; ; sub_180006A40 from 0x180006a40 to 0x180006eb9 (1145 bytes) ; ; 2 xrefs: ; > sub_180008050 @ 0x18000824e ; > @ 0x1801f633c ; ; This function is hookable on this platform! ; ; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA ; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings ; mov [rsp+arg_8], rbx ; +0x0, 0x180006a40 mov [rsp+arg_10], r8 ; +0x5, 0x180006a45 push rbp ; +0xa, 0x180006a4a push rsi ; +0xb, 0x180006a4b push rdi ; +0xc, 0x180006a4c push r12 ; +0xd, 0x180006a4d push r13 ; +0xf, 0x180006a4f push r14 ; +0x11, 0x180006a51 push r15 ; +0x13, 0x180006a53 sub rsp, 50h ; +0x15, 0x180006a55 mov rax, [rcx] ; +0x19, 0x180006a59 mov rbp, rdx ; +0x1c, 0x180006a5c mov edx, 1 ; +0x1f, 0x180006a5f mov r14, r9 ; +0x24, 0x180006a64 mov rsi, r8 ; +0x27, 0x180006a67 mov rcx, [rax+20h] ; +0x2a, 0x180006a6a movsxd rax, dword ptr [r8+38h] ; +0x2e, 0x180006a6e mov r15, [rcx+48h] ; +0x32, 0x180006a72 lea rcx, dword_1801A4200 ; +0x36, 0x180006a76 mov r13d, [rcx+rax*4-4] ; +0x3d, 0x180006a7d mov rcx, rbp ; +0x42, 0x180006a82 mov [rsp+88h+var_60], r13d ; +0x45, 0x180006a85 call sub_180001340 ; +0x4a, 0x180006a8a cmp eax, 1 ; +0x4f, 0x180006a8f jnz loc_180006E9F ; +0x52, 0x180006a92 lea ebx, [r13-1] ; +0x58, 0x180006a98 xor edx, edx ; +0x5c, 0x180006a9c mov eax, ebx ; +0x5e, 0x180006a9e test ebx, ebx ; +0x60, 0x180006aa0 jz short loc_180006ABF ; +0x62, 0x180006aa2 inc edx ; +0x64, 0x180006aa4 shr eax, 1 ; +0x66, 0x180006aa6 jnz short loc_180006AA4 ; +0x68, 0x180006aa8 mov rcx, rbp ; +0x6a, 0x180006aaa call sub_180001340 ; +0x6d, 0x180006aad mov [r14], eax ; +0x72, 0x180006ab2 xor edx, edx ; +0x75, 0x180006ab5 inc edx ; +0x77, 0x180006ab7 shr ebx, 1 ; +0x79, 0x180006ab9 jnz short loc_180006AB7 ; +0x7b, 0x180006abb jmp short loc_180006ACC ; +0x7d, 0x180006abd mov rcx, rbp ; +0x7f, 0x180006abf call sub_180001340 ; +0x82, 0x180006ac2 mov [r14], eax ; +0x87, 0x180006ac7 xor edx, edx ; +0x8a, 0x180006aca mov rcx, rbp ; +0x8c, 0x180006acc call sub_180001340 ; +0x8f, 0x180006acf xor r10d, r10d ; +0x94, 0x180006ad4 mov [r14+4], eax ; +0x97, 0x180006ad7 mov r12d, 2 ; +0x9b, 0x180006adb mov [rsp+88h+var_68], r10d ; +0xa1, 0x180006ae1 mov r8d, r12d ; +0xa6, 0x180006ae6 mov [rsp+88h+arg_0], r12d ; +0xa9, 0x180006ae9 cmp [rsi+30h], r10d ; +0xb1, 0x180006af1 jle loc_180006DB0 ; +0xb5, 0x180006af5 xor ecx, ecx ; +0xbb, 0x180006afb mov [rsp+88h+var_50], rcx ; +0xbd, 0x180006afd mov rax, [rsi+8] ; +0xc2, 0x180006b02 xor edi, edi ; +0xc6, 0x180006b06 movsx rcx, byte ptr [rax+rcx] ; +0xc8, 0x180006b08 mov rax, [rsi] ; +0xcd, 0x180006b0d mov esi, 1 ; +0xd0, 