{"type": "func", "start": 6442458768, "end": 6442460352, "name": "sub_180001E90", "pseudocode": "// \n// sub_180001E90 from 0x180001e90 to 0x1800024c0 (1584 bytes)\n// \n// 2 xrefs:\n// > sub_180001A10 @ 0x180001e4e\n// > @ 0x1801f60e4\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\n__int64 __fastcall sub_180001E90(_BYTE *a1, int a2, __int64 a3, __int64 a4)\n{\n __int64 v5; // r9\n _BYTE *v7; // r13\n unsigned __int64 v8; // rdx\n unsigned __int64 v9; // rdx\n void *v10; // rsp\n void *v11; // rsp\n int v12; // eax\n int v13; // edx\n int v14; // r8d\n unsigned __int64 v15; // rcx\n __int64 v16; // rax\n void *v17; // rsp\n unsigned int v19; // edi\n int v20; // r10d\n __int64 v21; // r9\n unsigned int *v22; // r8\n unsigned int v23; // ecx\n unsigned int v24; // edx\n unsigned int v25; // ecx\n unsigned int v26; // edx\n int v27; // ecx\n unsigned __int64 v28; // rax\n __int64 v29; // rdx\n void *v30; // rsp\n void *v31; // rsp\n int v32; // edx\n int *p_Base; // rsi\n __int64 v34; // rax\n signed int v35; // ecx\n signed int v36; // r8d\n __int64 v37; // rax\n __int64 v38; // rcx\n __int64 v39; // rdx\n __int64 v40; // rax\n int v41; // r11d\n _BYTE *v42; // r12\n __int64 *v43; // r13\n __int64 v44; // rsi\n int v45; // eax\n int v46; // r8d\n __int16 v47; // r9\n int v48; // ecx\n __int64 v49; // r10\n int v50; // eax\n __int16 v51; // dx\n __int64 v52; // rcx\n __int64 v53; // rax\n int v54; // edx\n __int64 *v55; // r8\n __int64 v56; // rcx\n __int64 v57; // rax\n int v58; // edx\n char v59; // r8\n __int64 v60; // rcx\n unsigned int v61; // ecx\n int v62; // eax\n int v63; // eax\n int v64; // r15d\n void *v65; // rax\n int v66; // ecx\n int v67; // r11d\n int v68; // r10d\n int v69; // r14d\n int v70; // r8d\n unsigned int v71; // ecx\n unsigned int v72; // ecx\n unsigned int v73; // ecx\n unsigned int v74; // eax\n int v75; // r11d\n __int64 v76; // r9\n unsigned int v77; // ecx\n unsigned int v78; // edx\n unsigned int v79; // ecx\n _WORD *v80; // rsi\n signed int v81; // r8d\n signed int v82; // ecx\n _DWORD *v83; // rdx\n __int16 v84; // ax\n int v85; // r8d\n __int64 v86; // rdx\n __int64 Base; // [rsp+20h] [rbp+0h] BYREF\n int *v88; // [rsp+28h] [rbp+8h]\n _BYTE *v89; // [rsp+30h] [rbp+10h]\n\n Base = a3;\n v5 = *(__int16 *)(a4 + 98);\n v89 = a1;\n v7 = a1;\n if ( (__int16)v5 > 0 )\n {\n v8 = 4 * v5 + 15;\n if ( v8 <= 4 * v5 )\n v8 = 0xFFFFFFFFFFFFFF0LL;\n v9 = v8 & 0xFFFFFFFFFFFFFFF0uLL;\n v10 = alloca(v9);\n v11 = alloca(v9);\n v12 = sub_180002550(&Base, a1, (unsigned int)*(__int16 *)(a4 + 96));\n LOWORD(v13) = *(_WORD *)(a4 + 98);\n v14 = v12;\n v15 = 8LL * (__int16)v13;\n v16 = v15 + 15;\n if ( v15 + 15 < v15 )\n v16 = 0xFFFFFFFFFFFFFF0LL;\n v17 = alloca(v16 & 0xFFFFFFFFFFFFFFF0uLL);\n if ( v14 < 0 )\n return 0xFFFFFFFFLL;\n v19 = 0;\n v20 = 0;\n if ( (__int16)v13 > 0 )\n {\n do\n {\n v21 = v20++;\n v22 = (unsigned int *)&Base + v21;\n v23 = __ROL4__(*v22, 16);\n v24 = (v23 << 8) ^ ((v23 << 8) ^ (v23 >> 8)) & 0xFF00FF;\n v25 = (16 * v24) ^ ((16 * v24) ^ (v24 >> 4)) & 0xF0F0F0F;\n v26 = (4 * v25) ^ ((4 * v25) ^ (v25 >> 2)) & 0x33333333;\n *v22 = (2 * v26) ^ ((2 * v26) ^ (v26 >> 1)) & 0x55555555;\n *(&Base + v21) = (__int64)v22;\n v13 = *(__int16 *)(a4 + 98);\n }\n while ( v20 < v13 );\n }\n qsort(&Base, (__int16)v13, 8u, CompareFunction);\n LOWORD(v27) = *(_WORD *)(a4 + 98);\n