# Binary bomb lab, can't find starting number and having problem recognizing pattern

The following is the assembly dump of a binary bomb from bomb lab Basically, you have to come up with a 6 number sequence to defuse the bomb, however, I am having trouble finding the first number and understanding the pattern.

I added some quick comments to the right to help EDIT: It seems like rbx is increased by 0x4 every time, 5 times, from my understanding that should mean that rbx is initialized at 0

`````` 400f0c:       41 54                   push   %r12
400f0e:       55                      push   %rbp
400f0f:       53                      push   %rbx
400f10:       48 83 ec 20             sub    \$0x20,%rsp
400f14:       48 89 e6                mov    %rsp,%rsi
400f17:       e8 ac 06 00 00          callq  4015c8 <read_six_numbers>        reads numbers as "%d %d %d %d %d %d"
400f1c:       8b 44 24 04             mov    0x4(%rsp),%eax                   move first number to eax
400f20:       39 04 24                cmp    %eax,(%rsp)                      compare eax to rsp
400f23:       74 06                   je     400f2b <phase_2+0x1f>            explode if equal
400f25:       3b 44 24 08             cmp    0x8(%rsp),%eax                   compare second number to eax
400f29:       75 26                   jne    400f51 <phase_2+0x45>            Jump to f51 step 1 if they're not equal
400f2b:       e8 62 06 00 00          callq  401592 <explode_bomb>            not good
400f30:       eb 1f                   jmp    400f51 <phase_2+0x45>
400f32:       48 89 e8                mov    %rbp,%rax                        f32 step 4
400f35:       48 29 d8                sub    %rbx,%rax                        subtract rbx from rax (addresses)
400f38:       8b 00                   mov    (%rax),%eax                      put rax into eax
400f3a:       41 39 04 1c             cmp    %eax,(%r12,%rbx,1)               compare eax to array r12[rbx] (is 1 just a multiplier?)
400f3e:       74 05                   je     400f45 <phase_2+0x39>            jump if equal
400f40:       e8 4d 06 00 00          callq  401592 <explode_bomb>            not good
400f45:       48 83 c3 04             add    \$0x4,%rbx                        add 4 to rbx step 5
400f49:       48 83 fb 14             cmp    \$0x14,%rbx                       check if rbx==14, if equal phase is defused, last number is 14
400f4d:       75 e3                   jne    400f32 <phase_2+0x26>            go back to f32 loop until end
400f4f:       eb 11                   jmp    400f62 <phase_2+0x56>
400f51:       bb 00 00 00 00          mov    \$0x0,%ebx                        ebx=0           f51 step 2
400f56:       4c 8d 64 24 04          lea    0x4(%rsp),%r12                   move first number address to r12
400f5b:       48 8d 6c 24 10          lea    0x10(%rsp),%rbp                  move rsp+0x10 to rbp