// File: /workspace/github_c_makefile_star2_O0/jsummers[P]deark/src/fmtutil-exe.c
// Function: detect_execomp_exepack
static void detect_execomp_exepack(deark *c,
	struct fmtutil_exe_info *ei, struct fmtutil_specialexe_detection_data *edd)
{
	u8 known_crc = 0;
	int has_RB = 0;
	int ret;
	i64 foundpos;

	if(ei->num_relocs!=0) goto done;
	if(ei->regIP!=16 && ei->regIP!=18) goto done;

	if(dbuf_getu16be(ei->f, ei->entry_point-2) == 0x5242) {
		has_RB = 1;
	}

	// If the first 64 bytes are recognized, we'll be less strict about
	// other things.
	switch(ei->entrypoint_crcs) {
	case 0xa6ea214e6c16ee72LLU: // common290
	case 0x4e04abaac5d3b465LLU: // common283
	case 0x1f449ca73852e197LLU: // common258,279,277
		known_crc = 1;
	}

	if(known_crc) {
		;
	}
	else if(ei->regSP==128 && has_RB) {
		;
	}
	else {
		goto done;
	}

	// OK so far, now look for the "epilog"

	// Known starting offsets are from ep+219 (EXPAKFIX) to ep+262(unknown291).
	ret = dbuf_search(ei->f, (const u8*)"\xcd\x21\xb8\xff\x4c\xcd\x21", 7,
		ei->entry_point+200, 100,
		&foundpos);
	if(!ret) goto done;
	edd->special_pos_1 = foundpos;

	edd->detected_fmt = DE_SPECIALEXEFMT_EXEPACK;

done:
	if(edd->detected_fmt==DE_SPECIALEXEFMT_EXEPACK) {
#ifdef DE_EXECOMP_DEVMODE
		de_dbg(c, "epvar: %u", (UI)edd->detected_subfmt);
#endif
		de_strlcpy(edd->detected_fmt_name, "EXEPACK", sizeof(edd->detected_fmt_name));
		edd->modname = "exepack";
	}
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x40, %rsp
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq %rdx, -0x18(%rbp)
movb $0x0, -0x19(%rbp)
movl $0x0, -0x20(%rbp)
movq -0x10(%rbp), %rax
cmpq $0x0, 0x8(%rax)
je 0x18974f
jmp 0x18984e
movq -0x10(%rbp), %rax
cmpq $0x10, 0x28(%rax)
je 0x18976a
movq -0x10(%rbp), %rax
cmpq $0x12, 0x28(%rax)
je 0x18976a
jmp 0x18984e
movq -0x10(%rbp), %rax
movq (%rax), %rdi
movq -0x10(%rbp), %rax
movq 0x40(%rax), %rsi
subq $0x2, %rsi
callq 0x1651d0
cmpq $0x5242, %rax           # imm = 0x5242
jne 0x189791
movl $0x1, -0x20(%rbp)
movq -0x10(%rbp), %rax
movq 0x68(%rax), %rax
movq %rax, -0x38(%rbp)
movabsq $-0x5915deb193e9118e, %rcx # imm = 0xA6EA214E6C16EE72
subq %rcx, %rax
je 0x1897d8
jmp 0x1897ae
movq -0x38(%rbp), %rax
movabsq $0x1f449ca73852e197, %rcx # imm = 0x1F449CA73852E197
subq %rcx, %rax
je 0x1897d8
jmp 0x1897c3
movq -0x38(%rbp), %rax
movabsq $0x4e04abaac5d3b465, %rcx # imm = 0x4E04ABAAC5D3B465
subq %rcx, %rax
jne 0x1897dc
jmp 0x1897d8
movb $0x1, -0x19(%rbp)
cmpb $0x0, -0x19(%rbp)
je 0x1897e4
jmp 0x1897fe
movq -0x10(%rbp), %rax
cmpq $0x80, 0x18(%rax)
jne 0x1897fa
cmpl $0x0, -0x20(%rbp)
je 0x1897fa
jmp 0x1897fc
jmp 0x18984e
jmp 0x1897fe
movq -0x10(%rbp), %rax
movq (%rax), %rdi
movq -0x10(%rbp), %rax
movq 0x40(%rax), %rcx
addq $0xc8, %rcx
leaq 0x4e27e(%rip), %rsi     # 0x1d7a99
movl $0x7, %edx
movl $0x64, %r8d
leaq -0x30(%rbp), %r9
callq 0x169370
movl %eax, -0x24(%rbp)
cmpl $0x0, -0x24(%rbp)
jne 0x18983a
jmp 0x18984e
movq -0x30(%rbp), %rcx
movq -0x18(%rbp), %rax
movq %rcx, 0x20(%rax)
movq -0x18(%rbp), %rax
movb $0x3, 0x1(%rax)
movq -0x18(%rbp), %rax
movzbl 0x1(%rax), %eax
cmpl $0x3, %eax
jne 0x189883
movq -0x18(%rbp), %rdi
addq $0x50, %rdi
leaq 0x4e237(%rip), %rsi     # 0x1d7aa1
movl $0x28, %edx
callq 0x15aa30
movq -0x18(%rbp), %rax
leaq 0x1fdb6(%rip), %rcx     # 0x1a9635
movq %rcx, 0x48(%rax)
addq $0x40, %rsp
popq %rbp
retq
nopl (%rax)