; ; sub_180008050 from 0x180008050 to 0x1800084e5 (1173 bytes) ; ; 2 xrefs: ; > sub_180003F70 @ 0x1800040e2 ; > @ 0x1801f63cc ; ; This function is hookable on this platform! ; ; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA ; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings ; push rbp ; +0x0, 0x180008050 push r12 ; +0x2, 0x180008052 push r13 ; +0x4, 0x180008054 push r14 ; +0x6, 0x180008056 push r15 ; +0x8, 0x180008058 sub rsp, 90h ; +0xa, 0x18000805a lea rbp, [rsp+30h] ; +0x11, 0x180008061 mov [rbp+80h+arg_0], rbx ; +0x16, 0x180008066 mov [rbp+80h+arg_8], rsi ; +0x1d, 0x18000806d mov [rbp+80h+arg_10], rdi ; +0x24, 0x180008074 mov rax, cs:__security_cookie ; +0x2b, 0x18000807b xor rax, rbp ; +0x32, 0x180008082 mov [rbp+80h+var_28], rax ; +0x35, 0x180008085 mov r13, [rcx] ; +0x39, 0x180008089 mov r14, rcx ; +0x3c, 0x18000808c mov rdi, r8 ; +0x3f, 0x18000808f mov [rbp+80h+var_48], rdx ; +0x42, 0x180008092 mov [rbp+80h+var_30], r13 ; +0x46, 0x180008096 mov rdx, 0FFFFFFFFFFFFFF0h ; +0x4a, 0x18000809a mov rcx, [r13+20h] ; +0x54, 0x1800080a4 movsxd rax, dword ptr [r14+28h] ; +0x58, 0x1800080a8 mov [rbp+80h+var_68], rcx ; +0x5c, 0x1800080ac mov eax, [rcx+rax*4] ; +0x60, 0x1800080b0 movsxd rcx, dword ptr [r13+4] ; +0x63, 0x1800080b3 mov [rbp+80h+var_78], eax ; +0x67, 0x1800080b7 lea r8, ds:0[rcx*8] ; +0x6a, 0x1800080ba lea rax, [r8+0Fh] ; +0x72, 0x1800080c2 cmp rax, r8 ; +0x76, 0x1800080c6 ja short loc_1800080CE ; +0x79, 0x1800080c9 mov rax, rdx ; +0x7b, 0x1800080cb and rax, 0FFFFFFFFFFFFFFF0h ; +0x7e, 0x1800080ce call __alloca_probe ; +0x82, 0x1800080d2 sub rsp, rax ; +0x87, 0x1800080d7 lea rcx, ds:0[rcx*4] ; +0x8a, 0x1800080da lea rax, [rsp+0B0h+var_80] ; +0x92, 0x1800080e2 mov [rbp+80h+var_50], rax ; +0x97, 0x1800080e7 lea rax, [rcx+0Fh] ; +0x9b, 0x1800080eb cmp rax, rcx ; +0x9f, 0x1800080ef ja short loc_1800080F7 ; +0xa2, 0x1800080f2 mov rax, rdx ; +0xa4, 0x1800080f4 and rax, 0FFFFFFFFFFFFFFF0h ; +0xa7, 0x1800080f7 call __alloca_probe ; +0xab, 0x1800080fb sub rsp, rax ; +0xb0, 0x180008100 lea rax, [rsp+0B0h+var_80] ; +0xb3, 0x180008103 mov [rbp+80h+var_58], rax ; +0xb8, 0x180008108 lea rax, [rcx+0Fh] ; +0xbc, 0x18000810c cmp rax, rcx ; +0xc0, 0x180008110 ja short loc_180008118 ; +0xc3, 0x180008113 mov rax, rdx ; +0xc5, 0x180008115 and rax, 0FFFFFFFFFFFFFFF0h ; +0xc8, 0x180008118 call __alloca_probe ; +0xcc, 0x18000811c sub rsp, rax ; +0xd1, 0x180008121 lea rax, [r8+0Fh] ; +0xd4, 0x180008124 lea r12, [rsp+0B0h+var_80] ; +0xd8, 0x180008128 cmp rax, r8 ; +0xdd, 0x18000812d ja short loc_180008135 ; +0xe0, 0x180008130 mov rax, rdx ; +0xe2, 