h] ; +0x11a, 0x180001b2a inc edx ; +0x120, 0x180001b30 shr eax, 1 ; +0x122, 0x180001b32 jnz short loc_180001B30 ; +0x124, 0x180001b34 mov rcx, r12 ; +0x126, 0x180001b36 call sub_180001340 ; +0x129, 0x180001b39 cmp eax, 0FFFFFFFFh ; +0x12e, 0x180001b3e jz loc_180001E5F ; +0x131, 0x180001b41 mov edx, r15d ; +0x137, 0x180001b47 test eax, eax ; +0x13a, 0x180001b4a jle short loc_180001B67 ; +0x13c, 0x180001b4c xchg ax, ax ; +0x13e, 0x180001b4e movsx ecx, word ptr [rdi+60h] ; +0x140, 0x180001b50 cmp ebx, ecx ; +0x144, 0x180001b54 jge short loc_180001B67 ; +0x146, 0x180001b56 mov [rsi+r13], r14b ; +0x148, 0x180001b58 inc edx ; +0x14c, 0x180001b5c inc rsi ; +0x14e, 0x180001b5e inc ebx ; +0x151, 0x180001b61 cmp edx, eax ; +0x153, 0x180001b63 jl short loc_180001B50 ; +0x155, 0x180001b65 movzx ecx, r14b ; +0x157, 0x180001b67 mov [rdi+67h], r14b ; +0x15b, 0x180001b6b mov eax, 1 ; +0x15f, 0x180001b6f inc r14d ; +0x164, 0x180001b74 shl eax, cl ; +0x167, 0x180001b77 dec eax ; +0x169, 0x180001b79 mov [rdi+68h], eax ; +0x16b, 0x180001b7b movsx edx, word ptr [rdi+60h] ; +0x16e, 0x180001b7e cmp ebx, edx ; +0x172, 0x180001b82 jl short loc_180001B20 ; +0x174, 0x180001b84 mov r14d, 1 ; +0x176, 0x180001b86 mov edx, 4 ; +0x17c, 0x180001b8c mov rcx, r12 ; +0x181, 0x180001b91 call sub_180001340 ; +0x184, 0x180001b94 mov esi, eax ; +0x189, 0x180001b99 test eax, eax ; +0x18b, 0x180001b9b jle loc_180001C63 ; +0x18d, 0x180001b9d mov edx, 20h ; ' ' ; +0x193, 0x180001ba3 mov rcx, r12 ; +0x198, 0x180001ba8 call sub_180001340 ; +0x19b, 0x180001bab mov edx, 20h ; ' ' ; +0x1a0, 0x180001bb0 mov rcx, r12 ; +0x1a5, 0x180001bb5 mov ebx, eax ; +0x1a8, 0x180001bb8 call sub_180001340 ; +0x1aa, 0x180001bba mov ecx, ebx ; +0x1af, 0x180001bbf mov [rbp+40h+var_3C], eax ; +0x1b1, 0x180001bc1 and ecx, 1FFFFFh ; +0x1b4, 0x180001bc4 mov edx, ebx ; +0x1ba, 0x180001bca sar edx, 15h ; +0x1bc, 0x180001bcc and edx, 3FFh ; +0x1bf, 0x180001bcf movd xmm0, ecx ; +0x1c5, 0x180001bd5 cvtdq2pd xmm0, xmm0 ; +0x1c9, 0x180001bd9 test ebx, ebx ; +0x1cd, 0x180001bdd jns short loc_180001BE8 ; +0x1cf, 0x180001bdf xorps xmm0, cs:xmmword_1801445D0; X ; +0x1d1, 0x180001be1 add edx, 0FFFFFCECh; Y ; +0x1d8, 0x180001be8 call ldexp ; +0x1de, 0x180001bee mov ecx, [rbp+40h+var_3C] ; +0x1e3, 0x180001bf3 xorps xmm1, xmm1 ; +0x1e6, 0x180001bf6 cvtsd2ss xmm1, xmm0 ; +0x1e9, 0x180001bf9 mov eax, ecx ; +0x1ed, 0x180001bfd mov edx, ecx ; +0x1ef, 0x180001bff and eax, 1FFFFFh ; +0x1f1, 0x180001c01 sar edx, 15h ; +0x1f6, 0x180001c06 and edx, 3FFh ; +0x1f9, 0x180001c09 movd xmm0, eax ; +0x1ff, 0x180001c0f movss dword ptr [rdi+58h], xmm1 ; +0x203, 0x180001c13 cvtdq2pd xmm0, xmm0 ; +0x208, 0x180001c18 test ecx, ecx ; +0x20c, 0x180001c1c jns short loc_180001C27 ; +0x20e, 0x180001c1e xorps xmm0, cs:xmmword_1801445D0; X ; +0x210, 0x180001c20 add edx, 0FFFFFCECh; Y ; +0x217, 0x180001c27 call ldexp ; +0x21d, 0x180001c2d xorps xmm1, xmm1 ; +0x222, 0x180001c32 mov edx, 4 ; +0x225, 0x180001c35 cvtsd2ss xmm1, xmm0 ; +0x22a, 0x180001c3a mov rcx, r12 ; +0x22e, 0x180001c3e movss dword ptr [rdi+5Ch], xmm1 ; +0x231, 0x180001c41 call sub_180001340 ; +0x236, 0x180001c46 inc al ; +0x23b, 0x180001c4b mov edx, r14d ; +0x23d, 0x180001c4d mov rcx, r12 ; +0x240, 0x180001c50 mov [rdi+66h], al ; +0x243, 0x180001c53 call sub_180001340 ; +0x246, 0x180001c56 test eax, eax ; +0x24b, 0x180001c5b jnz loc_180001E5F ; +0x24d, 0x180001c5d mov [rdi+65h], sil ; +0x253, 0x180001c63 mov ecx, esi ; +0x257, 0x180001c67 test esi, esi ; +0x259, 0x180001c69 jz loc_180001E0B ; +0x25b, 0x180001c6b sub ecx, 1 ; +0x261, 0x180001c71 jz loc_180001DA5 ; +0x264, 0x180001c74 cmp ecx, 1 ; +0x26a, 0x180001c7a jz loc_180001E5F ; +0x26d, 0x180001c7d test esi, esi ; +0x273, 0x180001c83 jz loc_180001E0F ; +0x275, 0x180001c85 mov eax, r15d ; +0x27b, 0x180001c8b jmp loc_180001DB5 ; +0x27e, 0x180001c8e movsx rax, word ptr [rdi+60h] ; +0x283, 0x180001c93 mov rdx, 0FFFFFFFFFFFFFF0h ; +0x288, 0x180001c98 lea rcx, [rax+0Fh] ; +0x292, 0x180001ca2 cmp rcx, rax ; +0x296, 0x180001ca6 ja short loc_180001CAE ; +0x299, 0x180001ca9 mov rcx, rdx ; +0x29b, 0x180001cab and rcx, 0FFFFFFFFFFFFFFF0h ; +0x29e, 0x180001cae mov rax, rcx ; +0x2a2, 0x180001cb2 call __alloca_probe ; +0x2a5, 0x180001cb5 sub rsp, rcx ; +0x2aa, 0x180001cba mov edx, r14d ; +0x2ad, 0x180001cbd mov rcx, r12 ; +0x2b0, 0x180001cc0 lea r13, [rsp+60h+var_40] ; +0x2b3, 0x180001cc3 call sub_180001340 ; +0x2b8, 0x180001cc8 movzx ecx, word ptr [rdi+60h] ; +0x2bd, 0x180001ccd test eax, eax ; +0x2c1, 0x180001cd1 jz short loc_180001D42 ; +0x2c3, 0x180001cd3 mov esi, r15d ; +0x2c5, 0x180001cd5 cmp r15w, cx ; +0x2c8, 0x180001cd8 jge loc_180001B8C ; +0x2cc, 0x180001cdc mov rbx, r13 ; +0x2d2, 0x180001ce2 mov edx, r14d ; +0x2d5, 0x180001ce5 mov rcx, r12 ; +0x2d8, 0x180001ce8 call sub_180001340 ; +0x2db, 0x180001ceb test