{"type": "func", "start": 6442479312, "end": 6442479897, "name": "sub_180006ED0", "pseudocode": "// \n// sub_180006ED0 from 0x180006ed0 to 0x180007119 (585 bytes)\n// \n// 2 xrefs:\n// > sub_180006640 @ 0x18000697f\n// > @ 0x1801f6348\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\n__int64 __fastcall sub_180006ED0(unsigned __int16 *a1, __int64 a2, __int64 a3)\n{\n unsigned __int16 v3; // si\n unsigned __int16 *v4; // rdi\n unsigned __int64 v5; // rax\n void *v6; // rsp\n int v7; // ecx\n __int64 result; // rax\n unsigned __int16 *v9; // rbx\n unsigned int v10; // r10d\n int v11; // r11d\n int v12; // ecx\n int v13; // esi\n unsigned int v14; // ecx\n __int64 v15; // r12\n unsigned int v16; // r9d\n __int64 v17; // r15\n __int64 v18; // r14\n __int64 v19; // r13\n char v20; // r11\n unsigned int v21; // esi\n __int64 v22; // rcx\n bool v23; // cf\n __int64 v24; // rcx\n __int64 i; // r8\n char v26; // cl\n __int64 v27; // rdx\n __int64 j; // r8\n char v29; // cl\n __int64 v30; // rdx\n _BYTE *v31; // rdx\n __int64 v32; // r8\n unsigned __int16 *v33; // rax\n signed __int64 v34; // rdi\n unsigned __int16 v35; // [rsp+20h] [rbp+0h] BYREF\n unsigned int v36; // [rsp+24h] [rbp+4h]\n int v37; // [rsp+28h] [rbp+8h]\n int v38; // [rsp+2Ch] [rbp+Ch]\n unsigned int v39; // [rsp+30h] [rbp+10h]\n int v40; // [rsp+34h] [rbp+14h]\n __int64 v41; // [rsp+38h] [rbp+18h]\n unsigned __int16 *v42; // [rsp+48h] [rbp+28h]\n\n v3 = a3;\n v4 = a1;\n v35 = a3;\n a3 = (unsigned __int16)a3;\n v41 = a2;\n v42 = a1;\n v5 = (unsigned __int16)a3 + 15LL;\n if ( v5 <= (unsigned __int16)a3 )\n v5 = 0xFFFFFFFFFFFFFF0LL;\n v6 = alloca(v5 & 0xFFFFFFFFFFFFFFF0uLL);\n LOWORD(v7) = 1;\n result = 0;\n v37 = 1;\n v9 = &v35;\n if ( (unsigned __int16)a3 > 1u )\n {\n v10 = (unsigned __int16)a3;\n v39 = (unsigned __int16)a3;\n do\n {\n v11 = (unsigned __int16)v7;\n v40 = (unsigned __int16)v7;\n if ( (unsigned __int16)v7 >= v10 )\n goto LABEL_27;\n v12 = 2 * (unsigned __int16)v7;\n while ( 1 )\n {\n v13 = (unsigned __int16)result;\n v14 = (unsigned __int16)result + v12;\n v15 = (unsigned __int16)result;\n v16 = (unsigned __int16)result + v11;\n if ( v14 >= v10 )\n v14 = v10;\n v17 = v16;\n v36 = (unsigned __int16)result + v11;\n v18 = v14;\n if ( (unsigned __int16)result < (unsigned __int64)v16 )\n {\n v19 = v16;\n do\n {\n v38 = v13;\n if ( v19 >= v18 )\n break;\n v20 = *((_BYTE *)v4 + v15);\n v21 = v36;\n v22 = v15;\n v23 = *(_WORD *)(a2 + 2LL * v20) < *(_WORD *)(a2 + 2LL * *((char *)v4 + v19));\n a2 = v41;\n if ( !v23 )\n v20 = *((_BYTE *)v4 + v19);\n ++v15;\n if ( !v23 )\n {\n v15 = v22;\n ++v19;\n v21 = v36 + 1;\n }\n v36 = v21;\n v13 = v38 + 1;\n if ( !v23 )\n v13 = v38;\n v24 = (unsigned __int16)result;\n LOWORD(result) = result + 