{"type": "func", "start": 6442476416, "end": 6442477117, "name": "sub_180006380", "pseudocode": "// \n// sub_180006380 from 0x180006380 to 0x18000663d (701 bytes)\n// \n// 2 xrefs:\n// > sub_180007A70 @ 0x180007b45\n// > @ 0x1801f6324\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\n__int64 __fastcall sub_180006380(__int64 a1, __int64 a2)\n{\n int v3; // r15d\n int v4; // esi\n int v5; // eax\n __int64 v6; // rcx\n unsigned int v7; // r12d\n unsigned __int64 v8; // rax\n void *v9; // rsp\n __int64 v10; // r14\n __int64 v11; // r15\n int v12; // edi\n char v13; // al\n int v14; // eax\n __int64 v15; // rsi\n unsigned int v16; // r12d\n __int64 v17; // rax\n void *v18; // rsp\n __int64 i; // rdi\n int v20; // eax\n int v21; // edx\n int v22; // edx\n int v23; // eax\n __int64 v24; // r9\n int v25; // eax\n __int64 v26; // r8\n int v27; // edi\n int v28; // esi\n int v29; // eax\n __int64 v30; // r11\n int v31; // r10d\n __int64 v32; // r8\n __int64 v33; // rcx\n int v34; // edx\n int v35; // r9d\n unsigned int v36; // edi\n __int64 v37; // r8\n int v38; // ecx\n __int64 v39; // rdx\n __int64 v40; // rax\n _DWORD v42[2]; // [rsp+20h] [rbp+0h] BYREF\n __int64 v43; // [rsp+28h] [rbp+8h]\n\n v3 = 0;\n v42[0] = 0;\n v4 = -1;\n v5 = sub_180001340(a2, 5);\n v6 = v5;\n v43 = v6;\n v7 = (v5 + 67) & 0xFFFFFFFC;\n v8 = v5 + 15LL;\n if ( v8 <= v6 )\n v8 = 0xFFFFFFFFFFFFFF0LL;\n v9 = alloca(v8 & 0xFFFFFFFFFFFFFFF0uLL);\n if ( v6 > 0 )\n {\n v10 = 0;\n v11 = v6;\n do\n {\n v12 = v4;\n v13 = sub_180001340(a2, 4);\n v4 = v13;\n *((_BYTE *)v42 + v10) = v13;\n if ( v12 >= v13 )\n v4 = v12;\n ++v10;\n }\n while ( v10 < v11 );\n v3 = 0;\n }\n v14 = 11 * v4;\n v15 = v4 + 1LL;\n v16 = (v14 + v7 + 14) & 0xFFFFFFFC;\n v17 = v15 + 15;\n if ( v15 + 15 < (unsigned __int64)v15 )\n v17 = 0xFFFFFFFFFFFFFF0LL;\n v18 = alloca(v17 & 0xFFFFFFFFFFFFFFF0uLL);\n if ( v15 <= 0 )\n {\n v22 = *(_DWORD *)(a2 + 16);\n v26 = *(_QWORD *)a2;\n }\n else\n {\n for ( i = 0; i < v15; ++i )\n {\n *((_BYTE *)v42 + i) = sub_180001340(a2, 3) + 1;\n v20 = sub_180001340(a2, 2);\n if ( v20 )\n {\n v21 = *(_DWORD *)(a2 + 16) + 8;\n *(_DWORD *)(a2 + 16) = (*(_BYTE *)(a2 + 16) + 8) & 7;\n *(_QWORD *)a2 += (__int64)v21 >> 3;\n }\n v22 = *(_DWORD *)(a2 + 16);\n v23 = 1 << v20;\n if ( v23 <= 0 )\n {\n v26 = *(_QWORD *)a2;\n }\n else\n {\n v24 = (unsigned int)v23;\n do\n {\n v25 = v22 + 8;\n v22 = ((_BYTE)v22 + 8) & 7;\n v26 = *(_QWORD *)a2 + ((__int64)v25 >> 3);\n *(_QWORD *)a2 = v26;\n --v24;\n }\n while ( v24 );\n *(_DWORD *)(a2 + 16) = v22;\n }\n }\n }\n v27 = 0;\n v28 = 0;\n *(_DWORD *)(a2 + 16) = ((_BYTE)v22 + 2) & 7;\n *(_QWORD *)a2 = v26 + ((__int64)(v22 + 2) >> 3);\n v29 = sub_180001340(a2, 4);\n v30 = v43;\n v31 = v29;\n v32 = 0;\n if ( v43 >= 2 )\n {\n do\n {\n v33 = *((char *)v42 + v32 + 1);\n v27 += *((char *)v42 + *((char *)v42 + v32));\n v32 += 2;\n v28 += *((char *)v42 + v33);\n }\n while ( v32 < v43 - 1 );\n }\n if ( v32 >= v43 )\n v34 = v42[0];\n else\n v34 = *((char *)v42 + *((char *)v42 + v32));\n v35 = 0;\n v36 = (v27\n + v28\n + v34\n + ((v27 + v28 + v34 + ((v27 + v28 + v34 + ((v16 + 7 + 2 * (v27 + v28 + v34)) & 0xFFFFFFFC) + 5) & 0xFFFFFFFC) + 3)\n & 0xFFFFFFFC)\n + 3)\n & 0xFFFFFFFC;\n if ( v43 > 0 )\n {\n v37 = 0;\n do\n {\n v3 += *((char *)v42 + *((char *)v42 + v37));\n if ( v35 < v3 )\n {\n v38 = *(_DWORD *)(a2 + 16);\n v39 = (unsigned int)(v3 - v35);\n v35 = v3;\n do\n {\n v40 = (__int64)(v38 + v31) >> 3;\n v38 = ((_BYTE)v38 + (_BYTE)v31) & 7;\n *(_QWORD *)a2 += v40;\n --v39;\n }\n while ( v39 );\n *(_DWORD *)(a2 + 16) = v38;\n }\n ++v37;\n }\n while ( v37 < v30 );\n }\n if ( (unsigned int)sub_180001310((_QWORD *)a2) )\n return (unsigned int)-1;\n return v36;\n}", "assembly": "; \n; sub_180006380 from 0x180006380 to 0x18000663d (701 bytes)\n; \n; 2 xrefs:\n; > sub_180007A70 @ 0x180007b45\n; > @ 0x1801f6324\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\npush rbp ; +0x0, 0x180006380\npush r12 ; +0x2, 0x180006382\npush r13 ; +0x4, 0x180006384\npush r14 ; +0x6, 0x180006386\npush r15 ; +0x8, 0x180006388\nsub rsp, 40h ; +0xa, 0x18000638a\nlea rbp, [rsp+20h] ; +0xe, 0x18000638e\nmov [rbp+40h+arg_0], rbx ; +0x13, 0x180006393\nmov [rbp+40h+arg_8], rsi ; +0x17, 0x180006397\nmov [rbp+40h+arg_10], rdi ; +0x1b, 0x18000639b\nmov rax, cs:__security_cookie ; +0x1f, 0x18000639f\nxor rax, rbp ; +0x26, 0x1800063a6\nmov [rbp+40h+var_30], rax ; +0x29, 0x1800063a9\nmov rbx, rdx ; +0x2d, 0x1800063ad\nxor r15d, r15d ; +0x30, 0x1800063b0\nmov rcx, rbx ; +0x33, 0x1800063b3\nmov [rbp+40h+var_40], r15d ; +0x36, 0x1800063b6\nlea esi, [r15-1] ; +0x3a, 0x1800063ba\nlea edx, [rsi+6] ; +0x3e, 0x1800063be\ncall sub_180001340 ; +0x41, 0x1800063c1\nmovsxd rcx, eax ; +0x46, 0x1800063c6\nmov rdx, 0FFFFFFFFFFFFFF0h ; +0x49, 0x1800063c9\nmov [rbp+40h+var_38], rcx ; +0x53, 0x1800063d3\nlea r12d, [rax+43h] ; +0x57, 0x1800063d7\nand r12d, 0FFFFFFFCh ; +0x5b, 0x1800063db\nlea rax, [rcx+0Fh] ; +0x5f, 