0x180008132 and rax, 0FFFFFFFFFFFFFFF0h ; +0xe5, 0x180008135 call __alloca_probe ; +0xe9, 0x180008139 sub rsp, rax ; +0xee, 0x18000813e mov ecx, 3 ; +0xf1, 0x180008141 lea rax, [rsp+0B0h+var_80] ; +0xf6, 0x180008146 mov [rbp+80h+var_60], rax ; +0xfb, 0x18000814b call sub_1800C0A10 ; +0xff, 0x18000814f test eax, eax ; +0x104, 0x180008154 jz short loc_180008165 ; +0x106, 0x180008156 lea rax, off_1801A4258 ; +0x108, 0x180008158 mov [rbp+80h+var_70], rax ; +0x10f, 0x18000815f jmp short loc_1800081A2 ; +0x113, 0x180008163 mov ecx, 2 ; +0x115, 0x180008165 call sub_1800C0A10 ; +0x11a, 0x18000816a test eax, eax ; +0x11f, 0x18000816f jz short loc_180008180 ; +0x121, 0x180008171 lea rax, off_1801A4240 ; +0x123, 0x180008173 mov [rbp+80h+var_70], rax ; +0x12a, 0x18000817a jmp short loc_1800081A2 ; +0x12e, 0x18000817e mov ecx, 1 ; +0x130, 0x180008180 call sub_1800C0A10 ; +0x135, 0x180008185 test eax, eax ; +0x13a, 0x18000818a lea rdx, off_1801A4228 ; +0x13c, 0x18000818c lea rcx, off_1801A4210 ; +0x143, 0x180008193 cmovnz rcx, rdx ; +0x14a, 0x18000819a mov [rbp+80h+var_70], rcx ; +0x14e, 0x18000819e xor ebx, ebx ; +0x152, 0x1800081a2 mov r15d, ebx ; +0x154, 0x1800081a4 cmp [r13+4], ebx ; +0x157, 0x1800081a7 jle loc_18000829C ; +0x15b, 0x1800081ab movsxd rax, [rbp+80h+var_78] ; +0x161, 0x1800081b1 mov esi, ebx ; +0x165, 0x1800081b5 shl rax, 2 ; +0x167, 0x1800081b7 shr rax, 1 ; +0x16b, 0x1800081bb mov [rbp+80h+Size], rax ; +0x16e, 0x1800081be mov dword ptr [rbp+80h+var_80], ebx ; +0x172, 0x1800081c2 cmp dword ptr [rdi], 1 ; +0x175, 0x1800081c5 mov rcx, rbx ; +0x178, 0x1800081c8 jle short loc_1800081D5 ; +0x17b, 0x1800081cb mov rax, [rdi+8] ; +0x17d, 0x1800081cd movzx ecx, byte ptr [rax+rsi] ; +0x181, 0x1800081d1 mov rax, [rdi+10h] ; +0x185, 0x1800081d5 movsx rdx, byte ptr [rax+rcx*2] ; +0x189, 0x1800081d9 mov rcx, [rbp+80h+var_68] ; +0x18e, 0x1800081de mov rax, [rcx+30h] ; +0x192, 0x1800081e2 cmp [rdx+rax], bl ; +0x196, 0x1800081e6 jz short loc_18000825D ; +0x199, 0x1800081e9 mov rcx, [rcx+38h] ; +0x19b, 0x1800081eb lea rax, ds:0[rdx*8] ; +0x19f, 0x1800081ef mov [rbp+80h+var_40], rax ; +0x1a7, 0x1800081f7 mov rcx, [rcx+rax] ; +0x1ab, 0x1800081fb call sub_180006EC0 ; +0x1af, 0x1800081ff movsxd rcx, eax ; +0x1b4, 0x180008204 shl rcx, 2 ; +0x1b7, 0x180008207 lea rax, [rcx+0Fh] ; +0x1bb, 0x18000820b cmp rax, rcx ; +0x1bf, 0x18000820f ja short loc_18000821E ; +0x1c2, 0x180008212 mov rax, 0FFFFFFFFFFFFFF0h ; +0x1c4, 0x180008214 and rax, 0FFFFFFFFFFFFFFF0h ; +0x1ce, 0x18000821e call __alloca_probe ; +0x1d2, 0x180008222 mov r8, [rbp+80h+var_68] ; +0x1d7, 0x180008227 