1;\n *((_BYTE *)v9 + v24) = v20;\n }\n while ( v15 < v16 );\n v16 = v36;\n v10 = v39;\n v11 = v40;\n }\n for ( i = v13; i < v17; *((_BYTE *)v9 + v27) = v26 )\n {\n v26 = *((_BYTE *)v4 + i++);\n v27 = (unsigned __int16)result;\n LOWORD(result) = result + 1;\n }\n for ( j = (int)v16; j < v18; *((_BYTE *)v9 + v30) = v29 )\n {\n v29 = *((_BYTE *)v4 + j++);\n v30 = (unsigned __int16)result;\n LOWORD(result) = result + 1;\n }\n v12 = 2 * v11;\n if ( v11 + (unsigned int)(unsigned __int16)result >= v10 )\n break;\n a2 = v41;\n }\n v3 = v35;\n if ( (unsigned __int16)result < v35 )\n {\nLABEL_27:\n v31 = (char *)v9 + (unsigned __int16)result;\n v32 = (unsigned __int16)(v3 - result);\n do\n {\n *v31 = v31[(char *)v4 - (char *)v9];\n ++v31;\n --v32;\n }\n while ( v32 );\n }\n HIWORD(v7) = HIWORD(v37);\n v33 = v4;\n a2 = v41;\n LOWORD(v7) = 2 * v37;\n v37 = v7;\n v4 = v9;\n v9 = v33;\n result = 0;\n }\n while ( (unsigned __int16)v7 < v3 );\n a3 = v3;\n }\n if ( v9 == v42 && v3 )\n {\n v34 = (char *)v4 - (char *)v9;\n do\n {\n result = *((unsigned __int8 *)v9 + v34);\n *(_BYTE *)v9 = result;\n v9 = (unsigned __int16 *)((char *)v9 + 1);\n --a3;\n }\n while ( a3 );\n }\n return result;\n}", "assembly": "; \n; sub_180006ED0 from 0x180006ed0 to 0x180007119 (585 bytes)\n; \n; 2 xrefs:\n; > sub_180006640 @ 0x18000697f\n; > @ 0x1801f6348\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\npush rbp ; +0x0, 0x180006ed0\npush r12 ; +0x2, 0x180006ed2\npush r13 ; +0x4, 0x180006ed4\npush r14 ; +0x6, 0x180006ed6\npush r15 ; +0x8, 0x180006ed8\nsub rsp, 60h ; +0xa, 0x180006eda\nlea rbp, [rsp+20h] ; +0xe, 0x180006ede\nmov [rbp+60h+arg_0], rbx ; +0x13, 0x180006ee3\nmov [rbp+60h+arg_8], rsi ; +0x17, 0x180006ee7\nmov [rbp+60h+arg_10], rdi ; +0x1b, 0x180006eeb\nmov rax, cs:__security_cookie ; +0x22, 0x180006ef2\nxor rax, rbp ; +0x29, 0x180006ef9\nmov [rbp+60h+var_30], rax ; +0x2c, 0x180006efc\nmovzx esi, r8w ; +0x30, 0x180006f00\nmov rdi, rcx ; +0x34, 0x180006f04\nmov [rbp+60h+var_60], si ; +0x37, 0x180006f07\nmov r8d, esi ; +0x3b, 0x180006f0b\nmov [rbp+60h+var_48], rdx ; +0x3e, 0x180006f0e\nmov [rbp+60h+var_38], rcx ; +0x42, 0x180006f12\nlea rax, [rsi+0Fh] ; +0x46, 0x180006f16\ncmp rax, rsi ; +0x4a, 0x180006f1a\nja short loc_180006F29 ; +0x4d, 0x180006f1d\nmov rax, 0FFFFFFFFFFFFFF0h ; +0x4f, 0x180006f1f\nand rax, 0FFFFFFFFFFFFFFF0h ; +0x59, 0x180006f29\ncall __alloca_probe ; +0x5d, 0x180006f2d\nsub rsp, rax ; +0x62, 0x180006f32\nmov ecx, 1 ; +0x65, 0x180006f35\nxor eax, eax ; +0x6a, 0x180006f3a\nmov [rbp+60h+var_58], ecx ; +0x6c, 0x180006f3c\nlea rbx, [rsp+80h+var_60] ; +0x6f, 0x180006f3f\ncmp cx, si ; +0x74, 0x180006f44\njnb loc_1800070C9 ; +0x77, 0x180006f47\nmov r10d, esi ; +0x7d, 0x180006f4d\nmov [rbp+60h+var_50], esi ; +0x80, 