eax, eax ; +0x2e0, 0x180001cf0 jz short loc_180001D2D ; +0x2e2, 0x180001cf2 mov edx, 5 ; +0x2e4, 0x180001cf4 mov rcx, r12 ; +0x2e9, 0x180001cf9 call sub_180001340 ; +0x2ec, 0x180001cfc cmp eax, 0FFFFFFFFh ; +0x2f1, 0x180001d01 jz loc_180001E5F ; +0x2f4, 0x180001d04 lea ecx, [rax+1] ; +0x2fa, 0x180001d0a mov [rbx], cl ; +0x2fd, 0x180001d0d lea edx, [rax+1] ; +0x2ff, 0x180001d0f inc word ptr [rdi+62h] ; +0x302, 0x180001d12 movsx eax, byte ptr [rdi+67h] ; +0x306, 0x180001d16 cmp edx, eax ; +0x30a, 0x180001d1a jle short loc_180001D30 ; +0x30c, 0x180001d1c mov eax, r14d ; +0x30e, 0x180001d1e mov [rdi+67h], cl ; +0x311, 0x180001d21 shl eax, cl ; +0x314, 0x180001d24 dec eax ; +0x316, 0x180001d26 mov [rdi+68h], eax ; +0x318, 0x180001d28 jmp short loc_180001D30 ; +0x31b, 0x180001d2b mov [rbx], r15b ; +0x31d, 0x180001d2d movsx eax, word ptr [rdi+60h] ; +0x320, 0x180001d30 inc esi ; +0x324, 0x180001d34 inc rbx ; +0x326, 0x180001d36 cmp esi, eax ; +0x329, 0x180001d39 jl short loc_180001CE5 ; +0x32b, 0x180001d3b jmp loc_180001B8C ; +0x32d, 0x180001d3d mov [rdi+62h], cx ; +0x332, 0x180001d42 mov ebx, r15d ; +0x336, 0x180001d46 cmp r15w, cx ; +0x339, 0x180001d49 jge loc_180001B8C ; +0x33d, 0x180001d4d mov rsi, r13 ; +0x343, 0x180001d53 nop word ptr [rax+rax+00000000h] ; +0x346, 0x180001d56 mov edx, 5 ; +0x350, 0x180001d60 mov rcx, r12 ; +0x355, 0x180001d65 call sub_180001340 ; +0x358, 0x180001d68 cmp eax, 0FFFFFFFFh ; +0x35d, 0x180001d6d jz loc_180001E5F ; +0x360, 0x180001d70 lea ecx, [rax+1] ; +0x366, 0x180001d76 lea edx, [rax+1] ; +0x369, 0x180001d79 mov [rsi], cl ; +0x36c, 0x180001d7c movsx eax, byte ptr [rdi+67h] ; +0x36e, 0x180001d7e cmp edx, eax ; +0x372, 0x180001d82 jle short loc_180001D93 ; +0x374, 0x180001d84 mov eax, r14d ; +0x376, 0x180001d86 mov [rdi+67h], cl ; +0x379, 0x180001d89 shl eax, cl ; +0x37c, 0x180001d8c dec eax ; +0x37e, 0x180001d8e mov [rdi+68h], eax ; +0x380, 0x180001d90 movsx eax, word ptr [rdi+60h] ; +0x383, 0x180001d93 inc ebx ; +0x387, 0x180001d97 inc rsi ; +0x389, 0x180001d99 cmp ebx, eax ; +0x38c, 0x180001d9c jl short loc_180001D60 ; +0x38e, 0x180001d9e jmp loc_180001B8C ; +0x390, 0x180001da0 movsx edx, byte ptr [rdi+64h] ; +0x395, 0x180001da5 movsx ecx, word ptr [rdi+60h] ; +0x399, 0x180001da9 call sub_1800024C0 ; +0x39d, 0x180001dad mov [rbp+40h+var_40], eax ; +0x3a2, 0x180001db2 movsxd rbx, eax ; +0x3a5, 0x180001db5 lea rcx, [rbx+rbx] ; +0x3a8, 