; ; sub_180006ED0 from 0x180006ed0 to 0x180007119 (585 bytes) ; ; 2 xrefs: ; > sub_180006640 @ 0x18000697f ; > @ 0x1801f6348 ; ; This function is hookable on this platform! ; ; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA ; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings ; push rbp ; +0x0, 0x180006ed0 push r12 ; +0x2, 0x180006ed2 push r13 ; +0x4, 0x180006ed4 push r14 ; +0x6, 0x180006ed6 push r15 ; +0x8, 0x180006ed8 sub rsp, 60h ; +0xa, 0x180006eda lea rbp, [rsp+20h] ; +0xe, 0x180006ede mov [rbp+60h+arg_0], rbx ; +0x13, 0x180006ee3 mov [rbp+60h+arg_8], rsi ; +0x17, 0x180006ee7 mov [rbp+60h+arg_10], rdi ; +0x1b, 0x180006eeb mov rax, cs:__security_cookie ; +0x22, 0x180006ef2 xor rax, rbp ; +0x29, 0x180006ef9 mov [rbp+60h+var_30], rax ; +0x2c, 0x180006efc movzx esi, r8w ; +0x30, 0x180006f00 mov rdi, rcx ; +0x34, 0x180006f04 mov [rbp+60h+var_60], si ; +0x37, 0x180006f07 mov r8d, esi ; +0x3b, 0x180006f0b mov [rbp+60h+var_48], rdx ; +0x3e, 0x180006f0e mov [rbp+60h+var_38], rcx ; +0x42, 0x180006f12 lea rax, [rsi+0Fh] ; +0x46, 0x180006f16 cmp rax, rsi ; +0x4a, 0x180006f1a ja short loc_180006F29 ; +0x4d, 0x180006f1d mov rax, 0FFFFFFFFFFFFFF0h ; +0x4f, 0x180006f1f and rax, 0FFFFFFFFFFFFFFF0h ; +0x59, 0x180006f29 call __alloca_probe ; +0x5d, 0x180006f2d sub rsp, rax ; +0x62, 0x180006f32 mov ecx, 1 ; +0x65, 0x180006f35 xor eax, eax ; +0x6a, 0x180006f3a mov [rbp+60h+var_58], ecx ; +0x6c, 0x180006f3c lea rbx, [rsp+80h+var_60] ; +0x6f, 0x180006f3f cmp cx, si ; +0x74, 0x180006f44 jnb loc_1800070C9 ; +0x77, 0x180006f47 mov r10d, esi ; +0x7d, 0x180006f4d mov [rbp+60h+var_50], esi ; +0x80, 0x180006f50 movzx r11d, cx ; +0x83, 0x180006f53 mov [rbp+60h+var_4C], r11d ; +0x87, 0x180006f57 cmp r11d, r10d ; +0x8b, 0x180006f5b jnb loc_180007072 ; +0x8e, 0x180006f5e lea ecx, [r11+r11] ; +0x94, 0x180006f64 jmp short loc_180006F74 ; +0x98, 0x180006f68 align 10h ; +0x9a, 0x180006f6a mov rdx, [rbp+60h+var_48] ; +0xa0, 0x180006f70 movzx esi, ax ; +0xa4, 0x180006f74 add ecx, esi ; +0xa7, 0x180006f77 mov r12d, esi ; +0xa9, 0x180006f79 cmp ecx, r10d ; +0xac, 0x180006f7c lea r9d, [rsi+r11] ; +0xaf, 0x180006f7f cmovnb ecx, r10d ; +0xb3, 0x180006f83 mov r15d, r9d ; +0xb7, 0x180006f87 mov [rbp+60h+var_5C], r9d ; +0xba, 0x180006f8a mov r14d, ecx ; +0xbe, 0x180006f8e cmp rsi, r15 ; +0xc1, 0x180006f91 jnb loc_180007017 ; +0xc4, 0x180006f94 mov r13d, r15d ; +0xca, 0x180006f9a nop dword ptr [rax] ; +0xcd, 0x180006f9d mov [rbp+60h+var_54], esi ; +0xd0, 0x180006fa0 cmp r13, r14 ; +0xd3, 0x180006fa3 jge short loc_18000700B ; +0xd6, 0x180006fa6 movzx r11d, byte ptr [r12+rdi] ; +0xd8, 0x180006fa8 lea r8d, [rax+1] ; +0xdd, 0x180006fad movzx r10d, byte ptr [rdi+r13] ; +0xe1, 0x180006fb1 mov esi, [rbp+60h+var_5C] ; +0xe6, 0x180006fb6 movsx rcx, r11b ; +0xe9, 0x180006fb9 movzx r9d, word ptr [rdx+rcx*2] ; +0xed, 0x180006fbd movsx rcx, r10b ; +0xf2, 0x180006fc2 movzx edx, word ptr [rdx+rcx*2] ; +0xf6, 0x180006fc6 mov rcx, r12 ; +0xfa, 0x180006fca cmp r9w, dx ; +0xfd, 0x180006fcd mov rdx, [rbp+60h+var_48] ; +0x101, 0x180006fd1 cmovnb r11d, r10d ; +0x105, 0x180006fd5 lea r12, [rcx+1] ; +0x109, 0x180006fd9 cmovnb r12, rcx ; +0x10d, 0x180006fdd lea rcx, [r13+1] ; +0x111, 0x180006fe1 cmovnb r13, rcx ; +0x115, 0x180006fe5 lea ecx, [rsi+1] ; +0x119, 0x180006fe9 cmovnb esi, ecx ; +0x11c, 0x180006fec mov ecx, [rbp+60h+var_54] ; +0x11f, 0x180006fef mov [rbp+60h+var_5C], esi ; +0x122, 0x180006ff2 lea esi, [rcx+1] ; +0x125, 