v28 = 4LL * (__int16)v27;\n v29 = v28 + 15;\n if ( v28 + 15 < v28 )\n v29 = 0xFFFFFFFFFFFFFF0LL;\n v30 = alloca(v29 & 0xFFFFFFFFFFFFFFF0uLL);\n v31 = alloca(v29 & 0xFFFFFFFFFFFFFFF0uLL);\n v32 = 0;\n p_Base = (int *)&Base;\n v88 = (int *)&Base;\n if ( (__int16)v27 > 0 )\n {\n do\n {\n *((_DWORD *)&Base + (int)((*(&Base + v32) - (__int64)&Base) >> 2)) = v32;\n ++v32;\n v27 = *(__int16 *)(a4 + 98);\n }\n while ( v32 < v27 );\n }\n v34 = sub_180018340(16, (unsigned int)(4 * (__int16)v27 + 4));\n LOWORD(v35) = *(_WORD *)(a4 + 98);\n v36 = 0;\n *(_QWORD *)(a4 + 64) = v34;\n if ( (__int16)v35 > 0 )\n {\n do\n {\n v37 = v36++;\n *(_DWORD *)(*(_QWORD *)(a4 + 64) + 4LL * *((int *)&Base + v37)) = *((_DWORD *)&Base + v37);\n v35 = *(__int16 *)(a4 + 98);\n }\n while ( v36 < v35 );\n }\n if ( v36 < (int)(((__int16)v35 + 4) & 0xFFFFFFFC) )\n {\n do\n {\n v38 = v36++;\n *(_DWORD *)(*(_QWORD *)(a4 + 64) + 4 * v38) = -1;\n v35 = *(__int16 *)(a4 + 98);\n }\n while ( v36 < (int)((v35 + 4) & 0xFFFFFFFC) );\n }\n v39 = (unsigned int)(2 * (__int16)v35);\n if ( *(_BYTE *)(a4 + 101) )\n {\n v40 = sub_180018340(16, v39);\n v41 = 0;\n *(_QWORD *)(a4 + 72) = v40;\n if ( *(__int16 *)(a4 + 96) > 0 )\n {\n v42 = v7;\n v43 = &Base;\n v44 = Base;\n do\n {\n if ( *v42 )\n {\n v45 = *(char *)(a4 + 100);\n v46 = 1;\n v47 = 0;\n if ( v45 > 0 )\n {\n v48 = 0;\n v49 = (unsigned int)v45;\n do\n {\n v50 = v41 / v46;\n v46 *= a2;\n v51 = *(_WORD *)(v44 + 2LL * (v50 % a2)) << v48;\n v48 += *(char *)(a4 + 102);\n v47 |= v51;\n --v49;\n }\n while ( v49 );\n }\n v52 = *(int *)v43;\n v43 = (__int64 *)((char *)v43 + 4);\n *(_WORD *)(*(_QWORD *)(a4 + 72) + 2 * v52) = v47;\n }\n ++v41;\n ++v42;\n }\n while ( v41 < *(__int16 *)(a4 + 96) );\n p_Base = v88;\n v7 = v89;\n }\n }\n else\n {\n v53 = sub_180018340(16, v39);\n v54 = 0;\n *(_QWORD *)(a4 + 80) = v53;\n if ( *(__int16 *)(a4 + 96) > 0 )\n {\n v55 = &Base;\n do\n {\n if ( (char)v7[v54] > 0 )\n {\n v56 = *(int *)v55;\n v55 = (__int64 *)((char *)v55 + 4);\n *(_WORD *)(*(_QWORD *)(a4 + 80) + 2 * v56) = v54;\n }\n ++v54;\n }\n while ( v54 < *(__int16 *)(a4 + 96) );\n }\n }\n v57 = sub_180018340(16, (unsigned int)(*(__int16 *)(a4 + 98) + 1));\n v58 = 0;\n for ( *(_QWORD *)(a4 + 56) = v57; v58 < *(__int16 *)(a4 + 96); ++v58 )\n {\n v59 = v7[v58];\n if ( v59 > 0 )\n {\n v60 = *p_Base++;\n *(_BYTE *)(v60 + *(_QWORD *)(a4 + 56)) = v59;\n }\n }\n v61 = *(__int16 *)(a4 + 98);\n v62 = 0;\n if ( *(_WORD *)(a4 + 98) )\n {\n do\n {\n ++v62;\n v61 >>= 1;\n }\n while ( v61 );\n }\n v63 = 5 * v62 / 4;\n if ( v63 >= 5 )\n {\n if ( v63 > 8 )\n LOBYTE(v63) = 8;\n }\n else\n {\n LOBYTE(v63) = 5;\n }\n v64 = 1 << v63;\n *(_DWORD *)(a4 + 108) = (char)v63;\n *(_DWORD *)(a4 + 112) = (1 << v63) - 1;\n v65 = (void *)sub_180018340(16, (unsigned int)(2 * (1 << v63)));\n *(_QWORD *)(a4 + 48) = v65;\n memset(v65, 0, 2LL * v64);\n LOWORD(v66) = *(_WORD *)(a4 + 98);\n v67 = 0;\n if ( (__int16)v66 > 0 )\n {\n do\n {\n v68 = *(_DWORD *)(a4 + 108);\n v69 = *(char *)(v67 + *(_QWORD *)(a4 + 56));\n if ( v69 <= v68 )\n {\n v70 = 0;\n v71 = __ROL4__(*(_DWORD *)(*(_QWORD *)(a4 + 64) + 4LL * v67), 16);\n v72 = (v71 << 8) ^ ((v71 << 8) ^ (v71 >> 8)) & 0xFF00FF;\n v73 = (16 * v72) ^ ((16 * v72) ^ (v72 >> 4)) & 0xF0F0F0F;\n if ( 1 << (v68 - v69) > 0 )\n {\n do\n {\n v74 = v70++ << *(_BYTE *)(v67 + *(_QWORD *)(a4 + 56));\n *(_WORD *)(*(_QWORD *)(a4 + 48)\n + 2\n * ((2 * ((4 * v73) ^ ((4 * v73) ^ (v73 >> 2)) & 0x33333333))\n ^ ((2 * ((4 * v73) ^ ((4 * v73) ^ (v73 >> 2)) & 0x33333333))\n ^ (((4 * v73) ^ ((4 * v73) ^ (v73 >> 2)) & 0x33333333) >> 1))\n & 0x55555555\n | (unsigned __int64)v74)) = v67 + 1;\n }\n while ( v70 < 1 << (*(_BYTE *)(a4 + 108) - *(_BYTE *)(v67 + *(_QWORD *)(a4 + 56))) );\n }\n }\n v66 = *(__int16 *)(a4 + 98);\n ++v67;\n }\n while ( v67 < v66 );\n }\n v75 = 0;\n if ( v64 > 0 )\n {\n v76 = 0;\n do\n {\n v77 = __ROL4__(v75 << (32 - *(_BYTE *)(a4 + 108)), 16);\n v78 = (16 * ((v77 << 8) ^ ((v77 << 8) ^ (v77 >> 8)) & 0xFF00FF))\n ^ ((16 * ((v77 << 8) ^ ((v77 << 8) ^ (v77 >> 8)) & 0xFF00FF))\n ^ (((v77 << 8) ^ ((v77 << 8) ^ (v77 >> 8)) & 0xFF00FF) >> 4))\n & 0xF0F0F0F;\n v79 = (4 * v78) ^ ((4 * v78) ^ (v78 >> 2)) & 0x33333333;\n v80 = (_WORD *)(*(_QWORD *)(a4 + 48)\n + 2 * ((2 * v79) ^ (unsigned __int64)(((2 * v79) ^ (v79 >> 1)) & 0x55555555)));\n if ( !*v80 )\n {\n v81 = *(__int16 *)(a4 + 98);\n v82 = v19 + 1;\n if ( (int)(v19 + 1) < v81 )\n {\n v83 = (_DWORD *)(*(_QWORD *)(a4 + 64) + 4LL + 4 * v76);\n do\n {\n if ( *v83 > (unsigned int)(v75 << (32 - *(_BYTE *)(a4 + 108))) )\n break;\n ++v19;\n ++v82;\n ++v76;\n ++v83;\n }\n while ( v82 < v81 );\n }\n v84 = v19;\n if ( v19 > 0x7FFF )\n v84 = 0x7FFF;\n *v80 = v84 | 0x8000;\n }\n ++v75;\n }\n while ( v75 < v64 );\n LOWORD(v66) = *(_WORD *)(a4 + 98);\n }\n v85 = (__int16)v66;\n if ( (__int16)v66 > 0 )\n {\n v86 = (__int16)v66;\n do\n {\n --v86;\n --v85;\n *(_BYTE *)(*(_QWORD *)(a4 + 56) + v86 + 1) = *(_BYTE *)(*(_QWORD *)(a4 + 56) + v86);\n }\n while ( v85 > 0 );\n }\n }\n return 0;\n}", "assembly": "; \n; sub_180001E90 from 0x180001e90 to 0x1800024c0 (1584 bytes)\n; \n; 2 xrefs:\n; > sub_180001A10 @ 0x180001e4e\n; > @ 0x1801f60e4\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\npush rbp ; +0x0, 0x180001e90\npush r12 ; +0x2, 0x180001e92\npush r13 ; +0x4, 0x180001e94\npush r14 ; +0x6, 0x180001e96\npush r15 ; +0x8, 0x180001e98\nsub rsp, 40h ; +0xa, 0x180001e9a\nlea rbp, [rsp+20h] ; +0xe, 0x180001e9e\nmov [rbp+40h+arg_0], rbx ; +0x13, 0x180001ea3\nmov [rbp+40h+arg_8], rsi ; +0x17, 0x180001ea7\nmov [rbp+40h+arg_10], rdi ; +0x1b, 0x180001eab\nmov rax, cs:__security_cookie ; +0x1f, 0x180001eaf\nxor rax, rbp ; +0x26, 0x180001eb6\nmov [rbp+40h+var_28], rax ; +0x29, 0x180001eb9\nmov rbx, r9 ; +0x2d, 0x180001ebd\nmov [rbp+40h+Base], r8 ; +0x30, 0x180001ec0\nmovsx r9, word ptr [r9+62h] ; +0x34, 0x180001ec4\nmov r14d, edx ; +0x39, 0x180001ec9\nmov [rbp+40h+var_30], rcx ; +0x3c, 0x180001ecc\nmov r13, rcx ; +0x40, 0x180001ed0\ntest r9w, r9w ; +0x43, 0x180001ed3\njle loc_180002498 ; +0x47, 0x180001ed7\nmov rax, r9 ; +0x4d, 0x180001edd\nmov rsi, 0FFFFFFFFFFFFFF0h ; +0x50, 0x180001ee0\nshl rax, 2 ; +0x5a, 0x180001eea\nlea rdx, [rax+0Fh] ; +0x5e, 0x180001eee\ncmp rdx, rax ; +0x62, 0x180001ef2\nja short loc_180001EFA ; +0x65, 0x180001ef5\nmov rdx, rsi ; +0x67, 0x180001ef7\nand rdx, 0FFFFFFFFFFFFFFF0h ; +0x6a, 0x180001efa\nmov rax, rdx ; +0x6e, 0x180001efe\ncall __alloca_probe ; +0x71, 0x180001f01\nmovsx r8d, word ptr [rbx+60h] ; +0x76, 0x180001f06\nsub rsp, rdx ; +0x7b, 0x180001f0b\nmov rdx, r13 ; +0x7e, 0x180001f0e\nlea r15, [rsp+60h+Base] ; +0x81, 0x180001f11\nmov rcx, r15 ; +0x86, 0x180001f16\ncall sub_180002550 ; +0x89, 0x180001f19\nmovsx rdx, word ptr [rbx+62h] ; +0x8e, 0x180001f1e\nmov