; ; sub_180001E90 from 0x180001e90 to 0x1800024c0 (1584 bytes) ; ; 2 xrefs: ; > sub_180001A10 @ 0x180001e4e ; > @ 0x1801f60e4 ; ; This function is hookable on this platform! ; ; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA ; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings ; push rbp ; +0x0, 0x180001e90 push r12 ; +0x2, 0x180001e92 push r13 ; +0x4, 0x180001e94 push r14 ; +0x6, 0x180001e96 push r15 ; +0x8, 0x180001e98 sub rsp, 40h ; +0xa, 0x180001e9a lea rbp, [rsp+20h] ; +0xe, 0x180001e9e mov [rbp+40h+arg_0], rbx ; +0x13, 0x180001ea3 mov [rbp+40h+arg_8], rsi ; +0x17, 0x180001ea7 mov [rbp+40h+arg_10], rdi ; +0x1b, 0x180001eab mov rax, cs:__security_cookie ; +0x1f, 0x180001eaf xor rax, rbp ; +0x26, 0x180001eb6 mov [rbp+40h+var_28], rax ; +0x29, 0x180001eb9 mov rbx, r9 ; +0x2d, 0x180001ebd mov [rbp+40h+Base], r8 ; +0x30, 0x180001ec0 movsx r9, word ptr [r9+62h] ; +0x34, 0x180001ec4 mov r14d, edx ; +0x39, 0x180001ec9 mov [rbp+40h+var_30], rcx ; +0x3c, 0x180001ecc mov r13, rcx ; +0x40, 0x180001ed0 test r9w, r9w ; +0x43, 0x180001ed3 jle loc_180002498 ; +0x47, 0x180001ed7 mov rax, r9 ; +0x4d, 0x180001edd mov rsi, 0FFFFFFFFFFFFFF0h ; +0x50, 0x180001ee0 shl rax, 2 ; +0x5a, 0x180001eea lea rdx, [rax+0Fh] ; +0x5e, 0x180001eee cmp rdx, rax ; +0x62, 0x180001ef2 ja short loc_180001EFA ; +0x65, 0x180001ef5 mov rdx, rsi ; +0x67, 0x180001ef7 and rdx, 0FFFFFFFFFFFFFFF0h ; +0x6a, 0x180001efa mov rax, rdx ; +0x6e, 0x180001efe call __alloca_probe ; +0x71, 0x180001f01 movsx r8d, word ptr [rbx+60h] ; +0x76, 0x180001f06 sub rsp, rdx ; +0x7b, 0x180001f0b mov rdx, r13 ; +0x7e, 0x180001f0e lea r15, [rsp+60h+Base] ; +0x81, 0x180001f11 mov rcx, r15 ; +0x86, 0x180001f16 call sub_180002550 ; +0x89, 0x180001f19 movsx rdx, word ptr [rbx+62h] ; +0x8e, 0x180001f1e mov r8d, eax ; +0x93, 0x180001f23 mov rcx, rdx ; +0x96, 0x180001f26 shl rcx, 3 ; +0x99, 0x180001f29 lea rax, [rcx+0Fh] ; +0x9d, 0x180001f2d cmp rax, rcx ; +0xa1, 0x180001f31 ja short loc_180001F39 ; +0xa4, 0x180001f34 mov rax, rsi ; +0xa6, 0x180001f36 and rax, 0FFFFFFFFFFFFFFF0h ; +0xa9, 0x180001f39 call __alloca_probe ; +0xad, 0x180001f3d sub rsp, rax ; +0xb2, 0x180001f42 lea r12, [rsp+60h+Base] ; +0xb5, 0x180001f45 test r8d, r8d ; +0xba, 0x180001f4a jns short loc_180001F59 ; +0xbd, 0x180001f4d mov eax, 0FFFFFFFFh ; +0xbf, 0x180001f4f jmp loc_18000249A ; +0xc4, 0x180001f54 xor edi, edi ; +0xc9, 0x180001f59 mov r10d, edi ; +0xcb, 0x180001f5b cmp di, dx ; +0xce, 0x180001f5e jge loc_180001FF0 ; +0xd1, 0x180001f61 nop word ptr [rax+rax+00000000h] ; +0xd7, 0x180001f67 movsxd r9, r10d ; +0xe0, 