sub rsp, rax ; +0x1db, 0x18000822b mov rax, [rbp+80h+var_60] ; +0x1de, 0x18000822e mov rcx, r14 ; +0x1e2, 0x180008232 mov rdx, [rbp+80h+var_48] ; +0x1e5, 0x180008235 lea r9, [rsp+0B0h+var_80] ; +0x1e9, 0x180008239 mov [rax+rsi*8], r9 ; +0x1ee, 0x18000823e mov r8, [r8+38h] ; +0x1f2, 0x180008242 mov rax, [rbp+80h+var_40] ; +0x1f6, 0x180008246 mov r8, [r8+rax] ; +0x1fa, 0x18000824a call sub_180006A40 ; +0x1fe, 0x18000824e mov rcx, [rbp+80h+var_60] ; +0x203, 0x180008253 mov [rcx+rsi*8], rax ; +0x207, 0x180008257 jmp short loc_180008261 ; +0x20b, 0x18000825b mov rcx, [rbp+80h+var_60] ; +0x20d, 0x18000825d mov r8, [rbp+80h+Size]; Size ; +0x211, 0x180008261 mov eax, ebx ; +0x215, 0x180008265 cmp [rcx+rsi*8], rax ; +0x217, 0x180008267 movsxd rcx, dword ptr [rbp+80h+var_80] ; +0x21b, 0x18000826b setnz al ; +0x21f, 0x18000826f xor edx, edx; Val ; +0x222, 0x180008272 mov [r12+rsi*4], eax ; +0x224, 0x180008274 mov rax, [r14+8] ; +0x228, 0x180008278 lea rcx, [rax+rcx*4]; void * ; +0x22c, 0x18000827c call memset ; +0x230, 0x180008280 add dword ptr [rbp+80h+var_80], 400h ; +0x235, 0x180008285 inc r15d ; +0x23c, 0x18000828c inc rsi ; +0x23f, 0x18000828f cmp r15d, [r13+4] ; +0x242, 0x180008292 jl loc_1800081C5 ; +0x246, 0x180008296 mov eax, [rdi+18h] ; +0x24c, 0x18000829c mov r8d, ebx ; +0x24f, 0x18000829f test eax, eax ; +0x252, 0x1800082a2 jle short loc_1800082F7 ; +0x254, 0x1800082a4 mov rdx, rbx ; +0x256, 0x1800082a6 nop dword ptr [rax+00000000h] ; +0x259, 0x1800082a9 mov rcx, [rdi+20h] ; +0x260, 0x1800082b0 movzx eax, byte ptr [rcx+rdx] ; +0x264, 0x1800082b4 cmp [r12+rax*4], ebx ; +0x268, 0x1800082b8 lea r9, [r12+rax*4] ; +0x26c, 0x1800082bc jnz short loc_1800082D0 ; +0x270, 0x1800082c0 movzx eax, byte ptr [rcx+rdx+1] ; +0x272, 0x1800082c2 cmp [r12+rax*4], ebx ; +0x277, 0x1800082c7 jz short loc_1800082E8 ; +0x27b, 0x1800082cb nop dword ptr [rax] ; +0x27d, 0x1800082cd mov dword ptr [r9], 1 ; +0x280, 0x1800082d0 mov rax, [rdi+20h] ; +0x287, 0x1800082d7 movzx ecx, byte ptr [rdx+rax+1] ; +0x28b, 0x1800082db mov dword ptr [r12+rcx*4], 1 ; +0x290, 0x1800082e0 mov eax, [rdi+18h] ; +0x298, 0x1800082e8 inc r8d ; +0x29b, 0x1800082eb add rdx, 2 ; +0x29e, 0x1800082ee cmp r8d, eax ; +0x2a2, 0x1800082f2 jl short loc_1800082B0 ; +0x2a5, 0x1800082f5 mov r15d, ebx ; +0x2a7, 0x1800082f7 cmp [rdi], ebx ; +0x2aa, 0x1800082fa jle loc_1800083CD ; +0x2ac, 0x1800082fc mov [rbp+80h+var_80], rbx ; +0x2b2, 0x180008302 nop word ptr [rax+rax+00000000h] ; +0x2b6, 0x180008306 mov rdx, rbx ; +0x2c0, 0x180008310 mov esi, ebx ; +0x2c3, 0x180008313 mov r8d, ebx ; +0x2c5, 0x180008315 cmp [r13+4], edx ; +0x2c8, 0x180008318 jle short loc_18000837E ; +0x2cc, 0x18000831c mov r11, [rbp+80h+var_50] ; +0x2ce, 0x18000831e mov r9d, ebx ; +0x2d2, 0x180008322 mov r10, rbx ; +0x2d5, 0x180008325 nop dword ptr [rax+rax+00000000h] ; +0x2d8, 0x180008328 mov rax, [rdi+8] ; +0x2e0, 0x180008330 test rax, rax ; +0x2e4, 0x180008334 jz short loc_180008342 ; +0x2e7, 0x180008337 movzx eax, byte ptr [rax+rdx] ; +0x2e9, 0x180008339 cmp eax, r15d ; +0x2ed, 0x18000833d jnz short loc_18000836B ; +0x2f0, 0x180008340 cmp [r12+rdx*4], ebx ; +0x2f2, 0x180008342 mov eax, ebx ; +0x2f6, 0x180008346 mov rcx, [rbp+80h+var_58] ; +0x2f8, 0x180008348 setnz al ; +0x2fc, 0x18000834c inc esi ; +0x2ff, 0x18000834f mov [r10+rcx], eax ; +0x301, 0x180008351 add r10, 4 ; +0x305, 0x180008355 mov rax, [r14+8] ; +0x309, 0x180008359 movsxd rcx, r9d ; +0x30d, 0x18000835d lea rcx, [rax+rcx*4] ; +0x310, 0x180008360 mov [r11], rcx ; +0x314, 0x180008364 add r11, 8 ; +0x317, 0x180008367 inc r8d ; +0x31b, 0x18000836b add r9d, 400h ; +0x31e, 0x18000836e inc rdx ; +0x325, 0x180008375 cmp r8d, [r13+4] ; +0x328, 0x180008378 jl short loc_180008330 ; +0x32c, 0x18000837c mov rax, [rdi+10h] ; +0x32e, 0x18000837e mov rcx, [rbp+80h+var_80] ; +0x332, 0x180008382 mov r9, [rbp+80h+var_50] ; +0x336, 0x180008386 mov [rsp+0B0h+var_88], esi ; +0x33a, 0x18000838a movsx rcx, byte ptr [rax+rcx+1] ; +0x33e, 0x18000838e mov rax, [rbp+80h+var_68] ; +0x344, 0x180008394 lea rdx, [rcx+rcx*4] ; +0x348, 0x180008398 mov rcx, r14 ; +0x34c, 0x18000839c mov rax, [rax+40h] ; +0x34f, 0x18000839f lea r8, [rax+rdx*8] ; +0x353, 0x1800083a3 mov rax, [rbp+80h+var_58] ; +0x357, 0x1800083a7 mov rdx, [rbp+80h+var_48] ; +0x35b, 0x1800083ab mov [rsp+0B0h+var_90], rax ; +0x35f, 0x1800083af call sub_180009770 ; +0x364, 0x1800083b4 add [rbp+80h+var_80], 2 ; +0x369, 0x1800083b9 inc r15d ; +0x36e, 0x1800083be cmp r15d, [rdi] ; +0x371, 0x1800083c1 jl loc_180008310 ; +0x374, 0x1800083c4 mov eax, [rdi+18h] ; +0x37a, 0x1800083ca sub eax, 1 ; +0x37d, 0x1800083cd movsxd rsi, eax ; +0x380, 0x1800083d0 js short loc_18000840E ; +0x383, 0x1800083d3 mov r13d, [rbp+80h+var_78] ; +0x385, 0x1800083d5 mov r15, [rbp+80h+var_70] ; +0x389, 0x1800083d9 sar r13d, 1 ; +0x38d, 0x1800083dd mov rax, [rdi+20h] ; +0x390, 0x1800083e0 mov r8d, r13d ; +0x394, 0x1800083e4 movzx edx, byte ptr [rax+rsi*2+1] ; +0x397, 0x1800083e7 movzx ecx, byte ptr [rax+rsi*2] ; +0x39c, 0x1800083ec shl rdx, 0Ch ; +0x3a0, 0x1800083f0 add rdx, [r14+8] ; +0x3a4, 0x1800083f4 shl rcx, 0Ch ; +0x3a8, 0x1800083f8 add rcx, [r14+8] ; +0x3ac, 0x1800083fc call qword ptr [r15+10h] ; +0x3b0, 