r8d, eax ; +0x93, 0x180001f23\nmov rcx, rdx ; +0x96, 0x180001f26\nshl rcx, 3 ; +0x99, 0x180001f29\nlea rax, [rcx+0Fh] ; +0x9d, 0x180001f2d\ncmp rax, rcx ; +0xa1, 0x180001f31\nja short loc_180001F39 ; +0xa4, 0x180001f34\nmov rax, rsi ; +0xa6, 0x180001f36\nand rax, 0FFFFFFFFFFFFFFF0h ; +0xa9, 0x180001f39\ncall __alloca_probe ; +0xad, 0x180001f3d\nsub rsp, rax ; +0xb2, 0x180001f42\nlea r12, [rsp+60h+Base] ; +0xb5, 0x180001f45\ntest r8d, r8d ; +0xba, 0x180001f4a\njns short loc_180001F59 ; +0xbd, 0x180001f4d\nmov eax, 0FFFFFFFFh ; +0xbf, 0x180001f4f\njmp loc_18000249A ; +0xc4, 0x180001f54\nxor edi, edi ; +0xc9, 0x180001f59\nmov r10d, edi ; +0xcb, 0x180001f5b\ncmp di, dx ; +0xce, 0x180001f5e\njge loc_180001FF0 ; +0xd1, 0x180001f61\nnop word ptr [rax+rax+00000000h] ; +0xd7, 0x180001f67\nmovsxd r9, r10d ; +0xe0, 0x180001f70\ninc r10d ; +0xe3, 0x180001f73\nmov ecx, [r15+r9*4] ; +0xe6, 0x180001f76\nlea r8, [r15+r9*4] ; +0xea, 0x180001f7a\nrol ecx, 10h ; +0xee, 0x180001f7e\nmov edx, ecx ; +0xf1, 0x180001f81\nmov eax, ecx ; +0xf3, 0x180001f83\nshl ecx, 8 ; +0xf5, 0x180001f85\nshr edx, 8 ; +0xf8, 0x180001f88\nshl eax, 8 ; +0xfb, 0x180001f8b\nxor edx, eax ; +0xfe, 0x180001f8e\nand edx, 0FF00FFh ; +0x100, 0x180001f90\nxor edx, ecx ; +0x106, 0x180001f96\nmov ecx, edx ; +0x108, 0x180001f98\nmov eax, edx ; +0x10a, 0x180001f9a\nshr ecx, 4 ; +0x10c, 0x180001f9c\nshl edx, 4 ; +0x10f, 0x180001f9f\nshl eax, 4 ; +0x112, 0x180001fa2\nxor ecx, eax ; +0x115, 0x180001fa5\nand ecx, 0F0F0F0Fh ; +0x117, 0x180001fa7\nxor ecx, edx ; +0x11d, 0x180001fad\nmov edx, ecx ; +0x11f, 0x180001faf\nshr edx, 2 ; +0x121, 0x180001fb1\nlea eax, ds:0[rcx*4] ; +0x124, 0x180001fb4\nxor edx, eax ; +0x12b, 0x180001fbb\nlea eax, ds:0[rcx*4] ; +0x12d, 0x180001fbd\nand edx, 33333333h ; +0x134, 0x180001fc4\nxor edx, eax ; +0x13a, 0x180001fca\nmov ecx, edx ; +0x13c, 0x180001fcc\nshr ecx, 1 ; +0x13e, 0x180001fce\nlea eax, [rdx+rdx] ; +0x140, 0x180001fd0\nxor ecx, eax ; +0x143, 0x180001fd3\nlea eax, [rdx+rdx] ; +0x145, 0x180001fd5\nand ecx, 55555555h ; +0x148, 0x180001fd8\nxor ecx, eax ; +0x14e, 0x180001fde\nmov [r8], ecx ; +0x150, 0x180001fe0\nmov [r12+r9*8], r8 ; +0x153, 0x180001fe3\nmovsx edx, word ptr [rbx+62h] ; +0x157, 0x180001fe7\ncmp r10d, edx ; +0x15b, 0x180001feb\njl short loc_180001F70 ; +0x15e, 0x180001fee\nmovsx rdx, dx; NumOfElements ; +0x160, 0x180001ff0\nlea r9, CompareFunction; CompareFunction ; +0x164, 0x180001ff4\nmov r8d, 8; SizeOfElements ; +0x16b, 0x180001ffb\nmov rcx, r12; Base ; +0x171, 0x180002001\ncall qsort ; +0x174, 0x180002004\nmovsx rcx, word ptr [rbx+62h] ; +0x179, 0x180002009\nmov rax, rcx ; +0x17e, 0x18000200e\nshl rax, 2 ; +0x181, 0x180002011\nlea rdx, [rax+0Fh] ; +0x185, 0x180002015\ncmp rdx, rax ; +0x189, 0x180002019\nja short loc_180002021 ; +0x18c, 0x18000201c\nmov rdx, rsi ; +0x18e, 0x18000201e\nand rdx, 0FFFFFFFFFFFFFFF0h ; +0x191, 0x180002021\nmov rax, rdx ; +0x195, 0x180002025\ncall __alloca_probe ; +0x198, 0x180002028\nsub rsp, rdx ; +0x19d, 0x18000202d\nmov edx, edi ; +0x1a0, 0x180002030\nlea rsi, [rsp+60h+Base] ; +0x1a2, 0x180002032\nmov [rbp+40h+var_38], rsi ; +0x1a7, 0x180002037\ncmp di, cx ; +0x1ab, 0x18000203b\njge short loc_18000205D ; +0x1ae, 0x18000203e\nmovsxd rax, edx ; +0x1b0, 0x180002040\nmov rax, [r12+rax*8] ; +0x1b3, 0x180002043\nsub rax, r15 ; +0x1b7, 0x180002047\nsar rax, 2 ; +0x1ba, 