0x180001db8 lea rax, [rcx+0Fh] ; +0x3ac, 0x180001dbc cmp rax, rcx ; +0x3b0, 0x180001dc0 ja short loc_180001DCF ; +0x3b3, 0x180001dc3 mov rax, 0FFFFFFFFFFFFFF0h ; +0x3b5, 0x180001dc5 and rax, 0FFFFFFFFFFFFFFF0h ; +0x3bf, 0x180001dcf call __alloca_probe ; +0x3c3, 0x180001dd3 sub rsp, rax ; +0x3c8, 0x180001dd8 lea rsi, [rsp+60h+var_40] ; +0x3cb, 0x180001ddb test rbx, rbx ; +0x3d0, 0x180001de0 jle short loc_180001E12 ; +0x3d3, 0x180001de3 nop word ptr [rax+rax+00000000h] ; +0x3d5, 0x180001de5 movsx edx, byte ptr [rdi+66h] ; +0x3e0, 0x180001df0 mov rcx, r12 ; +0x3e4, 0x180001df4 call sub_180001340 ; +0x3e7, 0x180001df7 mov [rsi+r15*2], ax ; +0x3ec, 0x180001dfc inc r15 ; +0x3f1, 0x180001e01 cmp r15, rbx ; +0x3f4, 0x180001e04 jl short loc_180001DF0 ; +0x3f7, 0x180001e07 jmp short loc_180001E12 ; +0x3f9, 0x180001e09 mov [rbp+40h+var_40], r15d ; +0x3fb, 0x180001e0b mov rsi, r15 ; +0x3ff, 0x180001e0f movzx ecx, byte ptr [rdi+66h] ; +0x402, 0x180001e12 mov r9, rdi ; +0x406, 0x180001e16 mov edx, [rbp+40h+var_40] ; +0x409, 0x180001e19 mov r8, rsi ; +0x40c, 0x180001e1c shl r14d, cl ; +0x40f, 0x180001e1f mov rcx, r13 ; +0x412, 0x180001e22 lea eax, [r14-1] ; +0x415, 0x180001e25 mov [rdi], eax ; +0x419, 0x180001e29 mov [rdi+4], eax ; +0x41b, 0x180001e2b mov [rdi+8], eax ; +0x41e, 0x180001e2e mov [rdi+0Ch], eax ; +0x421, 0x180001e31 movss xmm0, dword ptr [rdi+58h] ; +0x424, 0x180001e34 shufps xmm0, xmm0, 0 ; +0x429, 0x180001e39 movups xmmword ptr [rdi+10h], xmm0 ; +0x42d, 0x180001e3d movss xmm1, dword ptr [rdi+5Ch] ; +0x431, 0x180001e41 shufps xmm1, xmm1, 0 ; +0x436, 0x180001e46 movups xmmword ptr [rdi+20h], xmm1 ; +0x43a, 0x180001e4a call sub_180001E90 ; +0x43e, 0x180001e4e mov rcx, r12 ; +0x443, 0x180001e53 call sub_180001310 ; +0x446, 0x180001e56 test eax, eax ; +0x44b, 0x180001e5b jz short loc_180001E64 ; +0x44d, 0x180001e5d mov eax, 0FFFFFFFFh ; +0x44f, 0x180001e5f mov rcx, [rbp+40h+var_30] ; +0x454, 0x180001e64 xor rcx, rbp; StackCookie ; +0x458, 0x180001e68 call __security_check_cookie ; +0x45b, 0x180001e6b mov rbx, [rbp+40h+arg_0] ; +0x460, 0x180001e70 mov rsi, [rbp+40h+arg_8] ; +0x464, 0x180001e74 mov rdi, [rbp+40h+arg_10] ; +0x468, 0x180001e78 lea rsp, [rbp+20h] ; +0x46c, 0x180001e7c pop r15 ; +0x470, 0x180001e80 pop r14 ; +0x472, 0x180001e82 pop r13 ; +0x474, 0x180001e84 pop r12 ; +0x476, 0x180001e86 pop rbp ; +0x478, 0x180001e88 retn ; +0x479, 0x180001e89