0x1800063df\ncmp rax, rcx ; +0x63, 0x1800063e3\nja short loc_1800063EB ; +0x66, 0x1800063e6\nmov rax, rdx ; +0x68, 0x1800063e8\nand rax, 0FFFFFFFFFFFFFFF0h ; +0x6b, 0x1800063eb\ncall __alloca_probe ; +0x6f, 0x1800063ef\nsub rsp, rax ; +0x74, 0x1800063f4\nlea r13, [rsp+60h+var_40] ; +0x77, 0x1800063f7\ntest rcx, rcx ; +0x7c, 0x1800063fc\njle short loc_180006440 ; +0x7f, 0x1800063ff\nmov r14, r15 ; +0x81, 0x180006401\nmov r15, rcx ; +0x84, 0x180006404\nnop word ptr [rax+rax+00000000h] ; +0x87, 0x180006407\nmov edx, 4 ; +0x90, 0x180006410\nmov rcx, rbx ; +0x95, 0x180006415\nmov edi, esi ; +0x98, 0x180006418\ncall sub_180001340 ; +0x9a, 0x18000641a\nmovsx esi, al ; +0x9f, 0x18000641f\ncmp edi, esi ; +0xa2, 0x180006422\nmov [r14+r13], al ; +0xa4, 0x180006424\ncmovge esi, edi ; +0xa8, 0x180006428\ninc r14 ; +0xab, 0x18000642b\ncmp r14, r15 ; +0xae, 0x18000642e\njl short loc_180006410 ; +0xb1, 0x180006431\nxor r15d, r15d ; +0xb3, 0x180006433\nmov rdx, 0FFFFFFFFFFFFFF0h ; +0xb6, 0x180006436\nimul eax, esi, 0Bh ; +0xc0, 0x180006440\nadd r12d, 0Eh ; +0xc3, 0x180006443\nmovsxd rsi, esi ; +0xc7, 0x180006447\ninc rsi ; +0xca, 0x18000644a\nadd r12d, eax ; +0xcd, 0x18000644d\nand r12d, 0FFFFFFFCh ; +0xd0, 0x180006450\nlea rax, [rsi+0Fh] ; +0xd4, 0x180006454\ncmp rax, rsi ; +0xd8, 0x180006458\nja short loc_180006460 ; +0xdb, 0x18000645b\nmov rax, rdx ; +0xdd, 0x18000645d\nand rax, 0FFFFFFFFFFFFFFF0h ; +0xe0, 0x180006460\ncall __alloca_probe ; +0xe4, 0x180006464\nsub rsp, rax ; +0xe9, 0x180006469\nlea r14, [rsp+60h+var_40] ; +0xec, 0x18000646c\ntest rsi, rsi ; +0xf1, 0x180006471\njle loc_1800064FD ; +0xf4, 0x180006474\nmov rdi, r15 ; +0xfa, 0x18000647a\nnop dword ptr [rax] ; +0xfd, 0x18000647d\nmov edx, 3 ; +0x100, 0x180006480\nmov rcx, rbx ; +0x105, 0x180006485\ncall sub_180001340 ; +0x108, 0x180006488\ninc al ; +0x10d, 0x18000648d\nmov edx, 2 ; +0x10f, 0x18000648f\nmov rcx, rbx ; +0x114, 0x180006494\nmov [rdi+r14], al ; +0x117, 0x180006497\ncall sub_180001340 ; +0x11b, 0x18000649b\ntest eax, eax ; +0x120, 0x1800064a0\njz short loc_1800064BC ; +0x122, 0x1800064a2\nmov edx, [rbx+10h] ; +0x124, 0x1800064a4\nadd edx, 8 ; +0x127, 0x1800064a7\nmov ecx, edx ; +0x12a, 0x1800064aa\nand ecx, 7 ; +0x12c, 0x1800064ac\nmov [rbx+10h], ecx ; +0x12f, 0x1800064af\nmovsxd rcx, edx ; +0x132, 0x1800064b2\nsar rcx, 3 ; +0x135, 0x1800064b5\nadd [rbx], rcx ; +0x139, 0x1800064b9\nmov edx, [rbx+10h] ; +0x13c, 0x1800064bc\nmov ecx, eax ; +0x13f, 