0x180006b10 imul rdx, rcx, 0Bh ; +0xd5, 0x180006b15 lea r9, [rax+3] ; +0xd9, 0x180006b19 add r9, rdx ; +0xdd, 0x180006b1d mov [rsp+88h+var_58], r9 ; +0xe0, 0x180006b20 movsx r12, byte ptr [rdx+rax+1] ; +0xe5, 0x180006b25 movsx r13, byte ptr [rdx+rax] ; +0xeb, 0x180006b2b mov ecx, r12d ; +0xf0, 0x180006b30 shl esi, cl ; +0xf3, 0x180006b33 test r12d, r12d ; +0xf5, 0x180006b35 jz short loc_180006B6B ; +0xf8, 0x180006b38 movzx eax, byte ptr [rdx+rax+2] ; +0xfa, 0x180006b3a mov rdx, rbp ; +0xff, 0x180006b3f imul rcx, rax, 78h ; 'x' ; +0x102, 0x180006b42 add rcx, r15 ; +0x106, 0x180006b46 call sub_1800013B0 ; +0x109, 0x180006b49 mov edi, eax ; +0x10e, 0x180006b4e cmp eax, 0FFFFFFFFh ; +0x110, 0x180006b50 jz loc_180006E9F ; +0x113, 0x180006b53 mov r9, [rsp+88h+var_58] ; +0x119, 0x180006b59 mov r8d, [rsp+88h+arg_0] ; +0x11e, 0x180006b5e mov r10d, [rsp+88h+var_68] ; +0x126, 0x180006b66 cmp r13d, 4 ; +0x12b, 0x180006b6b jnz loc_180006C44 ; +0x12f, 0x180006b6f movsxd rcx, edi ; +0x135, 0x180006b75 movsxd r8, esi ; +0x138, 0x180006b78 dec r8 ; +0x13b, 0x180006b7b and rcx, r8 ; +0x13e, 0x180006b7e mov rax, r8 ; +0x141, 0x180006b81 movzx r10d, byte ptr [rcx+r9] ; +0x144, 0x180006b84 mov ecx, r12d ; +0x149, 0x180006b89 sar edi, cl ; +0x14c, 0x180006b8c mov rcx, r12 ; +0x14e, 0x180006b8e movsxd rdx, edi ; +0x151, 0x180006b91 and rax, rdx ; +0x154, 0x180006b94 sar rdx, cl ; +0x157, 0x180006b97 movzx edi, byte ptr [rax+r9] ; +0x15a, 0x180006b9a mov rax, rdx ; +0x15f, 0x180006b9f sar rdx, cl ; +0x162, 0x180006ba2 and rax, r8 ; +0x165, 0x180006ba5 and rdx, r8 ; +0x168, 0x180006ba8 movzx esi, byte ptr [rax+r9] ; +0x16b, 0x180006bab movzx r12d, byte ptr [rdx+r9] ; +0x170, 0x180006bb0 cmp r10b, 0FFh ; +0x175, 0x180006bb5 jnz short loc_180006BBF ; +0x179, 0x180006bb9 xor eax, eax ; +0x17b, 0x180006bbb jmp short loc_180006BCE ; +0x17d, 0x180006bbd imul rcx, r10, 78h ; 'x' ; +0x17f, 0x180006bbf mov rdx, rbp ; +0x183, 0x180006bc3 add rcx, r15 ; +0x186, 0x180006bc6 call sub_1800013B0 ; +0x189, 0x180006bc9 movsxd rbx, [rsp+88h+arg_0] ; +0x18e, 0x180006bce mov [r14+rbx*4], eax ; +0x196, 0x180006bd6 cmp dil, 0FFh ; +0x19a, 0x180006bda jnz short loc_180006BE4 ; +0x19e, 0x180006bde xor eax, eax ; +0x1a0, 0x180006be0 jmp short loc_180006BF3 ; +0x1a2, 0x180006be2 imul rcx, rdi, 78h ; 'x' ; +0x1a4, 0x180006be4 mov rdx, rbp ; +0x1a8, 0x180006be8 add rcx, r15 ; +0x1ab, 0x180006beb call sub_1800013B0 ; +0x1ae, 0x180006bee mov [r14+rbx*4+4], eax ; +0x1b3, 0x180006bf3 cmp sil, 0FFh ; +0x1b8, 0x180006bf8 jnz short loc_180006C02 ; +0x1bc, 0x180006bfc xor eax, eax ; +0x1be, 0x180006bfe jmp short loc_180006C11 ; +0x1c0, 0x180006c00 imul rcx, rsi, 78h ; 'x' ; +0x1c2, 0x180006c02 mov rdx, rbp ; +0x1c6, 0x180006c06 add rcx, r15 ; +0x1c9, 0x180006c09 call sub_1800013B0 ; +0x1cc, 0x180006c0c mov [r14+rbx*4+8], eax ; +0x1d1, 0x180006c11 cmp r12d, 0FFh ; +0x1d6, 0x180006c16 jnz short loc_180006C2B ; +0x1dd, 0x180006c1d xor eax, eax ; +0x1df, 0x180006c1f mov [r14+rbx*4+0Ch], eax ; +0x1e1, 0x180006c21 jmp loc_180006D66 ; +0x1e6, 0x180006c26 imul rcx, r12, 78h ; 'x' ; +0x1eb, 0x180006c2b mov rdx, rbp ; +0x1ef, 0x180006c2f add rcx, r15 ; +0x1f2, 0x180006c32 call sub_1800013B0 ; +0x1f5, 0x180006c35 mov [r14+rbx*4+0Ch], eax ; +0x1fa, 0x180006c3a jmp loc_180006D66 ; +0x1ff, 0x180006c3f cmp r13d, 3 ; +0x204, 0x180006c44 jnz loc_180006CE9 ; +0x208, 0x180006c48 movsxd r8, edi ; +0x20e, 0x180006c4e mov rcx, r12 ; +0x211, 0x180006c51 movsxd rdx, esi ; +0x214, 0x180006c54 dec rdx ; +0x217, 0x180006c57 mov rax, rdx ; +0x21a, 0x180006c5a and rax, r8 ; +0x21d, 0x180006c5d sar r8, cl ; +0x220, 0x180006c60 movzx r10d, byte ptr [rax+r9] ; +0x223, 0x180006c63 mov rax, r8 ; +0x228, 0x180006c68 sar r8, cl ; +0x22b, 0x180006c6b and rax, rdx ; +0x22e, 0x180006c6e and r8, rdx ; +0x231, 0x180006c71 movzx edi, byte ptr [rax+r9] ; +0x234, 0x180006c74 movzx esi, byte ptr [r8+r9] ; +0x239, 0x180006c79 cmp r10b, 0FFh ; +0x23e, 0x180006c7e jnz short loc_180006C88 ; +0x242, 0x180006c82 xor eax, eax ; +0x244, 0x180006c84 jmp short loc_180006C97 ; +0x246, 0x180006c86 imul rcx, r10, 78h ; 'x' ; +0x248, 0x180006c88 mov rdx, rbp ; +0x24c, 0x180006c8c add rcx, r15 ; +0x24f, 0x180006c8f call sub_1800013B0 ; +0x252, 0x180006c92 movsxd rbx, [rsp+88h+arg_0] ; +0x257, 0x180006c97 mov [r14+rbx*4], eax ; +0x25f, 0x180006c9f cmp dil, 0FFh ; +0x263, 0x180006ca3 jnz short loc_180006CAD ; +0x267, 0x180006ca7 xor eax, eax ; +0x269, 0x180006ca9 jmp short loc_180006CBC ; +0x26b, 0x180006cab imul rcx, rdi, 78h ; 'x' ; +0x26d, 0x180006cad mov rdx, rbp ; +0x271, 0x180006cb1 add rcx, r15 ; +0x274, 0x180006cb4 call sub_1800013B0 ; +0x277, 0x180006cb7 mov [r14+rbx*4+4], eax ; +0x27c, 0x180006cbc cmp sil, 0FFh ; +0x281, 0x180006cc1 jnz short loc_180006CD3 ; +0x285, 0x180006cc5 xor eax, eax ; +0x287, 0x180006cc7 mov [r14+rbx*4+8], eax ; +0x289, 0x180006cc9 jmp loc_180006D66 ; +0x28e, 0x180006cce imul rcx, rsi, 78h ; 'x' ; +0x293, 0x180006cd3 mov rdx, rbp ; +0x297, 0x180006cd7 add rcx, r15 ; +0x29a, 0x180006cda call sub_1800013B0 ; +0x29d, 0x180006cdd mov [r14+rbx*4+8], eax ; +0x2a2, 0x180006ce2 jmp short loc_180006D66 ; +0x2a7, 0x180006ce7 test r13, r13 ; +0x2a9, 