0x180006f50\nmovzx r11d, cx ; +0x83, 0x180006f53\nmov [rbp+60h+var_4C], r11d ; +0x87, 0x180006f57\ncmp r11d, r10d ; +0x8b, 0x180006f5b\njnb loc_180007072 ; +0x8e, 0x180006f5e\nlea ecx, [r11+r11] ; +0x94, 0x180006f64\njmp short loc_180006F74 ; +0x98, 0x180006f68\nalign 10h ; +0x9a, 0x180006f6a\nmov rdx, [rbp+60h+var_48] ; +0xa0, 0x180006f70\nmovzx esi, ax ; +0xa4, 0x180006f74\nadd ecx, esi ; +0xa7, 0x180006f77\nmov r12d, esi ; +0xa9, 0x180006f79\ncmp ecx, r10d ; +0xac, 0x180006f7c\nlea r9d, [rsi+r11] ; +0xaf, 0x180006f7f\ncmovnb ecx, r10d ; +0xb3, 0x180006f83\nmov r15d, r9d ; +0xb7, 0x180006f87\nmov [rbp+60h+var_5C], r9d ; +0xba, 0x180006f8a\nmov r14d, ecx ; +0xbe, 0x180006f8e\ncmp rsi, r15 ; +0xc1, 0x180006f91\njnb loc_180007017 ; +0xc4, 0x180006f94\nmov r13d, r15d ; +0xca, 0x180006f9a\nnop dword ptr [rax] ; +0xcd, 0x180006f9d\nmov [rbp+60h+var_54], esi ; +0xd0, 0x180006fa0\ncmp r13, r14 ; +0xd3, 0x180006fa3\njge short loc_18000700B ; +0xd6, 0x180006fa6\nmovzx r11d, byte ptr [r12+rdi] ; +0xd8, 0x180006fa8\nlea r8d, [rax+1] ; +0xdd, 0x180006fad\nmovzx r10d, byte ptr [rdi+r13] ; +0xe1, 0x180006fb1\nmov esi, [rbp+60h+var_5C] ; +0xe6, 0x180006fb6\nmovsx rcx, r11b ; +0xe9, 0x180006fb9\nmovzx r9d, word ptr [rdx+rcx*2] ; +0xed, 0x180006fbd\nmovsx rcx, r10b ; +0xf2, 0x180006fc2\nmovzx edx, word ptr [rdx+rcx*2] ; +0xf6, 0x180006fc6\nmov rcx, r12 ; +0xfa, 0x180006fca\ncmp r9w, dx ; +0xfd, 0x180006fcd\nmov rdx, [rbp+60h+var_48] ; +0x101, 0x180006fd1\ncmovnb r11d, r10d ; +0x105, 0x180006fd5\nlea r12, [rcx+1] ; +0x109, 0x180006fd9\ncmovnb r12, rcx ; +0x10d, 0x180006fdd\nlea rcx, [r13+1] ; +0x111, 0x180006fe1\ncmovnb r13, rcx ; +0x115, 0x180006fe5\nlea ecx, [rsi+1] ; +0x119, 0x180006fe9\ncmovnb esi, ecx ; +0x11c, 0x180006fec\nmov ecx, [rbp+60h+var_54] ; +0x11f, 0x180006fef\nmov [rbp+60h+var_5C], esi ; +0x122, 0x180006ff2\nlea esi, [rcx+1] ; +0x125, 0x180006ff5\ncmovnb esi, ecx ; +0x128, 0x180006ff8\nmovzx ecx, ax ; +0x12b, 0x180006ffb\nmovzx eax, r8w ; +0x12e, 0x180006ffe\nmov [rcx+rbx], r11b ; +0x132, 0x180007002\ncmp r12, r15 ; +0x136, 0x180007006\njl short loc_180006FA0 ; +0x139, 0x180007009\nmov r9d, [rbp+60h+var_5C] ; +0x13b, 0x18000700b\nmov r10d, [rbp+60h+var_50] ; +0x13f, 0x18000700f\nmov r11d, [rbp+60h+var_4C] ; +0x143, 0x180007013\nmovsxd r8, esi ; +0x147, 0x180007017\ncmp r8, r15 ; +0x14a, 0x18000701a\njge short loc_180007036 ; +0x14d, 0x18000701d\nnop ; +0x14f, 0x18000701f\nmovzx ecx, byte ptr [r8+rdi] ; +0x150, 0x180007020\ninc r8 ; +0x155, 0x180007025\nmovzx edx, ax ; +0x158, 0x180007028\ninc ax ; +0x15b, 0x18000702b\nmov [rdx+rbx], cl ; +0x15e, 0x18000702e\ncmp r8, r15 ; +0x161, 0x180007031\njl short loc_180007020 ; +0x164, 0x180007034\nmovsxd r8, r9d ; +0x166, 0x180007036\ncmp r8, r14 ; +0x169, 