0x180001f70 inc r10d ; +0xe3, 0x180001f73 mov ecx, [r15+r9*4] ; +0xe6, 0x180001f76 lea r8, [r15+r9*4] ; +0xea, 0x180001f7a rol ecx, 10h ; +0xee, 0x180001f7e mov edx, ecx ; +0xf1, 0x180001f81 mov eax, ecx ; +0xf3, 0x180001f83 shl ecx, 8 ; +0xf5, 0x180001f85 shr edx, 8 ; +0xf8, 0x180001f88 shl eax, 8 ; +0xfb, 0x180001f8b xor edx, eax ; +0xfe, 0x180001f8e and edx, 0FF00FFh ; +0x100, 0x180001f90 xor edx, ecx ; +0x106, 0x180001f96 mov ecx, edx ; +0x108, 0x180001f98 mov eax, edx ; +0x10a, 0x180001f9a shr ecx, 4 ; +0x10c, 0x180001f9c shl edx, 4 ; +0x10f, 0x180001f9f shl eax, 4 ; +0x112, 0x180001fa2 xor ecx, eax ; +0x115, 0x180001fa5 and ecx, 0F0F0F0Fh ; +0x117, 0x180001fa7 xor ecx, edx ; +0x11d, 0x180001fad mov edx, ecx ; +0x11f, 0x180001faf shr edx, 2 ; +0x121, 0x180001fb1 lea eax, ds:0[rcx*4] ; +0x124, 0x180001fb4 xor edx, eax ; +0x12b, 0x180001fbb lea eax, ds:0[rcx*4] ; +0x12d, 0x180001fbd and edx, 33333333h ; +0x134, 0x180001fc4 xor edx, eax ; +0x13a, 0x180001fca mov ecx, edx ; +0x13c, 0x180001fcc shr ecx, 1 ; +0x13e, 0x180001fce lea eax, [rdx+rdx] ; +0x140, 0x180001fd0 xor ecx, eax ; +0x143, 0x180001fd3 lea eax, [rdx+rdx] ; +0x145, 0x180001fd5 and ecx, 55555555h ; +0x148, 0x180001fd8 xor ecx, eax ; +0x14e, 0x180001fde mov [r8], ecx ; +0x150, 0x180001fe0 mov [r12+r9*8], r8 ; +0x153, 0x180001fe3 movsx edx, word ptr [rbx+62h] ; +0x157, 0x180001fe7 cmp r10d, edx ; +0x15b, 0x180001feb jl short loc_180001F70 ; +0x15e, 0x180001fee movsx rdx, dx; NumOfElements ; +0x160, 0x180001ff0 lea r9, CompareFunction; CompareFunction ; +0x164, 0x180001ff4 mov r8d, 8; SizeOfElements ; +0x16b, 0x180001ffb mov rcx, r12; Base ; +0x171, 0x180002001 call qsort ; +0x174, 0x180002004 movsx rcx, word ptr [rbx+62h] ; +0x179, 0x180002009 mov rax, rcx ; +0x17e, 0x18000200e shl rax, 2 ; +0x181, 0x180002011 lea rdx, [rax+0Fh] ; +0x185, 0x180002015 cmp rdx, rax ; +0x189, 0x180002019 ja short loc_180002021 ; +0x18c, 0x18000201c mov rdx, rsi ; +0x18e, 0x18000201e and rdx, 0FFFFFFFFFFFFFFF0h ; +0x191, 0x180002021 mov rax, rdx ; +0x195, 0x180002025 call __alloca_probe ; +0x198, 0x180002028 sub rsp, rdx ; +0x19d, 0x18000202d mov edx, edi ; +0x1a0, 0x180002030 lea rsi, [rsp+60h+Base] ; +0x1a2, 0x180002032 mov [rbp+40h+var_38], rsi ; +0x1a7, 0x180002037 cmp di, cx ; +0x1ab, 0x18000203b jge short loc_18000205D ; +0x1ae, 0x18000203e movsxd rax, edx ; +0x1b0, 0x180002040 mov rax, [r12+rax*8] ; +0x1b3, 0x180002043 sub rax, r15 ; +0x1b7, 0x180002047 sar rax, 2 ; +0x1ba, 0x18000204a cdqe ; +0x1be, 0x18000204e mov [rsi+rax*4], edx ; +0x1c0, 0x180002050 inc edx ; +0x1c3, 0x180002053 