0x180006ce9 jle loc_180006D73 ; +0x2ac, 0x180006cec xor ebx, ebx ; +0x2b2, 0x180006cf2 movsxd rcx, esi ; +0x2b4, 0x180006cf4 dec rcx ; +0x2b7, 0x180006cf7 movsxd r8, r8d ; +0x2ba, 0x180006cfa mov [rsp+88h+var_40], rcx ; +0x2bd, 0x180006cfd mov [rsp+88h+var_48], r8 ; +0x2c2, 0x180006d02 nop word ptr [rax+rax+00000000h] ; +0x2c7, 0x180006d07 movsxd rax, edi ; +0x2d0, 0x180006d10 and rax, rcx ; +0x2d3, 0x180006d13 mov ecx, r12d ; +0x2d6, 0x180006d16 sar edi, cl ; +0x2d9, 0x180006d19 movzx edx, byte ptr [rax+r9] ; +0x2db, 0x180006d1b lea rax, [r8+rbx] ; +0x2e0, 0x180006d20 lea rsi, [r14+rax*4] ; +0x2e4, 0x180006d24 cmp dl, 0FFh ; +0x2e8, 0x180006d28 jz short loc_180006D53 ; +0x2eb, 0x180006d2b imul rcx, rdx, 78h ; 'x' ; +0x2ed, 0x180006d2d mov rdx, rbp ; +0x2f1, 0x180006d31 add rcx, r15 ; +0x2f4, 0x180006d34 call sub_1800013B0 ; +0x2f7, 0x180006d37 mov [rsi], eax ; +0x2fc, 0x180006d3c cmp eax, 0FFFFFFFFh ; +0x2fe, 0x180006d3e jz loc_180006E9F ; +0x301, 0x180006d41 mov r9, [rsp+88h+var_58] ; +0x307, 0x180006d47 mov r8, [rsp+88h+var_48] ; +0x30c, 0x180006d4c jmp short loc_180006D59 ; +0x311, 0x180006d51 mov dword ptr [rsi], 0 ; +0x313, 0x180006d53 mov rcx, [rsp+88h+var_40] ; +0x319, 0x180006d59 inc rbx ; +0x31e, 0x180006d5e cmp rbx, r13 ; +0x321, 0x180006d61 jl short loc_180006D10 ; +0x324, 0x180006d64 mov r8d, [rsp+88h+arg_0] ; +0x326, 0x180006d66 mov r10d, [rsp+88h+var_68] ; +0x32e, 0x180006d6e mov rcx, [rsp+88h+var_50] ; +0x333, 0x180006d73 add r8d, r13d ; +0x338, 0x180006d78 mov rsi, [rsp+88h+arg_10] ; +0x33b, 0x180006d7b inc r10d ; +0x343, 0x180006d83 inc rcx ; +0x346, 0x180006d86 mov [rsp+88h+arg_0], r8d ; +0x349, 0x180006d89 mov [rsp+88h+var_68], r10d ; +0x351, 0x180006d91 mov [rsp+88h+var_50], rcx ; +0x356, 0x180006d96 cmp r10d, [rsi+30h] ; +0x35b, 0x180006d9b jl loc_180006B02 ; +0x35f, 0x180006d9f mov r13d, [rsp+88h+var_60] ; +0x365, 0x180006da5 mov r12d, 2 ; +0x36a, 0x180006daa cmp dword ptr [rsi+34h], 2 ; +0x370, 0x180006db0 jle loc_180006E9A ; +0x374, 0x180006db4 mov rdi, r12 ; +0x37a, 0x180006dba nop dword ptr [rax] ; +0x37d, 0x180006dbd mov r9, [rsi+10h] ; +0x380, 0x180006dc0 mov rax, [rsi+28h] ; +0x384, 0x180006dc4 movsx rcx, byte ptr [rdi+rax-2] ; +0x388, 0x180006dc8 mov rax, [rsi+20h] ; +0x38e, 0x180006dce mov ebx, [r14+rcx*4] ; +0x392, 0x180006dd2 movsx r8, byte ptr [rax+rdi-2] ; +0x396, 0x180006dd6 and ebx, 7FFFh ; +0x39c, 0x180006ddc movzx r10d, word ptr [r9+rcx*2] ; +0x3a2, 0x180006de2 movzx ecx, word ptr [r9+rdi*2] ; +0x3a7, 0x180006de7 sub ecx, r10d ; +0x3ac, 0x180006dec mov r11d, [r14+r8*4] ; +0x3af, 0x180006def