0x180007039\njge short loc_180007056 ; +0x16c, 0x18000703c\nxchg ax, ax ; +0x16e, 0x18000703e\nmovzx ecx, byte ptr [r8+rdi] ; +0x170, 0x180007040\ninc r8 ; +0x175, 0x180007045\nmovzx edx, ax ; +0x178, 0x180007048\ninc ax ; +0x17b, 0x18000704b\nmov [rdx+rbx], cl ; +0x17e, 0x18000704e\ncmp r8, r14 ; +0x181, 0x180007051\njl short loc_180007040 ; +0x184, 0x180007054\nmovzx ecx, ax ; +0x186, 0x180007056\nadd ecx, r11d ; +0x189, 0x180007059\ncmp ecx, r10d ; +0x18c, 0x18000705c\nlea ecx, [r11+r11] ; +0x18f, 0x18000705f\njb loc_180006F70 ; +0x193, 0x180007063\nmovzx esi, [rbp+60h+var_60] ; +0x199, 0x180007069\ncmp ax, si ; +0x19d, 0x18000706d\njnb short loc_1800070A1 ; +0x1a0, 0x180007070\nmovzx edx, ax ; +0x1a2, 0x180007072\nmov r9, rdi ; +0x1a5, 0x180007075\nadd rdx, rbx ; +0x1a8, 0x180007078\nsub r9, rbx ; +0x1ab, 0x18000707b\nmovzx ecx, si ; +0x1ae, 0x18000707e\nsub cx, ax ; +0x1b1, 0x180007081\nmovzx r8d, cx ; +0x1b4, 0x180007084\nnop dword ptr [rax+rax+00000000h] ; +0x1b8, 0x180007088\nmovzx eax, byte ptr [r9+rdx] ; +0x1c0, 0x180007090\nmov [rdx], al ; +0x1c5, 0x180007095\nlea rdx, [rdx+1] ; +0x1c7, 0x180007097\nsub r8, 1 ; +0x1cb, 0x18000709b\njnz short loc_180007090 ; +0x1cf, 0x18000709f\nmov ecx, [rbp+60h+var_58] ; +0x1d1, 0x1800070a1\nmov rax, rdi ; +0x1d4, 0x1800070a4\nmov rdx, [rbp+60h+var_48] ; +0x1d7, 0x1800070a7\nadd cx, cx ; +0x1db, 0x1800070ab\nmov [rbp+60h+var_58], ecx ; +0x1de, 0x1800070ae\nmov rdi, rbx ; +0x1e1, 0x1800070b1\nmov rbx, rax ; +0x1e4, 0x1800070b4\nmov eax, 0 ; +0x1e7, 0x1800070b7\ncmp cx, si ; +0x1ec, 0x1800070bc\njb loc_180006F53 ; +0x1ef, 0x1800070bf\nmovzx r8d, si ; +0x1f5, 0x1800070c5\ncmp rbx, [rbp+60h+var_38] ; +0x1f9, 0x1800070c9\njnz short loc_1800070F0 ; +0x1fd, 0x1800070cd\ncmp ax, si ; +0x1ff, 0x1800070cf\njnb short loc_1800070F0 ; +0x202, 0x1800070d2\nsub rdi, rbx ; +0x204, 0x1800070d4\nnop word ptr [rax+rax+00000000h] ; +0x207, 0x1800070d7\nmovzx eax, byte ptr [rbx+rdi] ; +0x210, 0x1800070e0\nmov [rbx], al ; +0x214, 0x1800070e4\nlea rbx, [rbx+1] ; +0x216, 0x1800070e6\nsub r8, 1 ; +0x21a, 0x1800070ea\njnz short loc_1800070E0 ; +0x21e, 0x1800070ee\nmov rcx, [rbp+60h+var_30] ; +0x220, 0x1800070f0\nxor rcx, rbp; StackCookie ; +0x224, 0x1800070f4\ncall __security_check_cookie ; +0x227, 0x1800070f7\nmov rbx, [rbp+60h+arg_0] ; +0x22c, 0x1800070fc\nmov rsi, [rbp+60h+arg_8] ; +0x230, 0x180007100\nmov rdi, [rbp+60h+arg_10] ; +0x234, 0x180007104\nlea rsp, [rbp+40h] ; +0x23b, 0x18000710b\npop r15 ; +0x23f, 0x18000710f\npop r14 ; +0x241, 0x180007111\npop r13 ; +0x243, 0x180007113\npop r12 ; +0x245, 0x180007115\npop rbp ; +0x247, 0x180007117\nretn ; +0x248, 0x180007118", "xrefs": ["sub_180006640 @ 0x18000697f", " @ 0x1801f6348"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}