0x1800064bf\nmov eax, 1 ; +0x141, 0x1800064c1\nshl eax, cl ; +0x146, 0x1800064c6\ntest eax, eax ; +0x148, 0x1800064c8\njle short loc_1800064F0 ; +0x14a, 0x1800064ca\nmov r9d, eax ; +0x14c, 0x1800064cc\nnop ; +0x14f, 0x1800064cf\nlea eax, [rdx+8] ; +0x150, 0x1800064d0\nmovsxd r8, eax ; +0x153, 0x1800064d3\nmov edx, eax ; +0x156, 0x1800064d6\nsar r8, 3 ; +0x158, 0x1800064d8\nand edx, 7 ; +0x15c, 0x1800064dc\nadd r8, [rbx] ; +0x15f, 0x1800064df\nmov [rbx], r8 ; +0x162, 0x1800064e2\nsub r9, 1 ; +0x165, 0x1800064e5\njnz short loc_1800064D0 ; +0x169, 0x1800064e9\nmov [rbx+10h], edx ; +0x16b, 0x1800064eb\njmp short loc_1800064F3 ; +0x16e, 0x1800064ee\nmov r8, [rbx] ; +0x170, 0x1800064f0\ninc rdi ; +0x173, 0x1800064f3\ncmp rdi, rsi ; +0x176, 0x1800064f6\njl short loc_180006480 ; +0x179, 0x1800064f9\njmp short loc_180006503 ; +0x17b, 0x1800064fb\nmov edx, [rbx+10h] ; +0x17d, 0x1800064fd\nmov r8, [rbx] ; +0x180, 0x180006500\nlea ecx, [rdx+2] ; +0x183, 0x180006503\nmov edi, r15d ; +0x186, 0x180006506\nmov eax, ecx ; +0x189, 0x180006509\nmov edx, 4 ; +0x18b, 0x18000650b\nand eax, 7 ; +0x190, 0x180006510\nmov esi, r15d ; +0x193, 0x180006513\nmov [rbx+10h], eax ; +0x196, 0x180006516\nmovsxd rax, ecx ; +0x199, 0x180006519\nmov rcx, rbx ; +0x19c, 0x18000651c\nsar rax, 3 ; +0x19f, 0x18000651f\nadd rax, r8 ; +0x1a3, 0x180006523\nmov [rbx], rax ; +0x1a6, 0x180006526\ncall sub_180001340 ; +0x1a9, 0x180006529\nmov r11, [rbp+40h+var_38] ; +0x1ae, 0x18000652e\nmov r10d, eax ; +0x1b2, 0x180006532\nmov r8, r15 ; +0x1b5, 0x180006535\ncmp r11, 2 ; +0x1b8, 0x180006538\njl short loc_180006572 ; +0x1bc, 0x18000653c\nlea rax, [r11-1] ; +0x1be, 0x18000653e\nnop dword ptr [rax+00h] ; +0x1c2, 0x180006542\nnop word ptr [rax+rax+00000000h] ; +0x1c6, 0x180006546\nmovsx rcx, byte ptr [r8+r13] ; +0x1d0, 0x180006550\nmovsx edx, byte ptr [rcx+r14] ; +0x1d5, 0x180006555\nmovsx rcx, byte ptr [r8+r13+1] ; +0x1da, 0x18000655a\nadd edi, edx ; +0x1e0, 0x180006560\nadd r8, 2 ; +0x1e2, 0x180006562\nmovsx edx, byte ptr [rcx+r14] ; +0x1e6, 0x180006566\nadd esi, edx ; +0x1eb, 0x18000656b\ncmp r8, rax ; +0x1ed, 0x18000656d\njl short loc_180006550 ; +0x1f0, 0x180006570\ncmp r8, r11 ; +0x1f2, 0x180006572\njge short loc_180006583 ; +0x1f5, 0x180006575\nmovsx rax, byte ptr [r8+r13] ; +0x1f7, 0x180006577\nmovsx edx, byte ptr [rax+r14] ; +0x1fc, 0x18000657c\njmp short loc_180006586 ; +0x201, 0x180006581\nmov edx, [rbp+40h+var_40] ; +0x203, 0x180006583\nlea eax, [rdi+rsi] ; +0x206, 