0x18000204a\ncdqe ; +0x1be, 0x18000204e\nmov [rsi+rax*4], edx ; +0x1c0, 0x180002050\ninc edx ; +0x1c3, 0x180002053\nmovsx ecx, word ptr [rbx+62h] ; +0x1c5, 0x180002055\ncmp edx, ecx ; +0x1c9, 0x180002059\njl short loc_180002040 ; +0x1cb, 0x18000205b\nmovsx edx, cx ; +0x1cd, 0x18000205d\nmov ecx, 10h ; +0x1d0, 0x180002060\nlea edx, ds:4[rdx*4] ; +0x1d5, 0x180002065\ncall sub_180018340 ; +0x1dc, 0x18000206c\nmovzx ecx, word ptr [rbx+62h] ; +0x1e1, 0x180002071\nmov r8d, edi ; +0x1e5, 0x180002075\nmov [rbx+40h], rax ; +0x1e8, 0x180002078\ncmp di, cx ; +0x1ec, 0x18000207c\njge short loc_18000209F ; +0x1ef, 0x18000207f\nmov rcx, [rbx+40h] ; +0x1f1, 0x180002081\nmovsxd rax, r8d ; +0x1f5, 0x180002085\ninc r8d ; +0x1f8, 0x180002088\nmovsxd rdx, dword ptr [rsi+rax*4] ; +0x1fb, 0x18000208b\nmov eax, [r15+rax*4] ; +0x1ff, 0x18000208f\nmov [rcx+rdx*4], eax ; +0x203, 0x180002093\nmovsx ecx, word ptr [rbx+62h] ; +0x206, 0x180002096\ncmp r8d, ecx ; +0x20a, 0x18000209a\njl short loc_180002081 ; +0x20d, 0x18000209d\nmovsx eax, cx ; +0x20f, 0x18000209f\nadd eax, 4 ; +0x212, 0x1800020a2\nand eax, 0FFFFFFFCh ; +0x215, 0x1800020a5\ncmp r8d, eax ; +0x218, 0x1800020a8\njge short loc_1800020D0 ; +0x21b, 0x1800020ab\nnop dword ptr [rax] ; +0x21d, 0x1800020ad\nmov rax, [rbx+40h] ; +0x220, 0x1800020b0\nmovsxd rcx, r8d ; +0x224, 0x1800020b4\ninc r8d ; +0x227, 0x1800020b7\nmov dword ptr [rax+rcx*4], 0FFFFFFFFh ; +0x22a, 0x1800020ba\nmovsx ecx, word ptr [rbx+62h] ; +0x231, 0x1800020c1\nlea eax, [rcx+4] ; +0x235, 0x1800020c5\nand eax, 0FFFFFFFCh ; +0x238, 0x1800020c8\ncmp r8d, eax ; +0x23b, 0x1800020cb\njl short loc_1800020B0 ; +0x23e, 0x1800020ce\nmovsx edx, cx ; +0x240, 0x1800020d0\nmov ecx, 10h ; +0x243, 0x1800020d3\nadd edx, edx ; +0x248, 0x1800020d8\ncmp [rbx+65h], dil ; +0x24a, 0x1800020da\njz loc_180002180 ; +0x24e, 0x1800020de\ncall sub_180018340 ; +0x254, 0x1800020e4\nmov r11d, edi ; +0x259, 0x1800020e9\nmov [rbx+48h], rax ; +0x25c, 0x1800020ec\ncmp di, [rbx+60h] ; +0x260, 0x1800020f0\njge loc_1800021B6 ; +0x264, 0x1800020f4\nmov r12, r13 ; +0x26a, 0x1800020fa\nmov r13, rsi ; +0x26d, 0x1800020fd\nmov rsi, [rbp+40h+Base] ; +0x270, 0x180002100\ncmp [r12], dil ; +0x274, 0x180002104\njz short loc_180002167 ; +0x278, 0x180002108\nmovsx eax, byte ptr [rbx+64h] ; +0x27a, 0x18000210a\nmov r8d, 1 ; +0x27e, 0x18000210e\nmovzx r9d, di ; +0x284, 0x180002114\ntest eax, eax ; +0x288, 0x180002118\njle short loc_180002156 ; +0x28a, 0x18000211a\nmovsx r15d, byte ptr [rbx+66h] ; +0x28c, 0x18000211c\nmov ecx, edi ; +0x291, 0x180002121\nmov r10d, eax ; +0x293, 0x180002123\nnop word ptr [rax+rax+00000000h] ; +0x296, 0x180002126\nmov eax, r11d ; +0x2a0, 0x180002130\ncdq ; +0x2a3, 0x180002133\nidiv r8d ; +0x2a4, 0x180002134\nimul r8d, r14d ; +0x2a7, 0x180002137\ncdq ; +0x2ab, 0x18000213b\nidiv r14d ; +0x2ac, 0x18000213c\nmovsxd rax, edx ; +0x2af, 0x18000213f\nmovzx edx, word ptr [rsi+rax*2] ; +0x2b2, 0x180002142\nshl dx, cl ; +0x2b6, 0x180002146\nadd ecx, r15d ; +0x2b9, 0x180002149\nor r9w, dx ; +0x2bc, 0x18000214c\nsub r10, 1 ; +0x2c0, 0x180002150\njnz short loc_180002130 ; +0x2c4, 0x180002154\nmovsxd rcx, dword ptr [r13+0] ; +0x2c6, 0x180002156\nadd r13, 4 ; +0x2ca, 0x18000215a\nmov rax, [rbx+48h] ; +0x2ce, 0x18000215e\nmov [rax+rcx*2], r9w ; +0x2d2, 0x180002162\nmovsx eax, word ptr [rbx+60h] ; +0x2d7, 0x180002167\ninc r11d ; +0x2db, 0x18000216b\ninc