0x180008400 sub rsi, 1 ; +0x3b4, 0x180008404 jns short loc_1800083E0 ; +0x3b8, 0x180008408 mov r13, [rbp+80h+var_30] ; +0x3ba, 0x18000840a mov eax, [r13+4] ; +0x3be, 0x18000840e mov r15d, ebx ; +0x3c2, 0x180008412 test eax, eax ; +0x3c5, 0x180008415 jle loc_1800084B4 ; +0x3c7, 0x180008417 mov rsi, rbx ; +0x3cd, 0x18000841d mov r12d, ebx ; +0x3d0, 0x180008420 cmp dword ptr [rdi], 1 ; +0x3d3, 0x180008423 mov rcx, rbx ; +0x3d6, 0x180008426 jle short loc_180008433 ; +0x3d9, 0x180008429 mov rax, [rdi+8] ; +0x3db, 0x18000842b movzx ecx, byte ptr [rax+rsi] ; +0x3df, 0x18000842f mov rax, [rdi+10h] ; +0x3e3, 0x180008433 mov rdx, [rbp+80h+var_68] ; +0x3e7, 0x180008437 movsx r10, byte ptr [rax+rcx*2] ; +0x3eb, 0x18000843b mov rax, [rdx+30h] ; +0x3f0, 0x180008440 cmp [r10+rax], bl ; +0x3f4, 0x180008444 jz short loc_18000846E ; +0x3f8, 0x180008448 mov rax, [r14+8] ; +0x3fa, 0x18000844a mov rdx, [rdx+38h] ; +0x3fe, 0x18000844e movsxd rcx, r12d ; +0x402, 0x180008452 mov rdx, [rdx+r10*8] ; +0x405, 0x180008455 lea r9, [rax+rcx*4] ; +0x409, 0x180008459 mov rax, [rbp+80h+var_60] ; +0x40d, 0x18000845d mov rcx, r14 ; +0x411, 0x180008461 mov r8, [rax+rsi*8] ; +0x414, 0x180008464 mov rax, [rbp+80h+var_70] ; +0x418, 0x180008468 call qword ptr [rax] ; +0x41c, 0x18000846c mov eax, [r13+4] ; +0x41e, 0x18000846e inc r15d ; +0x422, 0x180008472 add r12d, 400h ; +0x425, 0x180008475 inc rsi ; +0x42c, 0x18000847c cmp r15d, eax ; +0x42f, 0x18000847f jl short loc_180008423 ; +0x432, 0x180008482 test eax, eax ; +0x434, 0x180008484 jle short loc_1800084B4 ; +0x436, 0x180008486 mov edi, ebx ; +0x438, 0x180008488 nop word ptr [rax+rax+00h] ; +0x43a, 0x18000848a mov rax, [r14+8] ; +0x440, 0x180008490 movsxd rcx, edi ; +0x444, 0x180008494 lea rdx, [rax+rcx*4] ; +0x447, 0x180008497 mov rax, [rbp+80h+var_70] ; +0x44b, 0x18000849b mov ecx, [r14+28h] ; +0x44f, 0x18000849f call qword ptr [rax+8] ; +0x453, 0x1800084a3 inc ebx ; +0x456, 0x1800084a6 add edi, 400h ; +0x458, 0x1800084a8 cmp ebx, [r13+4] ; +0x45e, 0x1800084ae jl short loc_180008490 ; +0x462, 0x1800084b2 xor eax, eax ; +0x464, 0x1800084b4 mov rcx, [rbp+80h+var_28] ; +0x466, 0x1800084b6 xor rcx, rbp; StackCookie ; +0x46a, 0x1800084ba call __security_check_cookie ; +0x46d, 0x1800084bd mov rbx, [rbp+80h+arg_0] ; +0x472, 0x1800084c2 mov rsi, [rbp+80h+arg_8] ; +0x479, 0x1800084c9 mov rdi, [rbp+80h+arg_10] ; +0x480, 0x1800084d0 lea rsp, [rbp+60h] ; +0x487, 0x1800084d7 pop r15 ; +0x48b, 0x1800084db pop r14 ; +0x48d, 0x1800084dd pop r13 ; +0x48f, 0x1800084df pop r12 ; +0x491, 0x1800084e1 pop rbp ; +0x493, 0x1800084e3 retn ; +0x494, 0x1800084e4