movsx ecx, word ptr [rbx+62h] ; +0x1c5, 0x180002055 cmp edx, ecx ; +0x1c9, 0x180002059 jl short loc_180002040 ; +0x1cb, 0x18000205b movsx edx, cx ; +0x1cd, 0x18000205d mov ecx, 10h ; +0x1d0, 0x180002060 lea edx, ds:4[rdx*4] ; +0x1d5, 0x180002065 call sub_180018340 ; +0x1dc, 0x18000206c movzx ecx, word ptr [rbx+62h] ; +0x1e1, 0x180002071 mov r8d, edi ; +0x1e5, 0x180002075 mov [rbx+40h], rax ; +0x1e8, 0x180002078 cmp di, cx ; +0x1ec, 0x18000207c jge short loc_18000209F ; +0x1ef, 0x18000207f mov rcx, [rbx+40h] ; +0x1f1, 0x180002081 movsxd rax, r8d ; +0x1f5, 0x180002085 inc r8d ; +0x1f8, 0x180002088 movsxd rdx, dword ptr [rsi+rax*4] ; +0x1fb, 0x18000208b mov eax, [r15+rax*4] ; +0x1ff, 0x18000208f mov [rcx+rdx*4], eax ; +0x203, 0x180002093 movsx ecx, word ptr [rbx+62h] ; +0x206, 0x180002096 cmp r8d, ecx ; +0x20a, 0x18000209a jl short loc_180002081 ; +0x20d, 0x18000209d movsx eax, cx ; +0x20f, 0x18000209f add eax, 4 ; +0x212, 0x1800020a2 and eax, 0FFFFFFFCh ; +0x215, 0x1800020a5 cmp r8d, eax ; +0x218, 0x1800020a8 jge short loc_1800020D0 ; +0x21b, 0x1800020ab nop dword ptr [rax] ; +0x21d, 0x1800020ad mov rax, [rbx+40h] ; +0x220, 0x1800020b0 movsxd rcx, r8d ; +0x224, 0x1800020b4 inc r8d ; +0x227, 0x1800020b7 mov dword ptr [rax+rcx*4], 0FFFFFFFFh ; +0x22a, 0x1800020ba movsx ecx, word ptr [rbx+62h] ; +0x231, 0x1800020c1 lea eax, [rcx+4] ; +0x235, 0x1800020c5 and eax, 0FFFFFFFCh ; +0x238, 0x1800020c8 cmp r8d, eax ; +0x23b, 0x1800020cb jl short loc_1800020B0 ; +0x23e, 0x1800020ce movsx edx, cx ; +0x240, 0x1800020d0 mov ecx, 10h ; +0x243, 0x1800020d3 add edx, edx ; +0x248, 0x1800020d8 cmp [rbx+65h], dil ; +0x24a, 0x1800020da jz loc_180002180 ; +0x24e, 0x1800020de call sub_180018340 ; +0x254, 0x1800020e4 mov r11d, edi ; +0x259, 0x1800020e9 mov [rbx+48h], rax ; +0x25c, 0x1800020ec cmp di, [rbx+60h] ; +0x260, 0x1800020f0 jge loc_1800021B6 ; +0x264, 0x1800020f4 mov r12, r13 ; +0x26a, 0x1800020fa mov r13, rsi ; +0x26d, 0x1800020fd mov rsi, [rbp+40h+Base] ; +0x270, 0x180002100 cmp [r12], dil ; +0x274, 0x180002104 jz short loc_180002167 ; +0x278, 0x180002108 movsx eax, byte ptr [rbx+64h] ; +0x27a, 0x18000210a mov r8d, 1 ; +0x27e, 0x18000210e movzx r9d, di ; +0x284, 0x180002114 test eax, eax ; +0x288, 0x180002118 jle short loc_180002156 ; +0x28a, 0x18000211a movsx r15d, byte ptr [rbx+66h] ; +0x28c, 0x18000211c mov ecx, edi ; +0x291, 0x180002121 mov r10d, eax ; +0x293, 0x180002123 nop word ptr [rax+rax+00000000h] ; +0x296, 0x180002126 mov eax, r11d ; +0x2a0, 0x180002130 cdq ; +0x2a3, 0x180002133 idiv r8d ; +0x2a4, 0x180002134 imul r8d, r14d ; +0x2a7, 