r12 ; +0x2de, 0x18000216e\ncmp r11d, eax ; +0x2e1, 0x180002171\njl short loc_180002104 ; +0x2e4, 0x180002174\nmov rsi, [rbp+40h+var_38] ; +0x2e6, 0x180002176\nmov r13, [rbp+40h+var_30] ; +0x2ea, 0x18000217a\njmp short loc_1800021B6 ; +0x2ee, 0x18000217e\ncall sub_180018340 ; +0x2f0, 0x180002180\nmov edx, edi ; +0x2f5, 0x180002185\nmov [rbx+50h], rax ; +0x2f7, 0x180002187\ncmp di, [rbx+60h] ; +0x2fb, 0x18000218b\njge short loc_1800021B6 ; +0x2ff, 0x18000218f\nmov r8, rsi ; +0x301, 0x180002191\nmovsxd rax, edx ; +0x304, 0x180002194\ncmp [rax+r13], dil ; +0x307, 0x180002197\njle short loc_1800021AC ; +0x30b, 0x18000219b\nmovsxd rcx, dword ptr [r8] ; +0x30d, 0x18000219d\nadd r8, 4 ; +0x310, 0x1800021a0\nmov rax, [rbx+50h] ; +0x314, 0x1800021a4\nmov [rax+rcx*2], dx ; +0x318, 0x1800021a8\nmovsx eax, word ptr [rbx+60h] ; +0x31c, 0x1800021ac\ninc edx ; +0x320, 0x1800021b0\ncmp edx, eax ; +0x322, 0x1800021b2\njl short loc_180002194 ; +0x324, 0x1800021b4\nmovsx edx, word ptr [rbx+62h] ; +0x326, 0x1800021b6\nmov ecx, 10h ; +0x32a, 0x1800021ba\ninc edx ; +0x32f, 0x1800021bf\ncall sub_180018340 ; +0x331, 0x1800021c1\nmov edx, edi ; +0x336, 0x1800021c6\nmov [rbx+38h], rax ; +0x338, 0x1800021c8\ncmp di, [rbx+60h] ; +0x33c, 0x1800021cc\njge short loc_1800021F8 ; +0x340, 0x1800021d0\nmovsxd rax, edx ; +0x342, 0x1800021d2\nmovzx r8d, byte ptr [rax+r13] ; +0x345, 0x1800021d5\ntest r8b, r8b ; +0x34a, 0x1800021da\njle short loc_1800021EE ; +0x34d, 0x1800021dd\nmovsxd rcx, dword ptr [rsi] ; +0x34f, 0x1800021df\nadd rsi, 4 ; +0x352, 0x1800021e2\nmov rax, [rbx+38h] ; +0x356, 0x1800021e6\nmov [rcx+rax], r8b ; +0x35a, 0x1800021ea\nmovsx eax, word ptr [rbx+60h] ; +0x35e, 0x1800021ee\ninc edx ; +0x362, 0x1800021f2\ncmp edx, eax ; +0x364, 0x1800021f4\njl short loc_1800021D2 ; +0x366, 0x1800021f6\nmovsx ecx, word ptr [rbx+62h] ; +0x368, 0x1800021f8\nmov eax, edi ; +0x36c, 0x1800021fc\ntest ecx, ecx ; +0x36e, 0x1800021fe\njz short loc_180002208 ; +0x370, 0x180002200\ninc eax ; +0x372, 0x180002202\nshr ecx, 1 ; +0x374, 0x180002204\njnz short loc_180002202 ; +0x376, 0x180002206\nlea eax, [rax+rax*4] ; +0x378, 0x180002208\ncdq ; +0x37b, 0x18000220b\nand edx, 3 ; +0x37c, 0x18000220c\nadd eax, edx ; +0x37f, 0x18000220f\nsar eax, 2 ; +0x381, 0x180002211\ncmp eax, 5 ; +0x384, 0x180002214\njge short loc_180002220 ; +0x387, 0x180002217\nmov eax, 5 ; +0x389, 0x180002219\njmp short loc_18000222B ; +0x38e, 0x18000221e\ncmp eax, 8 ; +0x390, 0x180002220\nmov ecx, 8 ; +0x393, 0x180002223\ncmovg eax, ecx ; +0x398, 0x180002228\nmovsx ecx, al ; +0x39b, 0x18000222b\nmov r15d, 1 ; +0x39e, 0x18000222e\nshl r15d, cl ; +0x3a4, 0x180002234\nmov [rbx+6Ch], ecx ; +0x3a7, 0x180002237\nmov ecx, 10h ; +0x3aa, 0x18000223a\nlea eax, [r15-1] ; +0x3af, 0x18000223f\nlea edx, [r15+r15] ; +0x3b3, 0x180002243\nmov [rbx+70h], eax ; +0x3b7, 0x180002247\ncall sub_180018340 ; +0x3ba, 0x18000224a\nmovsxd r8, r15d ; +0x3bf, 0x18000224f\nxor edx, edx; Val ; +0x3c2, 0x180002252\nadd r8, r8; Size ; +0x3c4, 0x180002254\nmov [rbx+30h], rax ; +0x3c7, 0x180002257\nmov rcx, rax; void * ; +0x3cb, 0x18000225b\ncall memset ; +0x3ce, 0x18000225e\nmovzx ecx, word ptr [rbx+62h] ; +0x3d3, 0x180002263\nmov r11d, edi ; +0x3d7, 0x180002267\ncmp di, cx ; +0x3da, 0x18000226a\njge loc_18000236B ; +0x3dd, 0x18000226d\nnop dword ptr [rax+00h] ; +0x3e3, 0x180002273\nnop word ptr [rax+rax+00000000h] ; +0x3e7, 0x180002277\nmov rax, [rbx+38h] ; +0x3f0, 0x180002280\nmov r10d, [rbx+6Ch] ; +0x3f4, 0x180002284\nmovsxd r9, r11d ; +0x3f8, 0x180002288\nmovsx r14d, byte ptr [r9+rax] ; +0x3fb, 0x18000228b\ncmp r14d, r10d ; +0x400, 0x180002290\njg loc_18000235B ; +0x403, 0x180002293\nmov rax, [rbx+40h] ; +0x409, 0x180002299\nsub r10d, r14d ; +0x40d, 0x18000229d\nmov r8d, edi ; +0x410, 0x1800022a0\nmov ecx, [rax+r9*4] ; +0x413, 0x1800022a3\nrol ecx, 10h ; +0x417, 0x1800022a7\nmov edx, ecx ; +0x41a, 0x1800022aa\nmov eax, ecx ; +0x41c, 0x1800022ac\nshr edx, 8 ; +0x41e, 0x1800022ae\nshl eax, 8 ; +0x421, 0x1800022b1\nxor edx, eax ; +0x424, 0x1800022b4\nshl ecx, 8 ; +0x426, 0x1800022b6\nand edx, 0FF00FFh ; +0x429, 0x1800022b9\nxor edx, ecx ; +0x42f, 0x1800022bf\nmov ecx, edx ; +0x431, 0x1800022c1\nmov eax, edx ; +0x433, 0x1800022c3\nshl eax, 4 ; +0x435, 0x1800022c5\nshl edx, 4 ; +0x438, 0x1800022c8\nshr ecx, 4 ; +0x43b, 0x1800022cb\nxor ecx, eax ; +0x43e, 0x1800022ce\nand ecx, 0F0F0F0Fh ; +0x440, 0x1800022d0\nxor ecx, edx ; +0x446, 0x1800022d6\nmov edx, ecx ; +0x448, 0x1800022d8\nshr edx, 2 ; +0x44a, 0x1800022da\nlea eax, ds:0[rcx*4] ; +0x44d, 0x1800022dd\nxor edx, eax ; +0x454, 0x1800022e4\nlea eax, ds:0[rcx*4] ; +0x456, 0x1800022e6\nand edx, 33333333h ; +0x45d, 0x1800022ed\nmovzx ecx, r10b ; +0x463, 0x1800022f3\nxor edx, eax ; +0x467, 0x1800022f7\nmov esi, edx ; +0x469, 0x1800022f9\nshr esi, 1 ; +0x46b, 0x1800022fb\nlea eax, [rdx+rdx] ; +0x46d, 0x1800022fd\nxor esi, eax ; +0x470, 0x180002300\nlea eax, [rdx+rdx] ; +0x472, 0x180002302\nand esi, 55555555h ; +0x475, 0x180002305\nxor esi, eax ; +0x47b, 0x18000230b\nmov eax, 1 ; +0x47d, 0x18000230d\nshl eax, cl ; +0x482, 0x180002312\ntest eax, eax ; +0x484, 0x180002314\njle short loc_18000235B ; +0x486, 0x180002316\nlea r10d, [r11+1] ; +0x488, 0x180002318\nnop dword ptr [rax+00h] ; +0x48c, 0x18000231c\nmov rax, [rbx+38h] ; +0x490, 0x180002320\nmovzx ecx, byte ptr [r9+rax] ; +0x494, 0x180002324\nmov eax, r8d ; +0x499, 0x180002329\nshl eax, cl ; +0x49c, 0x18000232c\ninc r8d ; +0x49e, 0x18000232e\nmov ecx, eax ; +0x4a1, 0x180002331\nmov eax, esi ; +0x4a3, 0x180002333\nor rcx, rax ; +0x4a5, 0x180002335\nmov rax, [rbx+30h] ; +0x4a8, 0x180002338\nmov [rax+rcx*2], r10w ; +0x4ac, 0x18000233c\nmov rax, [rbx+38h] ; +0x4b1, 0x180002341\nmov ecx, [rbx+6Ch] ; +0x4b5, 0x180002345\nmovsx edx, byte ptr [r9+rax] ; +0x4b8, 0x180002348\nsub ecx, edx ; +0x4bd, 0x18000234d\nmov edx, 1 ; +0x4bf, 0x18000234f\nshl edx, cl ; +0x4c4, 0x180002354\ncmp r8d, edx ; +0x4c6, 0x180002356\njl short loc_180002320 ; +0x4c9, 0x180002359\nmovsx ecx, word ptr [rbx+62h] ; +0x4cb, 0x18000235b\ninc r11d ; +0x4cf, 0x18000235f\ncmp r11d, ecx ; +0x4d2, 0x180002362\njl loc_180002280 ; +0x4d5, 0x180002365\nmov r11d, edi ; +0x4db, 0x18000236b\ntest r15d, r15d ; +0x4de, 0x18000236e\njle loc_18000246B ; +0x4e1, 0x180002371\nmov r14d, 7FFFh ; +0x4e7, 0x180002377\nmov r9, rdi ; +0x4ed, 0x18000237d\nlea r12d, [r14+1] ; +0x4f0, 0x180002380\nnop dword ptr [rax+00h] ; +0x4f4, 0x180002384\nnop dword ptr [rax+rax+00000000h] ; +0x4f8, 0x180002388\nmov ecx, 20h ; ' ' ; +0x500, 0x180002390\nmov r10d, r11d ; +0x505, 0x180002395\nsub ecx, [rbx+6Ch] ; +0x508, 0x180002398\nshl r10d, cl ; +0x50b, 0x18000239b\nmov ecx, r10d ; +0x50e, 0x18000239e\nrol ecx, 10h ; +0x511, 0x1800023a1\nmov eax, ecx ; +0x514, 0x1800023a4\nmov