0x180006ff5 cmovnb esi, ecx ; +0x128, 0x180006ff8 movzx ecx, ax ; +0x12b, 0x180006ffb movzx eax, r8w ; +0x12e, 0x180006ffe mov [rcx+rbx], r11b ; +0x132, 0x180007002 cmp r12, r15 ; +0x136, 0x180007006 jl short loc_180006FA0 ; +0x139, 0x180007009 mov r9d, [rbp+60h+var_5C] ; +0x13b, 0x18000700b mov r10d, [rbp+60h+var_50] ; +0x13f, 0x18000700f mov r11d, [rbp+60h+var_4C] ; +0x143, 0x180007013 movsxd r8, esi ; +0x147, 0x180007017 cmp r8, r15 ; +0x14a, 0x18000701a jge short loc_180007036 ; +0x14d, 0x18000701d nop ; +0x14f, 0x18000701f movzx ecx, byte ptr [r8+rdi] ; +0x150, 0x180007020 inc r8 ; +0x155, 0x180007025 movzx edx, ax ; +0x158, 0x180007028 inc ax ; +0x15b, 0x18000702b mov [rdx+rbx], cl ; +0x15e, 0x18000702e cmp r8, r15 ; +0x161, 0x180007031 jl short loc_180007020 ; +0x164, 0x180007034 movsxd r8, r9d ; +0x166, 0x180007036 cmp r8, r14 ; +0x169, 0x180007039 jge short loc_180007056 ; +0x16c, 0x18000703c xchg ax, ax ; +0x16e, 0x18000703e movzx ecx, byte ptr [r8+rdi] ; +0x170, 0x180007040 inc r8 ; +0x175, 0x180007045 movzx edx, ax ; +0x178, 0x180007048 inc ax ; +0x17b, 0x18000704b mov [rdx+rbx], cl ; +0x17e, 0x18000704e cmp r8, r14 ; +0x181, 0x180007051 jl short loc_180007040 ; +0x184, 0x180007054 movzx ecx, ax ; +0x186, 0x180007056 add ecx, r11d ; +0x189, 0x180007059 cmp ecx, r10d ; +0x18c, 0x18000705c lea ecx, [r11+r11] ; +0x18f, 0x18000705f jb loc_180006F70 ; +0x193, 0x180007063 movzx esi, [rbp+60h+var_60] ; +0x199, 0x180007069 cmp ax, si ; +0x19d, 0x18000706d jnb short loc_1800070A1 ; +0x1a0, 0x180007070 movzx edx, ax ; +0x1a2, 0x180007072 mov r9, rdi ; +0x1a5, 0x180007075 add rdx, rbx ; +0x1a8, 0x180007078 sub r9, rbx ; +0x1ab, 0x18000707b movzx ecx, si ; +0x1ae, 0x18000707e sub cx, ax ; +0x1b1, 0x180007081 movzx r8d, cx ; +0x1b4, 0x180007084 nop dword ptr [rax+rax+00000000h] ; +0x1b8, 0x180007088 movzx eax, byte ptr [r9+rdx] ; +0x1c0, 0x180007090 mov [rdx], al ; +0x1c5, 0x180007095 lea rdx, [rdx+1] ; +0x1c7, 0x180007097 sub r8, 1 ; +0x1cb, 0x18000709b jnz short loc_180007090 ; +0x1cf, 0x18000709f mov ecx, [rbp+60h+var_58] ; +0x1d1, 0x1800070a1 mov rax, rdi ; +0x1d4, 0x1800070a4 mov rdx, [rbp+60h+var_48] ; +0x1d7, 0x1800070a7 add cx, cx ; +0x1db, 0x1800070ab mov [rbp+60h+var_58], ecx ; +0x1de, 0x1800070ae mov rdi, rbx ; +0x1e1, 0x1800070b1 mov rbx, rax ; +0x1e4, 0x1800070b4 mov eax, 0 ; +0x1e7, 0x1800070b7 cmp cx, si ; +0x1ec, 0x1800070bc jb loc_180006F53 ; +0x1ef, 0x1800070bf movzx r8d, si ; +0x1f5, 0x1800070c5 cmp rbx, [rbp+60h+var_38] ; +0x1f9, 0x1800070c9 jnz short loc_1800070F0 ; +0x1fd, 0x1800070cd cmp ax, si ; +0x1ff, 0x1800070cf jnb short loc_1800070F0 ; +0x202, 0x1800070d2 sub rdi, rbx ; +0x204, 0x1800070d4 nop word ptr [rax+rax+00000000h] ; +0x207, 0x1800070d7 movzx eax, byte ptr [rbx+rdi] ; +0x210, 0x1800070e0 mov [rbx], al ; +0x214, 0x1800070e4 lea rbx, [rbx+1] ; +0x216, 0x1800070e6 sub r8, 1 ; +0x21a, 0x1800070ea jnz short loc_1800070E0 ; +0x21e, 0x1800070ee mov rcx, [rbp+60h+var_30] ; +0x220, 0x1800070f0 xor rcx, rbp; StackCookie ; +0x224, 0x1800070f4 call __security_check_cookie ; +0x227, 0x1800070f7 mov rbx, [rbp+60h+arg_0] ; +0x22c, 0x1800070fc mov rsi, [rbp+60h+arg_8] ; +0x230, 0x180007100 mov rdi, [rbp+60h+arg_10] ; +0x234, 0x180007104 lea rsp, [rbp+40h] ; +0x23b, 0x18000710b pop r15 ; +0x23f, 0x18000710f pop r14 ; +0x241, 0x180007111 pop r13 ; +0x243, 0x180007113 pop r12 ; +0x245, 0x180007115 pop rbp ; +0x247, 0x180007117 retn ; +0x248, 0x180007118