0x180002137 cdq ; +0x2ab, 0x18000213b idiv r14d ; +0x2ac, 0x18000213c movsxd rax, edx ; +0x2af, 0x18000213f movzx edx, word ptr [rsi+rax*2] ; +0x2b2, 0x180002142 shl dx, cl ; +0x2b6, 0x180002146 add ecx, r15d ; +0x2b9, 0x180002149 or r9w, dx ; +0x2bc, 0x18000214c sub r10, 1 ; +0x2c0, 0x180002150 jnz short loc_180002130 ; +0x2c4, 0x180002154 movsxd rcx, dword ptr [r13+0] ; +0x2c6, 0x180002156 add r13, 4 ; +0x2ca, 0x18000215a mov rax, [rbx+48h] ; +0x2ce, 0x18000215e mov [rax+rcx*2], r9w ; +0x2d2, 0x180002162 movsx eax, word ptr [rbx+60h] ; +0x2d7, 0x180002167 inc r11d ; +0x2db, 0x18000216b inc r12 ; +0x2de, 0x18000216e cmp r11d, eax ; +0x2e1, 0x180002171 jl short loc_180002104 ; +0x2e4, 0x180002174 mov rsi, [rbp+40h+var_38] ; +0x2e6, 0x180002176 mov r13, [rbp+40h+var_30] ; +0x2ea, 0x18000217a jmp short loc_1800021B6 ; +0x2ee, 0x18000217e call sub_180018340 ; +0x2f0, 0x180002180 mov edx, edi ; +0x2f5, 0x180002185 mov [rbx+50h], rax ; +0x2f7, 0x180002187 cmp di, [rbx+60h] ; +0x2fb, 0x18000218b jge short loc_1800021B6 ; +0x2ff, 0x18000218f mov r8, rsi ; +0x301, 0x180002191 movsxd rax, edx ; +0x304, 0x180002194 cmp [rax+r13], dil ; +0x307, 0x180002197 jle short loc_1800021AC ; +0x30b, 0x18000219b movsxd rcx, dword ptr [r8] ; +0x30d, 0x18000219d add r8, 4 ; +0x310, 0x1800021a0 mov rax, [rbx+50h] ; +0x314, 0x1800021a4 mov [rax+rcx*2], dx ; +0x318, 0x1800021a8 movsx eax, word ptr [rbx+60h] ; +0x31c, 0x1800021ac inc edx ; +0x320, 0x1800021b0 cmp edx, eax ; +0x322, 0x1800021b2 jl short loc_180002194 ; +0x324, 0x1800021b4 movsx edx, word ptr [rbx+62h] ; +0x326, 0x1800021b6 mov ecx, 10h ; +0x32a, 0x1800021ba inc edx ; +0x32f, 0x1800021bf call sub_180018340 ; +0x331, 0x1800021c1 mov edx, edi ; +0x336, 0x1800021c6 mov [rbx+38h], rax ; +0x338, 0x1800021c8 cmp di, [rbx+60h] ; +0x33c, 0x1800021cc jge short loc_1800021F8 ; +0x340, 0x1800021d0 movsxd rax, edx ; +0x342, 0x1800021d2 movzx r8d, byte ptr [rax+r13] ; +0x345, 0x1800021d5 test r8b, r8b ; +0x34a, 0x1800021da jle short loc_1800021EE ; +0x34d, 0x1800021dd movsxd rcx, dword ptr [rsi] ; +0x34f, 0x1800021df add rsi, 4 ; +0x352, 0x1800021e2 mov rax, [rbx+38h] ; +0x356, 0x1800021e6 mov [rcx+rax], r8b ; +0x35a, 0x1800021ea movsx eax, word ptr [rbx+60h] ; +0x35e, 0x1800021ee inc edx ; +0x362, 0x1800021f2 cmp edx, eax ; +0x364, 0x1800021f4 jl short loc_1800021D2 ; +0x366, 0x1800021f6 movsx ecx, word ptr [rbx+62h] ; +0x368, 0x1800021f8 mov eax, edi ; +0x36c, 0x1800021fc test ecx, ecx ; +0x36e, 0x1800021fe jz short loc_180002208 ; +0x370, 0x180002200 inc eax ; +0x372, 0x180002202 shr ecx, 1 ; +0x374, 