and r11d, 7FFFh ; +0x3b3, 0x180006df3 sub r11d, ebx ; +0x3ba, 0x180006dfa mov eax, r11d ; +0x3bd, 0x180006dfd cdq ; +0x3c0, 0x180006e00 xor eax, edx ; +0x3c1, 0x180006e01 sub eax, edx ; +0x3c3, 0x180006e03 imul eax, ecx ; +0x3c5, 0x180006e05 movzx ecx, word ptr [r9+r8*2] ; +0x3c8, 0x180006e08 sub ecx, r10d ; +0x3cd, 0x180006e0d cdq ; +0x3d0, 0x180006e10 idiv ecx ; +0x3d1, 0x180006e11 mov edx, r13d ; +0x3d3, 0x180006e13 lea ecx, [rax+rbx] ; +0x3d6, 0x180006e16 sub ebx, eax ; +0x3d9, 0x180006e19 mov eax, [r14+rdi*4] ; +0x3db, 0x180006e1b test r11d, r11d ; +0x3df, 0x180006e1f cmovns ebx, ecx ; +0x3e2, 0x180006e22 sub edx, ebx ; +0x3e5, 0x180006e25 test eax, eax ; +0x3e7, 0x180006e27 jz short loc_180006E82 ; +0x3e9, 0x180006e29 cmp edx, ebx ; +0x3eb, 0x180006e2b mov ecx, ebx ; +0x3ed, 0x180006e2d cmovl ecx, edx ; +0x3ef, 0x180006e2f add ecx, ecx ; +0x3f2, 0x180006e32 cmp eax, ecx ; +0x3f4, 0x180006e34 jl short loc_180006E47 ; +0x3f6, 0x180006e36 cmp edx, ebx ; +0x3f8, 0x180006e38 jle short loc_180006E40 ; +0x3fa, 0x180006e3a sub eax, ebx ; +0x3fc, 0x180006e3c jmp short loc_180006E55 ; +0x3fe, 0x180006e3e sub edx, eax ; +0x400, 0x180006e40 lea eax, [rdx-1] ; +0x402, 0x180006e42 jmp short loc_180006E55 ; +0x405, 0x180006e45 test al, 1 ; +0x407, 0x180006e47 jz short loc_180006E53 ; +0x409, 0x180006e49 inc eax ; +0x40b, 0x180006e4b sar eax, 1 ; +0x40d, 0x180006e4d neg eax ; +0x40f, 0x180006e4f jmp short loc_180006E55 ; +0x411, 0x180006e51 sar eax, 1 ; +0x413, 0x180006e53 lea ecx, [rbx+rax] ; +0x415, 0x180006e55 mov [r14+rdi*4], ecx ; +0x418, 0x180006e58 mov rax, [rsi+28h] ; +0x41c, 0x180006e5c movsx rcx, byte ptr [rdi+rax-2] ; +0x420, 0x180006e60 and dword ptr [r14+rcx*4], 7FFFh ; +0x426, 0x180006e66 mov rax, [rsi+20h] ; +0x42e, 0x180006e6e movsx rcx, byte ptr [rax+rdi-2] ; +0x432, 0x180006e72 and dword ptr [r14+rcx*4], 7FFFh ; +0x438, 0x180006e78 jmp short loc_180006E8A ; +0x440, 0x180006e80 bts ebx, 0Fh ; +0x442, 0x180006e82 mov [r14+rdi*4], ebx ; +0x446, 0x180006e86 inc r12d ; +0x44a, 0x180006e8a inc rdi ; +0x44d, 0x180006e8d cmp r12d, [rsi+34h] ; +0x450, 0x180006e90 jl loc_180006DC0 ; +0x454, 0x180006e94 mov rax, r14 ; +0x45a, 0x180006e9a jmp short loc_180006EA1 ; +0x45d, 0x180006e9d xor eax, eax ; +0x45f, 0x180006e9f mov rbx, [rsp+88h+arg_8] ; +0x461, 0x180006ea1 add rsp, 50h ; +0x469, 0x180006ea9 pop r15 ; +0x46d, 0x180006ead pop r14 ; +0x46f, 0x180006eaf pop r13 ; +0x471, 0x180006eb1 pop r12 ; +0x473, 0x180006eb3 pop rdi ; +0x475, 0x180006eb5 pop rsi ; +0x476, 0x180006eb6 pop rbp ; +0x477, 0x180006eb7 retn ; +0x478, 0x180006eb8