; ; sub_180006380 from 0x180006380 to 0x18000663d (701 bytes) ; ; 2 xrefs: ; > sub_180007A70 @ 0x180007b45 ; > @ 0x1801f6324 ; ; This function is hookable on this platform! ; ; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA ; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings ; push rbp ; +0x0, 0x180006380 push r12 ; +0x2, 0x180006382 push r13 ; +0x4, 0x180006384 push r14 ; +0x6, 0x180006386 push r15 ; +0x8, 0x180006388 sub rsp, 40h ; +0xa, 0x18000638a lea rbp, [rsp+20h] ; +0xe, 0x18000638e mov [rbp+40h+arg_0], rbx ; +0x13, 0x180006393 mov [rbp+40h+arg_8], rsi ; +0x17, 0x180006397 mov [rbp+40h+arg_10], rdi ; +0x1b, 0x18000639b mov rax, cs:__security_cookie ; +0x1f, 0x18000639f xor rax, rbp ; +0x26, 0x1800063a6 mov [rbp+40h+var_30], rax ; +0x29, 0x1800063a9 mov rbx, rdx ; +0x2d, 0x1800063ad xor r15d, r15d ; +0x30, 0x1800063b0 mov rcx, rbx ; +0x33, 0x1800063b3 mov [rbp+40h+var_40], r15d ; +0x36, 0x1800063b6 lea esi, [r15-1] ; +0x3a, 0x1800063ba lea edx, [rsi+6] ; +0x3e, 0x1800063be call sub_180001340 ; +0x41, 0x1800063c1 movsxd rcx, eax ; +0x46, 0x1800063c6 mov rdx, 0FFFFFFFFFFFFFF0h ; +0x49, 0x1800063c9 mov [rbp+40h+var_38], rcx ; +0x53, 0x1800063d3 lea r12d, [rax+43h] ; +0x57, 0x1800063d7 and r12d, 0FFFFFFFCh ; +0x5b, 0x1800063db lea rax, [rcx+0Fh] ; +0x5f, 0x1800063df cmp rax, rcx ; +0x63, 0x1800063e3 ja short loc_1800063EB ; +0x66, 0x1800063e6 mov rax, rdx ; +0x68, 0x1800063e8 and rax, 0FFFFFFFFFFFFFFF0h ; +0x6b, 0x1800063eb call __alloca_probe ; +0x6f, 0x1800063ef sub rsp, rax ; +0x74, 0x1800063f4 lea r13, [rsp+60h+var_40] ; +0x77, 0x1800063f7 test rcx, rcx ; +0x7c, 0x1800063fc jle short loc_180006440 ; +0x7f, 0x1800063ff mov r14, r15 ; +0x81, 0x180006401 mov r15, rcx ; +0x84, 0x180006404 nop word ptr [rax+rax+00000000h] ; +0x87, 0x180006407 mov edx, 4 ; +0x90, 0x180006410 mov rcx, rbx ; +0x95, 0x180006415 mov edi, esi ; +0x98, 0x180006418 call sub_180001340 ; +0x9a, 0x18000641a movsx esi, al ; +0x9f, 0x18000641f cmp edi, esi ; +0xa2, 0x180006422 mov [r14+r13], al ; +0xa4, 0x180006424 cmovge esi, edi ; +0xa8, 0x180006428 inc r14 ; +0xab, 0x18000642b cmp r14, r15 ; +0xae, 0x18000642e jl short loc_180006410 ; +0xb1, 0x180006431 xor r15d, r15d ; +0xb3, 0x180006433 mov rdx, 0FFFFFFFFFFFFFF0h ; +0xb6, 0x180006436 imul eax, esi, 0Bh ; +0xc0, 0x180006440 add r12d, 0Eh ; +0xc3, 0x180006443 movsxd rsi, esi ; +0xc7, 0x180006447 inc rsi ; +0xca, 0x18000644a add r12d, eax ; +0xcd, 0x18000644d and r12d, 0FFFFFFFCh ; +0xd0, 0x180006450 lea rax, [rsi+0Fh] ; +0xd4, 0x180006454 cmp rax, rsi ; +0xd8, 0x180006458 ja short loc_180006460 ; +0xdb, 0x18000645b mov rax, rdx ; +0xdd, 0x18000645d and rax, 0FFFFFFFFFFFFFFF0h ; +0xe0, 0x180006460 call __alloca_probe ; +0xe4, 0x180006464 sub rsp, rax ; +0xe9, 0x180006469 lea r14, [rsp+60h+var_40] ; +0xec, 