0x180002204 jnz short loc_180002202 ; +0x376, 0x180002206 lea eax, [rax+rax*4] ; +0x378, 0x180002208 cdq ; +0x37b, 0x18000220b and edx, 3 ; +0x37c, 0x18000220c add eax, edx ; +0x37f, 0x18000220f sar eax, 2 ; +0x381, 0x180002211 cmp eax, 5 ; +0x384, 0x180002214 jge short loc_180002220 ; +0x387, 0x180002217 mov eax, 5 ; +0x389, 0x180002219 jmp short loc_18000222B ; +0x38e, 0x18000221e cmp eax, 8 ; +0x390, 0x180002220 mov ecx, 8 ; +0x393, 0x180002223 cmovg eax, ecx ; +0x398, 0x180002228 movsx ecx, al ; +0x39b, 0x18000222b mov r15d, 1 ; +0x39e, 0x18000222e shl r15d, cl ; +0x3a4, 0x180002234 mov [rbx+6Ch], ecx ; +0x3a7, 0x180002237 mov ecx, 10h ; +0x3aa, 0x18000223a lea eax, [r15-1] ; +0x3af, 0x18000223f lea edx, [r15+r15] ; +0x3b3, 0x180002243 mov [rbx+70h], eax ; +0x3b7, 0x180002247 call sub_180018340 ; +0x3ba, 0x18000224a movsxd r8, r15d ; +0x3bf, 0x18000224f xor edx, edx; Val ; +0x3c2, 0x180002252 add r8, r8; Size ; +0x3c4, 0x180002254 mov [rbx+30h], rax ; +0x3c7, 0x180002257 mov rcx, rax; void * ; +0x3cb, 0x18000225b call memset ; +0x3ce, 0x18000225e movzx ecx, word ptr [rbx+62h] ; +0x3d3, 0x180002263 mov r11d, edi ; +0x3d7, 0x180002267 cmp di, cx ; +0x3da, 0x18000226a jge loc_18000236B ; +0x3dd, 0x18000226d nop dword ptr [rax+00h] ; +0x3e3, 0x180002273 nop word ptr [rax+rax+00000000h] ; +0x3e7, 0x180002277 mov rax, [rbx+38h] ; +0x3f0, 0x180002280 mov r10d, [rbx+6Ch] ; +0x3f4, 0x180002284 movsxd r9, r11d ; +0x3f8, 0x180002288 movsx r14d, byte ptr [r9+rax] ; +0x3fb, 0x18000228b cmp r14d, r10d ; +0x400, 0x180002290 jg loc_18000235B ; +0x403, 0x180002293 mov rax, [rbx+40h] ; +0x409, 0x180002299 sub r10d, r14d ; +0x40d, 0x18000229d mov r8d, edi ; +0x410, 0x1800022a0 mov ecx, [rax+r9*4] ; +0x413, 0x1800022a3 rol ecx, 10h ; +0x417, 0x1800022a7 mov edx, ecx ; +0x41a, 0x1800022aa mov eax, ecx ; +0x41c, 0x1800022ac shr edx, 8 ; +0x41e, 0x1800022ae shl eax, 8 ; +0x421, 0x1800022b1 xor edx, eax ; +0x424, 0x1800022b4 shl ecx, 8 ; +0x426, 0x1800022b6 and edx, 0FF00FFh ; +0x429, 0x1800022b9 xor edx, ecx ; +0x42f, 0x1800022bf mov ecx, edx ; +0x431, 0x1800022c1 mov eax, edx ; +0x433, 0x1800022c3 shl eax, 4 ; +0x435, 0x1800022c5 shl edx, 4 ; +0x438, 0x1800022c8 shr ecx, 4 ; +0x43b, 0x1800022cb xor ecx, eax ; +0x43e, 0x1800022ce and ecx, 0F0F0F0Fh ; +0x440, 0x1800022d0 xor ecx, edx ; +0x446, 0x1800022d6 mov edx, ecx ; +0x448, 0x1800022d8 shr edx, 2 ; +0x44a, 0x1800022da lea eax, ds:0[rcx*4] ; +0x44d, 0x1800022dd xor edx, eax ; +0x454, 0x1800022e4 lea eax, ds:0[rcx*4] ; +0x456, 0x1800022e6 and edx, 33333333h ; +0x45d, 0x1800022ed movzx ecx, r10b ; +0x463, 