title: Bomblab Phase 4
body: <p>Working on dissembled code, I understand that my second input has to be between 2 and 4, I need help working through how to get my first input. The input is two ints  </p>
  
  <pre><code>   0x0000000000401128 &lt;+4&gt;: lea    rcx,[rsp+0x14]
     0x000000000040112d &lt;+9&gt;: lea    rdx,[rsp+0x10]
     0x0000000000401132 &lt;+14&gt;:    mov    esi,0x40271a
     0x0000000000401137 &lt;+19&gt;:    mov    eax,0x0
     0x000000000040113c &lt;+24&gt;:    call   0x400b80 &lt;sscanf@plt&gt;
     0x0000000000401141 &lt;+29&gt;:    cmp    eax,0x2
     0x0000000000401144 &lt;+32&gt;:    jne    0x401154 &lt;phase_4+48&gt;
     0x0000000000401146 &lt;+34&gt;:    mov    eax,DWORD PTR [rsp+0x14]
     0x000000000040114a &lt;+38&gt;:    cmp    eax,0x1
     0x000000000040114d &lt;+41&gt;:    jle    0x401154 &lt;phase_4+48&gt;
     0x000000000040114f &lt;+43&gt;:    cmp    eax,0x4
     0x0000000000401152 &lt;+46&gt;:    jle    0x401159 &lt;phase_4+53&gt;
     0x0000000000401154 &lt;+48&gt;:    call   0x401432 &lt;explode_bomb&gt;
     0x0000000000401159 &lt;+53&gt;:    mov    esi,DWORD PTR [rsp+0x14]
     0x000000000040115d &lt;+57&gt;:    mov    edi,0x5
     0x0000000000401162 &lt;+62&gt;:    call   0x400e70 &lt;func4&gt;
     0x0000000000401167 &lt;+67&gt;:    cmp    eax,DWORD PTR [rsp+0x10]
     0x000000000040116b &lt;+71&gt;:    je     0x401172 &lt;phase_4+78&gt;
     0x000000000040116d &lt;+73&gt;:    call   0x401432 &lt;explode_bomb&gt;
     0x0000000000401172 &lt;+78&gt;:    add    rsp,0x18
     0x0000000000401176 &lt;+82&gt;:    ret    
  </code></pre>
  
  <p>Function 4</p>
  
  <pre><code>x0000000000400e70 &lt;+0&gt;: mov    QWORD PTR [rsp-0x18],rbx
     0x0000000000400e75 &lt;+5&gt;: mov    QWORD PTR [rsp-0x10],rbp
     0x0000000000400e7a &lt;+10&gt;:    mov    QWORD PTR [rsp-0x8],r12
     0x0000000000400e7f &lt;+15&gt;:    sub    rsp,0x18
     0x0000000000400e83 &lt;+19&gt;:    mov    ebp,edi
     0x0000000000400e85 &lt;+21&gt;:    mov    r12d,esi
     0x0000000000400e88 &lt;+24&gt;:    test   edi,edi
     0x0000000000400e8a &lt;+26&gt;:    jg     0x400e94 &lt;func4+36&gt;
     0x0000000000400e8c &lt;+28&gt;:    mov    r12d,0x0
     0x0000000000400e92 &lt;+34&gt;:    jmp    0x400eb7 &lt;func4+71&gt;
     0x0000000000400e94 &lt;+36&gt;:    cmp    edi,0x1
     0x0000000000400e97 &lt;+39&gt;:    je     0x400eb7 &lt;func4+71&gt;
     0x0000000000400e99 &lt;+41&gt;:    lea    edi,[rbp-0x1]
     0x0000000000400e9c &lt;+44&gt;:    nop    DWORD PTR [rax+0x0]
     0x0000000000400ea0 &lt;+48&gt;:    call   0x400e70 &lt;func4&gt;
     0x0000000000400ea5 &lt;+53&gt;:    mov    ebx,eax
     0x0000000000400ea7 &lt;+55&gt;:    lea    edi,[rbp-0x2]
     0x0000000000400eaa &lt;+58&gt;:    mov    esi,r12d
     0x0000000000400ead &lt;+61&gt;:    call   0x400e70 &lt;func4&gt;
     0x0000000000400eb2 &lt;+66&gt;:    add    eax,ebx
     0x0000000000400eb4 &lt;+68&gt;:    add    r12d,eax
     0x0000000000400eb7 &lt;+71&gt;:    mov    eax,r12d
     0x0000000000400eba &lt;+74&gt;:    mov    rbx,QWORD PTR [rsp]
     0x0000000000400ebe &lt;+78&gt;:    mov    rbp,QWORD PTR [rsp+0x8]
     0x0000000000400ec3 &lt;+83&gt;:    mov    r12,QWORD PTR [rsp+0x10]
     0x0000000000400ec8 &lt;+88&gt;:    add    rsp,0x18
     0x0000000000400ecc &lt;+92&gt;:    ret    
  </code></pre>
  
  <p>I know that it's a recursive function and everything, however, I can't quite figure out what func4 is doing, even after getting the info on all registers throughout every step.</p>