0x180006586\nmov r9d, r15d ; +0x209, 0x180006589\nadd edx, eax ; +0x20c, 0x18000658c\nlea eax, [r12+7] ; +0x20e, 0x18000658e\nlea edi, [rax+rdx*2] ; +0x213, 0x180006593\nand edi, 0FFFFFFFCh ; +0x216, 0x180006596\nadd edi, 5 ; +0x219, 0x180006599\nadd edi, edx ; +0x21c, 0x18000659c\nand edi, 0FFFFFFFCh ; +0x21e, 0x18000659e\nadd edi, 3 ; +0x221, 0x1800065a1\nadd edi, edx ; +0x224, 0x1800065a4\nand edi, 0FFFFFFFCh ; +0x226, 0x1800065a6\nadd edi, 3 ; +0x229, 0x1800065a9\nadd edi, edx ; +0x22c, 0x1800065ac\nand edi, 0FFFFFFFCh ; +0x22e, 0x1800065ae\ntest r11, r11 ; +0x231, 0x1800065b1\njle short loc_180006603 ; +0x234, 0x1800065b4\nmov r8, r15 ; +0x236, 0x1800065b6\nnop dword ptr [rax+00000000h] ; +0x239, 0x1800065b9\nmovsx rax, byte ptr [r8+r13] ; +0x240, 0x1800065c0\nmovsx ecx, byte ptr [rax+r14] ; +0x245, 0x1800065c5\nadd r15d, ecx ; +0x24a, 0x1800065ca\ncmp r9d, r15d ; +0x24d, 0x1800065cd\njge short loc_1800065FB ; +0x250, 0x1800065d0\nmov ecx, [rbx+10h] ; +0x252, 0x1800065d2\nmov eax, r15d ; +0x255, 0x1800065d5\nsub eax, r9d ; +0x258, 0x1800065d8\nmov edx, eax ; +0x25b, 0x1800065db\nadd r9d, eax ; +0x25d, 0x1800065dd\nlea eax, [rcx+r10] ; +0x260, 0x1800065e0\nmov ecx, eax ; +0x264, 0x1800065e4\ncdqe ; +0x266, 0x1800065e6\nsar rax, 3 ; +0x268, 0x1800065e8\nand ecx, 7 ; +0x26c, 0x1800065ec\nadd [rbx], rax ; +0x26f, 0x1800065ef\nsub rdx, 1 ; +0x272, 0x1800065f2\njnz short loc_1800065E0 ; +0x276, 0x1800065f6\nmov [rbx+10h], ecx ; +0x278, 0x1800065f8\ninc r8 ; +0x27b, 0x1800065fb\ncmp r8, r11 ; +0x27e, 0x1800065fe\njl short loc_1800065C0 ; +0x281, 0x180006601\nmov rcx, rbx ; +0x283, 0x180006603\ncall sub_180001310 ; +0x286, 0x180006606\ntest eax, eax ; +0x28b, 0x18000660b\nmov eax, 0FFFFFFFFh ; +0x28d, 0x18000660d\ncmovnz edi, eax ; +0x292, 0x180006612\nmov eax, edi ; +0x295, 0x180006615\nmov rcx, [rbp+40h+var_30] ; +0x297, 0x180006617\nxor rcx, rbp; StackCookie ; +0x29b, 0x18000661b\ncall __security_check_cookie ; +0x29e, 0x18000661e\nmov rbx, [rbp+40h+arg_0] ; +0x2a3, 0x180006623\nmov rsi, [rbp+40h+arg_8] ; +0x2a7, 0x180006627\nmov rdi, [rbp+40h+arg_10] ; +0x2ab, 0x18000662b\nlea rsp, [rbp+20h] ; +0x2af, 0x18000662f\npop r15 ; +0x2b3, 0x180006633\npop r14 ; +0x2b5, 0x180006635\npop r13 ; +0x2b7, 0x180006637\npop r12 ; +0x2b9, 0x180006639\npop rbp ; +0x2bb, 0x18000663b\nretn ; +0x2bc, 0x18000663c", "xrefs": ["sub_180007A70 @ 0x180007b45", " @ 0x1801f6324"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}