0x1800022f3 xor edx, eax ; +0x467, 0x1800022f7 mov esi, edx ; +0x469, 0x1800022f9 shr esi, 1 ; +0x46b, 0x1800022fb lea eax, [rdx+rdx] ; +0x46d, 0x1800022fd xor esi, eax ; +0x470, 0x180002300 lea eax, [rdx+rdx] ; +0x472, 0x180002302 and esi, 55555555h ; +0x475, 0x180002305 xor esi, eax ; +0x47b, 0x18000230b mov eax, 1 ; +0x47d, 0x18000230d shl eax, cl ; +0x482, 0x180002312 test eax, eax ; +0x484, 0x180002314 jle short loc_18000235B ; +0x486, 0x180002316 lea r10d, [r11+1] ; +0x488, 0x180002318 nop dword ptr [rax+00h] ; +0x48c, 0x18000231c mov rax, [rbx+38h] ; +0x490, 0x180002320 movzx ecx, byte ptr [r9+rax] ; +0x494, 0x180002324 mov eax, r8d ; +0x499, 0x180002329 shl eax, cl ; +0x49c, 0x18000232c inc r8d ; +0x49e, 0x18000232e mov ecx, eax ; +0x4a1, 0x180002331 mov eax, esi ; +0x4a3, 0x180002333 or rcx, rax ; +0x4a5, 0x180002335 mov rax, [rbx+30h] ; +0x4a8, 0x180002338 mov [rax+rcx*2], r10w ; +0x4ac, 0x18000233c mov rax, [rbx+38h] ; +0x4b1, 0x180002341 mov ecx, [rbx+6Ch] ; +0x4b5, 0x180002345 movsx edx, byte ptr [r9+rax] ; +0x4b8, 0x180002348 sub ecx, edx ; +0x4bd, 0x18000234d mov edx, 1 ; +0x4bf, 0x18000234f shl edx, cl ; +0x4c4, 0x180002354 cmp r8d, edx ; +0x4c6, 0x180002356 jl short loc_180002320 ; +0x4c9, 0x180002359 movsx ecx, word ptr [rbx+62h] ; +0x4cb, 0x18000235b inc r11d ; +0x4cf, 0x18000235f cmp r11d, ecx ; +0x4d2, 0x180002362 jl loc_180002280 ; +0x4d5, 0x180002365 mov r11d, edi ; +0x4db, 0x18000236b test r15d, r15d ; +0x4de, 0x18000236e jle loc_18000246B ; +0x4e1, 0x180002371 mov r14d, 7FFFh ; +0x4e7, 0x180002377 mov r9, rdi ; +0x4ed, 0x18000237d lea r12d, [r14+1] ; +0x4f0, 0x180002380 nop dword ptr [rax+00h] ; +0x4f4, 0x180002384 nop dword ptr [rax+rax+00000000h] ; +0x4f8, 0x180002388 mov ecx, 20h ; ' ' ; +0x500, 0x180002390 mov r10d, r11d ; +0x505, 0x180002395 sub ecx, [rbx+6Ch] ; +0x508, 0x180002398 shl r10d, cl ; +0x50b, 0x18000239b mov ecx, r10d ; +0x50e, 0x18000239e rol ecx, 10h ; +0x511, 0x1800023a1 mov eax, ecx ; +0x514, 0x1800023a4 mov r8d, ecx ; +0x516, 0x1800023a6 shl eax, 8 ; +0x519, 0x1800023a9 shl ecx, 8 ; +0x51c, 0x1800023ac shr r8d, 8 ; +0x51f, 0x1800023af xor r8d, eax ; +0x523, 0x1800023b3 and r8d, 0FF00FFh ; +0x526, 0x1800023b6 xor r8d, ecx ; +0x52d, 0x1800023bd mov eax, r8d ; +0x530, 0x1800023c0 mov edx, r8d ; +0x533, 0x1800023c3 shr edx, 4 ; +0x536, 0x1800023c6 shl eax, 4 ; +0x539, 0x1800023c9 xor edx, eax ; +0x53c, 0x1800023cc shl r8d, 4 ; +0x53e, 0x1800023ce and edx, 0F0F0F0Fh ; +0x542, 0x1800023d2 xor edx, r8d ; +0x548, 0x1800023d8 mov ecx, edx ; +0x54b, 0x1800023db shr ecx, 2 ; +0x54d, 0x1800023dd