r8d, ecx ; +0x516, 0x1800023a6\nshl eax, 8 ; +0x519, 0x1800023a9\nshl ecx, 8 ; +0x51c, 0x1800023ac\nshr r8d, 8 ; +0x51f, 0x1800023af\nxor r8d, eax ; +0x523, 0x1800023b3\nand r8d, 0FF00FFh ; +0x526, 0x1800023b6\nxor r8d, ecx ; +0x52d, 0x1800023bd\nmov eax, r8d ; +0x530, 0x1800023c0\nmov edx, r8d ; +0x533, 0x1800023c3\nshr edx, 4 ; +0x536, 0x1800023c6\nshl eax, 4 ; +0x539, 0x1800023c9\nxor edx, eax ; +0x53c, 0x1800023cc\nshl r8d, 4 ; +0x53e, 0x1800023ce\nand edx, 0F0F0F0Fh ; +0x542, 0x1800023d2\nxor edx, r8d ; +0x548, 0x1800023d8\nmov ecx, edx ; +0x54b, 0x1800023db\nshr ecx, 2 ; +0x54d, 0x1800023dd\nlea eax, ds:0[rdx*4] ; +0x550, 0x1800023e0\nxor ecx, eax ; +0x557, 0x1800023e7\nlea eax, ds:0[rdx*4] ; +0x559, 0x1800023e9\nand ecx, 33333333h ; +0x560, 0x1800023f0\nxor ecx, eax ; +0x566, 0x1800023f6\nmov edx, ecx ; +0x568, 0x1800023f8\nshr rdx, 1 ; +0x56a, 0x1800023fa\nlea eax, [rcx+rcx] ; +0x56d, 0x1800023fd\nadd ecx, ecx ; +0x570, 0x180002400\nxor rdx, rax ; +0x572, 0x180002402\nmov rax, [rbx+30h] ; +0x575, 0x180002405\nand edx, 55555555h ; +0x579, 0x180002409\nxor rdx, rcx ; +0x57f, 0x18000240f\ncmp word ptr [rax+rdx*2], 0 ; +0x582, 0x180002412\nlea rsi, [rax+rdx*2] ; +0x587, 0x180002417\njnz short loc_18000245B ; +0x58b, 0x18000241b\nmovsx r8d, word ptr [rbx+62h] ; +0x58d, 0x18000241d\nlea ecx, [rdi+1] ; +0x592, 0x180002422\ncmp ecx, r8d ; +0x595, 0x180002425\njge short loc_18000244B ; +0x598, 0x180002428\nmov rdx, [rbx+40h] ; +0x59a, 0x18000242a\nadd rdx, 4 ; +0x59e, 0x18000242e\nlea rdx, [rdx+r9*4] ; +0x5a2, 0x180002432\ncmp [rdx], r10d ; +0x5a6, 0x180002436\nja short loc_18000244B ; +0x5a9, 0x180002439\ninc edi ; +0x5ab, 0x18000243b\ninc ecx ; +0x5ad, 0x18000243d\ninc r9 ; +0x5af, 0x18000243f\nadd rdx, 4 ; +0x5b2, 0x180002442\ncmp ecx, r8d ; +0x5b6, 0x180002446\njl short loc_180002436 ; +0x5b9, 0x180002449\ncmp edi, r14d ; +0x5bb, 0x18000244b\nmov eax, edi ; +0x5be, 0x18000244e\ncmova eax, r14d ; +0x5c0, 0x180002450\nor ax, r12w ; +0x5c4, 0x180002454\nmov [rsi], ax ; +0x5c8, 0x180002458\ninc r11d ; +0x5cb, 0x18000245b\ncmp r11d, r15d ; +0x5ce, 0x18000245e\njl loc_180002390 ; +0x5d1, 0x180002461\nmovzx ecx, word ptr [rbx+62h] ; +0x5d7, 0x180002467\nmovsx r8d, cx ; +0x5db, 0x18000246b\ntest cx, cx ; +0x5df, 0x18000246f\njle short loc_180002498 ; +0x5e2, 0x180002472\nmovsx rdx, cx ; +0x5e4, 0x180002474\nnop dword ptr [rax+rax+00000000h] ; +0x5e8, 0x180002478\nmov rcx, [rbx+38h] ; +0x5f0, 0x180002480\nlea rdx, [rdx-1] ; +0x5f4, 0x180002484\ndec r8d ; +0x5f8, 0x180002488\nmovzx eax, byte ptr [rcx+rdx] ; +0x5fb, 0x18000248b\nmov [rcx+rdx+1], al ; +0x5ff, 0x18000248f\ntest r8d, r8d ; +0x603, 0x180002493\njg short loc_180002480 ; +0x606, 0x180002496\nxor eax, eax ; +0x608, 0x180002498\nmov rcx, [rbp+40h+var_28] ; +0x60a, 0x18000249a\nxor rcx, rbp; StackCookie ; +0x60e, 0x18000249e\ncall __security_check_cookie ; +0x611, 0x1800024a1\nmov rbx, [rbp+40h+arg_0] ; +0x616, 0x1800024a6\nmov rsi, [rbp+40h+arg_8] ; +0x61a, 0x1800024aa\nmov rdi, [rbp+40h+arg_10] ; +0x61e, 0x1800024ae\nlea rsp, [rbp+20h] ; +0x622, 0x1800024b2\npop r15 ; +0x626, 0x1800024b6\npop r14 ; +0x628, 0x1800024b8\npop r13 ; +0x62a, 0x1800024ba\npop r12 ; +0x62c, 0x1800024bc\npop rbp ; +0x62e, 0x1800024be\nretn ; +0x62f, 0x1800024bf", "xrefs": ["sub_180001A10 @ 0x180001e4e", " @ 0x1801f60e4"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}