0x18000646c test rsi, rsi ; +0xf1, 0x180006471 jle loc_1800064FD ; +0xf4, 0x180006474 mov rdi, r15 ; +0xfa, 0x18000647a nop dword ptr [rax] ; +0xfd, 0x18000647d mov edx, 3 ; +0x100, 0x180006480 mov rcx, rbx ; +0x105, 0x180006485 call sub_180001340 ; +0x108, 0x180006488 inc al ; +0x10d, 0x18000648d mov edx, 2 ; +0x10f, 0x18000648f mov rcx, rbx ; +0x114, 0x180006494 mov [rdi+r14], al ; +0x117, 0x180006497 call sub_180001340 ; +0x11b, 0x18000649b test eax, eax ; +0x120, 0x1800064a0 jz short loc_1800064BC ; +0x122, 0x1800064a2 mov edx, [rbx+10h] ; +0x124, 0x1800064a4 add edx, 8 ; +0x127, 0x1800064a7 mov ecx, edx ; +0x12a, 0x1800064aa and ecx, 7 ; +0x12c, 0x1800064ac mov [rbx+10h], ecx ; +0x12f, 0x1800064af movsxd rcx, edx ; +0x132, 0x1800064b2 sar rcx, 3 ; +0x135, 0x1800064b5 add [rbx], rcx ; +0x139, 0x1800064b9 mov edx, [rbx+10h] ; +0x13c, 0x1800064bc mov ecx, eax ; +0x13f, 0x1800064bf mov eax, 1 ; +0x141, 0x1800064c1 shl eax, cl ; +0x146, 0x1800064c6 test eax, eax ; +0x148, 0x1800064c8 jle short loc_1800064F0 ; +0x14a, 0x1800064ca mov r9d, eax ; +0x14c, 0x1800064cc nop ; +0x14f, 0x1800064cf lea eax, [rdx+8] ; +0x150, 0x1800064d0 movsxd r8, eax ; +0x153, 0x1800064d3 mov edx, eax ; +0x156, 0x1800064d6 sar r8, 3 ; +0x158, 0x1800064d8 and edx, 7 ; +0x15c, 0x1800064dc add r8, [rbx] ; +0x15f, 0x1800064df mov [rbx], r8 ; +0x162, 0x1800064e2 sub r9, 1 ; +0x165, 0x1800064e5 jnz short loc_1800064D0 ; +0x169, 0x1800064e9 mov [rbx+10h], edx ; +0x16b, 0x1800064eb jmp short loc_1800064F3 ; +0x16e, 0x1800064ee mov r8, [rbx] ; +0x170, 0x1800064f0 inc rdi ; +0x173, 0x1800064f3 cmp rdi, rsi ; +0x176, 0x1800064f6 jl short loc_180006480 ; +0x179, 0x1800064f9 jmp short loc_180006503 ; +0x17b, 0x1800064fb mov edx, [rbx+10h] ; +0x17d, 0x1800064fd mov r8, [rbx] ; +0x180, 0x180006500 lea ecx, [rdx+2] ; +0x183, 0x180006503 mov edi, r15d ; +0x186, 0x180006506 mov eax, ecx ; +0x189, 0x180006509 mov edx, 4 ; +0x18b, 0x18000650b and eax, 7 ; +0x190, 0x180006510 mov esi, r15d ; +0x193, 0x180006513 mov [rbx+10h], eax ; +0x196, 0x180006516 movsxd rax, ecx ; +0x199, 0x180006519 mov rcx, rbx ; +0x19c, 0x18000651c sar rax, 3 ; +0x19f, 0x18000651f add rax, r8 ; +0x1a3, 0x180006523 mov [rbx], rax ; +0x1a6, 0x180006526 call sub_180001340 ; +0x1a9, 0x180006529 mov r11, [rbp+40h+var_38] ; +0x1ae, 0x18000652e mov r10d, eax ; +0x1b2, 0x180006532 mov r8, r15 ; +0x1b5, 0x180006535 cmp r11, 2 ; +0x1b8, 0x180006538 jl short loc_180006572 ; +0x1bc, 0x18000653c lea rax, [r11-1] ; +0x1be, 0x18000653e nop dword ptr [rax+00h] ; +0x1c2, 0x180006542 nop word ptr [rax+rax+00000000h] ; +0x1c6, 0x180006546 movsx rcx, byte ptr [r8+r13] ; +0x1d0, 0x180006550 movsx edx, byte ptr [rcx+r14] ; +0x1d5, 0x180006555 movsx rcx, byte ptr [r8+r13+1] ; +0x1da, 0x18000655a add edi, edx ; +0x1e0, 