lea eax, ds:0[rdx*4] ; +0x550, 0x1800023e0 xor ecx, eax ; +0x557, 0x1800023e7 lea eax, ds:0[rdx*4] ; +0x559, 0x1800023e9 and ecx, 33333333h ; +0x560, 0x1800023f0 xor ecx, eax ; +0x566, 0x1800023f6 mov edx, ecx ; +0x568, 0x1800023f8 shr rdx, 1 ; +0x56a, 0x1800023fa lea eax, [rcx+rcx] ; +0x56d, 0x1800023fd add ecx, ecx ; +0x570, 0x180002400 xor rdx, rax ; +0x572, 0x180002402 mov rax, [rbx+30h] ; +0x575, 0x180002405 and edx, 55555555h ; +0x579, 0x180002409 xor rdx, rcx ; +0x57f, 0x18000240f cmp word ptr [rax+rdx*2], 0 ; +0x582, 0x180002412 lea rsi, [rax+rdx*2] ; +0x587, 0x180002417 jnz short loc_18000245B ; +0x58b, 0x18000241b movsx r8d, word ptr [rbx+62h] ; +0x58d, 0x18000241d lea ecx, [rdi+1] ; +0x592, 0x180002422 cmp ecx, r8d ; +0x595, 0x180002425 jge short loc_18000244B ; +0x598, 0x180002428 mov rdx, [rbx+40h] ; +0x59a, 0x18000242a add rdx, 4 ; +0x59e, 0x18000242e lea rdx, [rdx+r9*4] ; +0x5a2, 0x180002432 cmp [rdx], r10d ; +0x5a6, 0x180002436 ja short loc_18000244B ; +0x5a9, 0x180002439 inc edi ; +0x5ab, 0x18000243b inc ecx ; +0x5ad, 0x18000243d inc r9 ; +0x5af, 0x18000243f add rdx, 4 ; +0x5b2, 0x180002442 cmp ecx, r8d ; +0x5b6, 0x180002446 jl short loc_180002436 ; +0x5b9, 0x180002449 cmp edi, r14d ; +0x5bb, 0x18000244b mov eax, edi ; +0x5be, 0x18000244e cmova eax, r14d ; +0x5c0, 0x180002450 or ax, r12w ; +0x5c4, 0x180002454 mov [rsi], ax ; +0x5c8, 0x180002458 inc r11d ; +0x5cb, 0x18000245b cmp r11d, r15d ; +0x5ce, 0x18000245e jl loc_180002390 ; +0x5d1, 0x180002461 movzx ecx, word ptr [rbx+62h] ; +0x5d7, 0x180002467 movsx r8d, cx ; +0x5db, 0x18000246b test cx, cx ; +0x5df, 0x18000246f jle short loc_180002498 ; +0x5e2, 0x180002472 movsx rdx, cx ; +0x5e4, 0x180002474 nop dword ptr [rax+rax+00000000h] ; +0x5e8, 0x180002478 mov rcx, [rbx+38h] ; +0x5f0, 0x180002480 lea rdx, [rdx-1] ; +0x5f4, 0x180002484 dec r8d ; +0x5f8, 0x180002488 movzx eax, byte ptr [rcx+rdx] ; +0x5fb, 0x18000248b mov [rcx+rdx+1], al ; +0x5ff, 0x18000248f test r8d, r8d ; +0x603, 0x180002493 jg short loc_180002480 ; +0x606, 0x180002496 xor eax, eax ; +0x608, 0x180002498 mov rcx, [rbp+40h+var_28] ; +0x60a, 0x18000249a xor rcx, rbp; StackCookie ; +0x60e, 0x18000249e call __security_check_cookie ; +0x611, 0x1800024a1 mov rbx, [rbp+40h+arg_0] ; +0x616, 0x1800024a6 mov rsi, [rbp+40h+arg_8] ; +0x61a, 0x1800024aa mov rdi, [rbp+40h+arg_10] ; +0x61e, 0x1800024ae lea rsp, [rbp+20h] ; +0x622, 0x1800024b2 pop r15 ; +0x626, 0x1800024b6 pop r14 ; +0x628, 0x1800024b8 pop r13 ; +0x62a, 0x1800024ba pop r12 ; +0x62c, 0x1800024bc pop rbp ; +0x62e, 0x1800024be retn ; +0x62f, 0x1800024bf