0x180006560 add r8, 2 ; +0x1e2, 0x180006562 movsx edx, byte ptr [rcx+r14] ; +0x1e6, 0x180006566 add esi, edx ; +0x1eb, 0x18000656b cmp r8, rax ; +0x1ed, 0x18000656d jl short loc_180006550 ; +0x1f0, 0x180006570 cmp r8, r11 ; +0x1f2, 0x180006572 jge short loc_180006583 ; +0x1f5, 0x180006575 movsx rax, byte ptr [r8+r13] ; +0x1f7, 0x180006577 movsx edx, byte ptr [rax+r14] ; +0x1fc, 0x18000657c jmp short loc_180006586 ; +0x201, 0x180006581 mov edx, [rbp+40h+var_40] ; +0x203, 0x180006583 lea eax, [rdi+rsi] ; +0x206, 0x180006586 mov r9d, r15d ; +0x209, 0x180006589 add edx, eax ; +0x20c, 0x18000658c lea eax, [r12+7] ; +0x20e, 0x18000658e lea edi, [rax+rdx*2] ; +0x213, 0x180006593 and edi, 0FFFFFFFCh ; +0x216, 0x180006596 add edi, 5 ; +0x219, 0x180006599 add edi, edx ; +0x21c, 0x18000659c and edi, 0FFFFFFFCh ; +0x21e, 0x18000659e add edi, 3 ; +0x221, 0x1800065a1 add edi, edx ; +0x224, 0x1800065a4 and edi, 0FFFFFFFCh ; +0x226, 0x1800065a6 add edi, 3 ; +0x229, 0x1800065a9 add edi, edx ; +0x22c, 0x1800065ac and edi, 0FFFFFFFCh ; +0x22e, 0x1800065ae test r11, r11 ; +0x231, 0x1800065b1 jle short loc_180006603 ; +0x234, 0x1800065b4 mov r8, r15 ; +0x236, 0x1800065b6 nop dword ptr [rax+00000000h] ; +0x239, 0x1800065b9 movsx rax, byte ptr [r8+r13] ; +0x240, 0x1800065c0 movsx ecx, byte ptr [rax+r14] ; +0x245, 0x1800065c5 add r15d, ecx ; +0x24a, 0x1800065ca cmp r9d, r15d ; +0x24d, 0x1800065cd jge short loc_1800065FB ; +0x250, 0x1800065d0 mov ecx, [rbx+10h] ; +0x252, 0x1800065d2 mov eax, r15d ; +0x255, 0x1800065d5 sub eax, r9d ; +0x258, 0x1800065d8 mov edx, eax ; +0x25b, 0x1800065db add r9d, eax ; +0x25d, 0x1800065dd lea eax, [rcx+r10] ; +0x260, 0x1800065e0 mov ecx, eax ; +0x264, 0x1800065e4 cdqe ; +0x266, 0x1800065e6 sar rax, 3 ; +0x268, 0x1800065e8 and ecx, 7 ; +0x26c, 0x1800065ec add [rbx], rax ; +0x26f, 0x1800065ef sub rdx, 1 ; +0x272, 0x1800065f2 jnz short loc_1800065E0 ; +0x276, 0x1800065f6 mov [rbx+10h], ecx ; +0x278, 0x1800065f8 inc r8 ; +0x27b, 0x1800065fb cmp r8, r11 ; +0x27e, 0x1800065fe jl short loc_1800065C0 ; +0x281, 0x180006601 mov rcx, rbx ; +0x283, 0x180006603 call sub_180001310 ; +0x286, 0x180006606 test eax, eax ; +0x28b, 0x18000660b mov eax, 0FFFFFFFFh ; +0x28d, 0x18000660d cmovnz edi, eax ; +0x292, 0x180006612 mov eax, edi ; +0x295, 0x180006615 mov rcx, [rbp+40h+var_30] ; +0x297, 0x180006617 xor rcx, rbp; StackCookie ; +0x29b, 0x18000661b call __security_check_cookie ; +0x29e, 0x18000661e mov rbx, [rbp+40h+arg_0] ; +0x2a3, 0x180006623 mov rsi, [rbp+40h+arg_8] ; +0x2a7, 0x180006627 mov rdi, [rbp+40h+arg_10] ; +0x2ab, 0x18000662b lea rsp, [rbp+20h] ; +0x2af, 0x18000662f pop r15 ; +0x2b3, 0x180006633 pop r14 ; +0x2b5, 0x180006635 pop r13 ; +0x2b7, 0x180006637 pop r12 ; +0x2b9, 0x180006639 pop rbp ; +0x2bb, 0x18000663b retn ; +0x2bc, 0x18000663c